# Flog Txt Version 1
# Analyzer Version: 4.4.1
# Analyzer Build Date: Jan 14 2022 06:06:11
# Log Creation Date: 18.03.2022 08:23:39.601

Process:
	id = "1"
	image_name = "b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe"
	filename = "c:\\users\\rdhj0cnfevzx\\desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe"
	page_root = "0x6abbc000"
	os_pid = "0x614"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "analysis_target"
	parent_id = "0"
	os_parent_pid = "0x4a0"
	cmd_line = "\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe\" "
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 123
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 124
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 125
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 126
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 127
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 128
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 129
	        start_va = 0x1b0000
	          end_va = 0x1b1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001b0000"
	        filename = ""

Region:
	              id = 130
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 131
	        start_va = 0x400000
	          end_va = 0x739fff
	       monitored = 1
	     entry_point = 0x44ba80
	     region_type = mapped_file
	            name = "b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe"
	        filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe")

Region:
	              id = 132
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 133
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 134
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 135
	        start_va = 0x7fff0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 136
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 137
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 275
	        start_va = 0x8d0000
	          end_va = 0x8dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000008d0000"
	        filename = ""

Region:
	              id = 276
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 277
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 278
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 279
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 280
	        start_va = 0x740000
	          end_va = 0x87ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000740000"
	        filename = ""

Region:
	              id = 281
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 282
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 283
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 284
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 285
	        start_va = 0x8e0000
	          end_va = 0x99dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 370
	        start_va = 0x743a0000
	          end_va = 0x74431fff
	       monitored = 0
	     entry_point = 0x743e0380
	     region_type = mapped_file
	            name = "apphelp.dll"
	        filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll")

Region:
	              id = 371
	        start_va = 0x7fb00000
	          end_va = 0x7fea0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sysmain.sdb"
	        filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb")

Region:
	              id = 372
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 373
	        start_va = 0x1c0000
	          end_va = 0x1fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 374
	        start_va = 0x9a0000
	          end_va = 0xa9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000009a0000"
	        filename = ""

Region:
	              id = 375
	        start_va = 0x75310000
	          end_va = 0x7536efff
	       monitored = 0
	     entry_point = 0x75314af0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 376
	        start_va = 0x6ccd0000
	          end_va = 0x6ccf3fff
	       monitored = 0
	     entry_point = 0x6ccd4820
	     region_type = mapped_file
	            name = "winmm.dll"
	        filename = "\\Windows\\SysWOW64\\winmm.dll" (normalized: "c:\\windows\\syswow64\\winmm.dll")

Region:
	              id = 377
	        start_va = 0x76ae0000
	          end_va = 0x76b23fff
	       monitored = 0
	     entry_point = 0x76af9d80
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 378
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 379
	        start_va = 0x75260000
	          end_va = 0x7530cfff
	       monitored = 0
	     entry_point = 0x75274f00
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 380
	        start_va = 0x77450000
	          end_va = 0x77596fff
	       monitored = 0
	     entry_point = 0x77461cf0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 381
	        start_va = 0x74450000
	          end_va = 0x7446dfff
	       monitored = 0
	     entry_point = 0x7445b640
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 382
	        start_va = 0x76b30000
	          end_va = 0x76c7efff
	       monitored = 0
	     entry_point = 0x76be6820
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 383
	        start_va = 0x74440000
	          end_va = 0x74449fff
	       monitored = 0
	     entry_point = 0x74442a00
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 384
	        start_va = 0x74590000
	          end_va = 0x745e7fff
	       monitored = 0
	     entry_point = 0x745d25c0
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 385
	        start_va = 0x6cca0000
	          end_va = 0x6ccc2fff
	       monitored = 0
	     entry_point = 0x6cca8940
	     region_type = mapped_file
	            name = "winmmbase.dll"
	        filename = "\\Windows\\SysWOW64\\winmmbase.dll" (normalized: "c:\\windows\\syswow64\\winmmbase.dll")

Region:
	              id = 386
	        start_va = 0x75120000
	          end_va = 0x75156fff
	       monitored = 0
	     entry_point = 0x75123b50
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll")

Region:
	              id = 387
	        start_va = 0x880000
	          end_va = 0x8cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000880000"
	        filename = ""

Region:
	              id = 388
	        start_va = 0x740000
	          end_va = 0x769fff
	       monitored = 0
	     entry_point = 0x745680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 389
	        start_va = 0x780000
	          end_va = 0x87ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000780000"
	        filename = ""

Region:
	              id = 390
	        start_va = 0xaa0000
	          end_va = 0xc27fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000aa0000"
	        filename = ""

Region:
	              id = 391
	        start_va = 0x74ea0000
	          end_va = 0x74ecafff
	       monitored = 0
	     entry_point = 0x74ea5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 392
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 393
	        start_va = 0x740000
	          end_va = 0x740fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000740000"
	        filename = ""

Region:
	              id = 394
	        start_va = 0xc30000
	          end_va = 0xdb0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000c30000"
	        filename = ""

Region:
	              id = 395
	        start_va = 0xdc0000
	          end_va = 0x21bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000dc0000"
	        filename = ""

Region:
	              id = 396
	        start_va = 0x74650000
	          end_va = 0x746cafff
	       monitored = 0
	     entry_point = 0x7466e970
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 397
	        start_va = 0x21c0000
	          end_va = 0x323c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000021c0000"
	        filename = ""

Region:
	              id = 398
	        start_va = 0x880000
	          end_va = 0x8bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000880000"
	        filename = ""

Region:
	              id = 399
	        start_va = 0x8c0000
	          end_va = 0x8cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000008c0000"
	        filename = ""

Region:
	              id = 400
	        start_va = 0x750000
	          end_va = 0x75ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000750000"
	        filename = ""

Region:
	              id = 401
	        start_va = 0x760000
	          end_va = 0x76ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000760000"
	        filename = ""

Region:
	              id = 402
	        start_va = 0x323d0000
	          end_va = 0x3240ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000323d0000"
	        filename = ""

Region:
	              id = 403
	        start_va = 0x32410000
	          end_va = 0x3250ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000032410000"
	        filename = ""

Region:
	              id = 404
	        start_va = 0x32510000
	          end_va = 0x3254ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000032510000"
	        filename = ""

Region:
	              id = 405
	        start_va = 0x32550000
	          end_va = 0x3264ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000032550000"
	        filename = ""

Region:
	              id = 406
	        start_va = 0x32650000
	          end_va = 0x3268ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000032650000"
	        filename = ""

Region:
	              id = 407
	        start_va = 0x32690000
	          end_va = 0x3278ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000032690000"
	        filename = ""

Region:
	              id = 408
	        start_va = 0x32790000
	          end_va = 0x327cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000032790000"
	        filename = ""

Region:
	              id = 409
	        start_va = 0x327d0000
	          end_va = 0x328cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000327d0000"
	        filename = ""

Region:
	              id = 410
	        start_va = 0x328d0000
	          end_va = 0x3291efff
	       monitored = 0
	     entry_point = 0x328dd850
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll")

Region:
	              id = 411
	        start_va = 0x770000
	          end_va = 0x771fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000770000"
	        filename = ""

Region:
	              id = 412
	        start_va = 0x32920000
	          end_va = 0x32920fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000032920000"
	        filename = ""

Region:
	              id = 413
	        start_va = 0x32930000
	          end_va = 0x32d2afff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000032930000"
	        filename = ""

Region:
	              id = 414
	        start_va = 0x328d0000
	          end_va = 0x3290ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000328d0000"
	        filename = ""

Region:
	              id = 2322
	        start_va = 0x32d30000
	          end_va = 0x32ddffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000032d30000"
	        filename = ""

Region:
	              id = 5825
	        start_va = 0x6ddf0000
	          end_va = 0x6de02fff
	       monitored = 0
	     entry_point = 0x6ddf9950
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll")

Region:
	              id = 5826
	        start_va = 0x1c0000
	          end_va = 0x1fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 5827
	        start_va = 0x9a0000
	          end_va = 0xa9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000009a0000"
	        filename = ""

Region:
	              id = 5828
	        start_va = 0x6d230000
	          end_va = 0x6d25efff
	       monitored = 0
	     entry_point = 0x6d2495e0
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")

Region:
	              id = 5829
	        start_va = 0x740f0000
	          end_va = 0x7410afff
	       monitored = 0
	     entry_point = 0x740f9050
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 5830
	        start_va = 0x32de0000
	          end_va = 0x33116fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 5831
	        start_va = 0x32910000
	          end_va = 0x3291ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000032910000"
	        filename = ""

Region:
	              id = 5832
	        start_va = 0x33120000
	          end_va = 0x3315ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000033120000"
	        filename = ""

Region:
	              id = 5833
	        start_va = 0x33160000
	          end_va = 0x3319ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000033160000"
	        filename = ""

Region:
	              id = 5834
	        start_va = 0x331a0000
	          end_va = 0x3329ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000331a0000"
	        filename = ""

Region:
	              id = 5835
	        start_va = 0x332a0000
	          end_va = 0x332dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000332a0000"
	        filename = ""

Region:
	              id = 5836
	        start_va = 0x332e0000
	          end_va = 0x332effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000332e0000"
	        filename = ""


Thread:
	id = 1
	os_tid = 0xb38

	[0107.088] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75600000
	[0107.089] GetProcAddress (hModule=0x75600000, lpProcName="AddDllDirectory") returned 0x755b45e0
	[0107.089] GetProcAddress (hModule=0x75600000, lpProcName="AddVectoredContinueHandler") returned 0x777d28d0
	[0107.089] GetProcAddress (hModule=0x75600000, lpProcName="GetQueuedCompletionStatusEx") returned 0x756410f0
	[0107.089] GetProcAddress (hModule=0x75600000, lpProcName="LoadLibraryExW") returned 0x75617930
	[0107.089] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74650000
	[0108.668] GetProcAddress (hModule=0x74650000, lpProcName="SystemFunction036") returned 0x74442a60
	[0108.668] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77720000
	[0108.668] GetProcAddress (hModule=0x77720000, lpProcName="NtWaitForSingleObject") returned 0x77796cc0
	[0108.668] GetProcAddress (hModule=0x77720000, lpProcName="wine_get_version") returned 0x0
	[0108.669] SetErrorMode (uMode=0x2) returned 0x0
	[0108.669] SetErrorMode (uMode=0x8003) returned 0x2
	[0108.669] RtlAddVectoredExceptionHandler (FirstHandler=0x1, VectoredHandler=0x44bbe0) returned 0x7936e8
	[0108.669] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x44bbf0) returned 0x0
	[0108.669] SetConsoleCtrlHandler (HandlerRoutine=0x44bc00, Add=1) returned 1
	[0108.669] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0108.670] GetProcessAffinityMask (in: hProcess=0xffffffff, lpProcessAffinityMask=0x19fe90, lpSystemAffinityMask=0x19fe8c | out: lpProcessAffinityMask=0x19fe90, lpSystemAffinityMask=0x19fe8c) returned 1
	[0108.670] GetSystemInfo (in: lpSystemInfo=0x19fe94 | out: lpSystemInfo=0x19fe94*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) 
	[0108.670] SetProcessPriorityBoost (hProcess=0xffffffff, bDisablePriorityBoost=1) returned 1
	[0108.671] VirtualAlloc (lpAddress=0x700000, dwSize=0x30202000, flAllocationType=0x2000, flProtect=0x4) returned 0x0
	[0108.671] VirtualAlloc (lpAddress=0x0, dwSize=0x30202000, flAllocationType=0x2000, flProtect=0x4) returned 0x21c0000
	[0108.700] VirtualAlloc (lpAddress=0x11184000, dwSize=0x123c000, flAllocationType=0x1000, flProtect=0x4) returned 0x11184000
	[0108.749] VirtualAlloc (lpAddress=0x21c0000, dwSize=0x25000, flAllocationType=0x1000, flProtect=0x4) returned 0x21c0000
	[0108.749] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x3000, flProtect=0x4) returned 0x880000
	[0108.750] VirtualAlloc (lpAddress=0x123c0000, dwSize=0x100000, flAllocationType=0x1000, flProtect=0x4) returned 0x123c0000
	[0108.752] VirtualAlloc (lpAddress=0x11174000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x11174000
	[0108.753] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x3000, flProtect=0x4) returned 0x750000
	[0108.753] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x3000, flProtect=0x4) returned 0x760000
	[0108.754] SystemFunction036 (in: RandomBuffer=0x605000, RandomBufferLength=0x40 | out: RandomBuffer=0x605000) returned 1
	[0108.754] GetEnvironmentStringsW () returned 0x7952e0*
	[0108.755] FreeEnvironmentStringsW (penv=0x7952e0) returned 1
	[0108.756] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x19fecc, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x19fecc*=0x100) returned 1
	[0108.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x100000, lpStartAddress=0x44bd00, lpParameter=0x123e4000, dwCreationFlags=0x10000, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104
	[0108.757] CloseHandle (hObject=0x104) returned 1
	[0108.758] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x100000, lpStartAddress=0x44bd00, lpParameter=0x123e4240, dwCreationFlags=0x10000, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104
	[0108.758] CloseHandle (hObject=0x104) returned 1
	[0108.758] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x100000, lpStartAddress=0x44bd00, lpParameter=0x123e4480, dwCreationFlags=0x10000, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104
	[0108.759] CloseHandle (hObject=0x104) returned 1
	[0108.759] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x104
	[0108.759] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0108.932] LoadLibraryExW (lpLibFileName="kernel32.dll", hFile=0x0, dwFlags=0x800) returned 0x75600000
	[0108.933] GetProcAddress (hModule=0x75600000, lpProcName="GetStdHandle") returned 0x7561a6e0
	[0108.933] GetStdHandle (nStdHandle=0xfffffff6) returned 0x38
	[0108.933] GetProcAddress (hModule=0x75600000, lpProcName="SetHandleInformation") returned 0x75626660
	[0108.933] SetHandleInformation (hObject=0x38, dwMask=0x1, dwFlags=0x0) returned 1
	[0108.934] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c
	[0108.934] SetHandleInformation (hObject=0x3c, dwMask=0x1, dwFlags=0x0) returned 1
	[0108.934] GetStdHandle (nStdHandle=0xfffffff4) returned 0x40
	[0108.934] SetHandleInformation (hObject=0x40, dwMask=0x1, dwFlags=0x0) returned 1
	[0108.934] LoadLibraryExW (lpLibFileName="ws2_32.dll", hFile=0x0, dwFlags=0x800) returned 0x75310000
	[0108.935] GetProcAddress (hModule=0x75310000, lpProcName="WSAStartup") returned 0x75316520
	[0108.935] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x123f5df4 | out: lpWSAData=0x123f5df4) returned 0
	[0108.956] GetProcAddress (hModule=0x75600000, lpProcName="CancelIoEx") returned 0x7561f450
	[0108.956] GetProcAddress (hModule=0x75600000, lpProcName="SetFileCompletionNotificationModes") returned 0x75619dd0
	[0108.957] GetProcAddress (hModule=0x75310000, lpProcName="WSAEnumProtocolsW") returned 0x75327ed0
	[0108.957] WSAEnumProtocolsW (in: lpiProtocols=0x1241ef58, lpProtocolBuffer=0x1241ef60, lpdwBufferLength=0x1241ef54 | out: lpProtocolBuffer=0x1241ef60, lpdwBufferLength=0x1241ef54) returned 4
	[0109.469] GetProcAddress (hModule=0x75600000, lpProcName="GetConsoleMode") returned 0x75626f70
	[0109.469] GetConsoleMode (in: hConsoleHandle=0x38, lpMode=0x12423f70 | out: lpMode=0x12423f70) returned 1
	[0109.488] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x3000, flProtect=0x4) returned 0x328d0000
	[0109.488] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0x12423f70 | out: lpMode=0x12423f70) returned 1
	[0109.499] GetConsoleMode (in: hConsoleHandle=0x40, lpMode=0x12423f70 | out: lpMode=0x12423f70) returned 1
	[0109.504] GetProcAddress (hModule=0x75600000, lpProcName="GetCommandLineW") returned 0x7561aba0
	[0109.504] GetCommandLineW () returned="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe\" "
	[0109.506] GetProcAddress (hModule=0x75600000, lpProcName="GetVersion") returned 0x7561aaf0
	[0109.506] GetVersion () returned 0x23f00206
	[0109.507] GetProcAddress (hModule=0x75600000, lpProcName="GetEnvironmentVariableW") returned 0x75619970
	[0109.507] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1243a000, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0109.507] GetProcAddress (hModule=0x75600000, lpProcName="GetFileAttributesExW") returned 0x75626a40
	[0109.507] GetFileAttributesExW (in: lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12430058 | out: lpFileInformation=0x12430058*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0109.508] GetProcAddress (hModule=0x75600000, lpProcName="CreateFileW") returned 0x75626890
	[0109.508] CreateFileW (lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0109.508] GetFileAttributesExW (in: lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), fInfoLevelId=0x0, lpFileInformation=0x124300a8 | out: lpFileInformation=0x124300a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0109.509] CreateFileW (lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0109.509] GetFileAttributesExW (in: lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), fInfoLevelId=0x0, lpFileInformation=0x124300f8 | out: lpFileInformation=0x124300f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0109.509] CreateFileW (lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0109.509] GetFileAttributesExW (in: lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), fInfoLevelId=0x0, lpFileInformation=0x12430148 | out: lpFileInformation=0x12430148*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0109.509] CreateFileW (lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0109.509] GetFileAttributesExW (in: lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x12430198 | out: lpFileInformation=0x12430198*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0109.509] CreateFileW (lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0109.510] GetFileAttributesExW (in: lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), fInfoLevelId=0x0, lpFileInformation=0x124301e8 | out: lpFileInformation=0x124301e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0109.510] CreateFileW (lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0109.510] GetFileAttributesExW (in: lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), fInfoLevelId=0x0, lpFileInformation=0x12430238 | out: lpFileInformation=0x12430238*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0109.510] CreateFileW (lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0109.510] GetFileAttributesExW (in: lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), fInfoLevelId=0x0, lpFileInformation=0x12430288 | out: lpFileInformation=0x12430288*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0109.510] CreateFileW (lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0109.510] GetFileAttributesExW (in: lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), fInfoLevelId=0x0, lpFileInformation=0x124302d8 | out: lpFileInformation=0x124302d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0109.510] CreateFileW (lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0109.511] GetFileAttributesExW (in: lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), fInfoLevelId=0x0, lpFileInformation=0x12430328 | out: lpFileInformation=0x12430328*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0109.511] CreateFileW (lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0109.511] GetFileAttributesExW (in: lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), fInfoLevelId=0x0, lpFileInformation=0x12430378 | out: lpFileInformation=0x12430378*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0109.511] CreateFileW (lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0109.511] GetFileAttributesExW (in: lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), fInfoLevelId=0x0, lpFileInformation=0x124303c8 | out: lpFileInformation=0x124303c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0109.511] CreateFileW (lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0109.511] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0x1243a0d0, nSize=0x64 | out: lpBuffer="") returned 0x63
	[0109.511] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12430418 | out: lpFileInformation=0x12430418*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0109.513] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1243a1a0, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0109.513] GetFileAttributesExW (in: lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12430468 | out: lpFileInformation=0x12430468*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0109.513] CreateFileW (lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0109.513] GetFileAttributesExW (in: lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), fInfoLevelId=0x0, lpFileInformation=0x124304b8 | out: lpFileInformation=0x124304b8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0109.514] CreateFileW (lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0109.514] GetFileAttributesExW (in: lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), fInfoLevelId=0x0, lpFileInformation=0x12430508 | out: lpFileInformation=0x12430508*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0109.514] CreateFileW (lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0109.520] GetFileAttributesExW (in: lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), fInfoLevelId=0x0, lpFileInformation=0x12430558 | out: lpFileInformation=0x12430558*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0109.520] CreateFileW (lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0109.520] GetFileAttributesExW (in: lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x124305a8 | out: lpFileInformation=0x124305a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0109.520] CreateFileW (lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0109.521] GetFileAttributesExW (in: lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), fInfoLevelId=0x0, lpFileInformation=0x124305f8 | out: lpFileInformation=0x124305f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0109.521] CreateFileW (lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0109.521] GetFileAttributesExW (in: lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), fInfoLevelId=0x0, lpFileInformation=0x12430648 | out: lpFileInformation=0x12430648*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0109.521] CreateFileW (lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0109.521] GetFileAttributesExW (in: lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), fInfoLevelId=0x0, lpFileInformation=0x12430698 | out: lpFileInformation=0x12430698*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0109.522] CreateFileW (lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0109.522] GetFileAttributesExW (in: lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), fInfoLevelId=0x0, lpFileInformation=0x124306e8 | out: lpFileInformation=0x124306e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0109.522] CreateFileW (lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0109.522] GetFileAttributesExW (in: lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), fInfoLevelId=0x0, lpFileInformation=0x12430738 | out: lpFileInformation=0x12430738*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0109.522] CreateFileW (lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0109.523] GetFileAttributesExW (in: lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), fInfoLevelId=0x0, lpFileInformation=0x12430788 | out: lpFileInformation=0x12430788*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0109.523] CreateFileW (lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0109.523] GetFileAttributesExW (in: lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), fInfoLevelId=0x0, lpFileInformation=0x124307d8 | out: lpFileInformation=0x124307d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0109.523] CreateFileW (lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0109.523] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0x1243a270, nSize=0x64 | out: lpBuffer="") returned 0x63
	[0109.523] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12430828 | out: lpFileInformation=0x12430828*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0109.523] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1243a340, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0109.523] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12430878 | out: lpFileInformation=0x12430878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0109.537] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130
	[0109.538] GetConsoleMode (in: hConsoleHandle=0x130, lpMode=0x12423aa4 | out: lpMode=0x12423aa4) returned 0
	[0109.538] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134
	[0109.538] GetConsoleMode (in: hConsoleHandle=0x134, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0109.538] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0109.538] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0109.539] GetProcAddress (hModule=0x75600000, lpProcName="GetEnvironmentStringsW") returned 0x7561aac0
	[0109.539] GetEnvironmentStringsW () returned 0x79a8e0*
	[0109.540] GetProcAddress (hModule=0x75600000, lpProcName="FreeEnvironmentStringsW") returned 0x7561a7e0
	[0109.541] FreeEnvironmentStringsW (penv=0x79a8e0) returned 1
	[0109.541] GetProcAddress (hModule=0x75600000, lpProcName="GetCurrentProcess") returned 0x756138c0
	[0109.541] GetCurrentProcess () returned 0xffffffff
	[0109.541] GetProcAddress (hModule=0x75600000, lpProcName="DuplicateHandle") returned 0x75626640
	[0109.541] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x130, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x12412660, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x12412660*=0x13c) returned 1
	[0109.541] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x134, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x12412664, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x12412664*=0x140) returned 1
	[0109.541] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x138, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x12412668, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x12412668*=0x144) returned 1
	[0109.542] GetProcAddress (hModule=0x75600000, lpProcName="CreateProcessW") returned 0x7561b000
	[0109.542] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c \"taskkill /f /im msftesql.exe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x400, lpEnvironment=0x12462000, lpCurrentDirectory=0x0, lpStartupInfo=0x12423acc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x13c, hStdOutput=0x140, hStdError=0x144), lpProcessInformation=0x12423aa8 | out: lpCommandLine="cmd.exe /c \"taskkill /f /im msftesql.exe \"", lpProcessInformation=0x12423aa8*(hProcess=0x154, hThread=0x150, dwProcessId=0x1210, dwThreadId=0xdd8)) returned 1
	[0109.967] SetEvent (hEvent=0x168) returned 1
	[0109.967] GetProcAddress (hModule=0x75600000, lpProcName="CloseHandle") returned 0x75626630
	[0109.967] CloseHandle (hObject=0x150) returned 1
	[0109.967] CloseHandle (hObject=0x144) returned 1
	[0109.968] CloseHandle (hObject=0x140) returned 1
	[0109.968] CloseHandle (hObject=0x13c) returned 1
	[0109.968] CloseHandle (hObject=0x130) returned 1
	[0109.968] CloseHandle (hObject=0x134) returned 1
	[0109.968] CloseHandle (hObject=0x138) returned 1
	[0109.968] GetProcAddress (hModule=0x75600000, lpProcName="WaitForSingleObject") returned 0x75626820
	[0109.968] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0xffffffff) returned 0x0
	[0119.951] SetEvent (hEvent=0x168) returned 1
	[0119.952] GetProcAddress (hModule=0x75600000, lpProcName="GetExitCodeProcess") returned 0x7561fdb0
	[0119.953] GetExitCodeProcess (in: hProcess=0x154, lpExitCode=0x12423bdc | out: lpExitCode=0x12423bdc*=0x80) returned 1
	[0119.954] GetProcAddress (hModule=0x75600000, lpProcName="GetProcessTimes") returned 0x75623dc0
	[0119.954] GetProcessTimes (in: hProcess=0x154, lpCreationTime=0x123cc240, lpExitTime=0x123cc248, lpKernelTime=0x123cc250, lpUserTime=0x123cc258 | out: lpCreationTime=0x123cc240, lpExitTime=0x123cc248, lpKernelTime=0x123cc250, lpUserTime=0x123cc258) returned 1
	[0119.954] CloseHandle (hObject=0x154) returned 1
	[0119.955] SetEvent (hEvent=0x124) returned 1
	[0119.955] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x4) returned 0x102
	[0120.026] SetEvent (hEvent=0x168) returned 1
	[0120.027] SetEvent (hEvent=0x124) returned 1
	[0120.027] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1243a410, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0120.027] GetFileAttributesExW (in: lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124308c8 | out: lpFileInformation=0x124308c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0120.028] CreateFileW (lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0120.028] GetFileAttributesExW (in: lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), fInfoLevelId=0x0, lpFileInformation=0x12430918 | out: lpFileInformation=0x12430918*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0120.028] CreateFileW (lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0120.028] GetFileAttributesExW (in: lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), fInfoLevelId=0x0, lpFileInformation=0x12430968 | out: lpFileInformation=0x12430968*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0120.028] CreateFileW (lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0120.029] GetFileAttributesExW (in: lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), fInfoLevelId=0x0, lpFileInformation=0x124309b8 | out: lpFileInformation=0x124309b8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0120.029] CreateFileW (lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0120.029] GetFileAttributesExW (in: lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x12430a08 | out: lpFileInformation=0x12430a08*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0120.029] CreateFileW (lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0120.029] GetFileAttributesExW (in: lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), fInfoLevelId=0x0, lpFileInformation=0x12430a58 | out: lpFileInformation=0x12430a58*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0120.029] CreateFileW (lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0120.029] GetFileAttributesExW (in: lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), fInfoLevelId=0x0, lpFileInformation=0x12430aa8 | out: lpFileInformation=0x12430aa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0120.029] CreateFileW (lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0120.030] GetFileAttributesExW (in: lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), fInfoLevelId=0x0, lpFileInformation=0x12430af8 | out: lpFileInformation=0x12430af8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0120.030] CreateFileW (lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0120.030] GetFileAttributesExW (in: lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), fInfoLevelId=0x0, lpFileInformation=0x12430b48 | out: lpFileInformation=0x12430b48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0120.030] CreateFileW (lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0120.030] GetFileAttributesExW (in: lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), fInfoLevelId=0x0, lpFileInformation=0x12430b98 | out: lpFileInformation=0x12430b98*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0120.031] CreateFileW (lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0120.031] GetFileAttributesExW (in: lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), fInfoLevelId=0x0, lpFileInformation=0x12430be8 | out: lpFileInformation=0x12430be8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0120.031] CreateFileW (lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0120.031] GetFileAttributesExW (in: lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), fInfoLevelId=0x0, lpFileInformation=0x12430c38 | out: lpFileInformation=0x12430c38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0120.031] CreateFileW (lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0120.031] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0x1243a4e0, nSize=0x64 | out: lpBuffer="") returned 0x63
	[0120.031] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12430c88 | out: lpFileInformation=0x12430c88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0120.032] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1243a5b0, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0120.032] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12430cd8 | out: lpFileInformation=0x12430cd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0120.032] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154
	[0120.032] GetConsoleMode (in: hConsoleHandle=0x154, lpMode=0x12423aa4 | out: lpMode=0x12423aa4) returned 0
	[0120.032] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0120.032] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0120.033] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134
	[0120.033] GetConsoleMode (in: hConsoleHandle=0x134, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0120.033] GetEnvironmentStringsW () returned 0x79a8e0*
	[0120.033] FreeEnvironmentStringsW (penv=0x79a8e0) returned 1
	[0120.034] GetCurrentProcess () returned 0xffffffff
	[0120.034] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x154, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x12412aa0, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x12412aa0*=0x130) returned 1
	[0120.034] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x138, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x12412aa4, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x12412aa4*=0x13c) returned 1
	[0120.034] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x134, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x12412aa8, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x12412aa8*=0x140) returned 1
	[0120.034] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c \"taskkill /f /im sqlagent.exe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x400, lpEnvironment=0x12462a80, lpCurrentDirectory=0x0, lpStartupInfo=0x12423acc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x130, hStdOutput=0x13c, hStdError=0x140), lpProcessInformation=0x12423aa8 | out: lpCommandLine="cmd.exe /c \"taskkill /f /im sqlagent.exe \"", lpProcessInformation=0x12423aa8*(hProcess=0x150, hThread=0x144, dwProcessId=0x13cc, dwThreadId=0xc14)) returned 1
	[0120.257] SetEvent (hEvent=0x168) returned 1
	[0120.257] CloseHandle (hObject=0x144) returned 1
	[0120.257] CloseHandle (hObject=0x140) returned 1
	[0120.257] CloseHandle (hObject=0x13c) returned 1
	[0120.258] CloseHandle (hObject=0x130) returned 1
	[0120.258] CloseHandle (hObject=0x154) returned 1
	[0120.258] CloseHandle (hObject=0x138) returned 1
	[0120.258] CloseHandle (hObject=0x134) returned 1
	[0120.258] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0
	[0121.929] SetEvent (hEvent=0x168) returned 1
	[0121.929] GetExitCodeProcess (in: hProcess=0x150, lpExitCode=0x12423bdc | out: lpExitCode=0x12423bdc*=0x80) returned 1
	[0121.930] GetProcessTimes (in: hProcess=0x150, lpCreationTime=0x124110e0, lpExitTime=0x124110e8, lpKernelTime=0x124110f0, lpUserTime=0x124110f8 | out: lpCreationTime=0x124110e0, lpExitTime=0x124110e8, lpKernelTime=0x124110f0, lpUserTime=0x124110f8) returned 1
	[0121.930] CloseHandle (hObject=0x150) returned 1
	[0121.930] SetEvent (hEvent=0x124) returned 1
	[0121.930] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x5) returned 0x102
	[0121.952] SetEvent (hEvent=0x124) returned 1
	[0121.953] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1246a000, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0121.953] GetFileAttributesExW (in: lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12472008 | out: lpFileInformation=0x12472008*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0121.953] CreateFileW (lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0121.953] GetFileAttributesExW (in: lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), fInfoLevelId=0x0, lpFileInformation=0x12472058 | out: lpFileInformation=0x12472058*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0121.954] CreateFileW (lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0121.954] GetFileAttributesExW (in: lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), fInfoLevelId=0x0, lpFileInformation=0x124720a8 | out: lpFileInformation=0x124720a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0121.954] CreateFileW (lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0121.954] GetFileAttributesExW (in: lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), fInfoLevelId=0x0, lpFileInformation=0x124720f8 | out: lpFileInformation=0x124720f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0121.954] CreateFileW (lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0121.954] GetFileAttributesExW (in: lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x12472148 | out: lpFileInformation=0x12472148*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0121.954] CreateFileW (lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0121.954] GetFileAttributesExW (in: lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), fInfoLevelId=0x0, lpFileInformation=0x12472198 | out: lpFileInformation=0x12472198*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0121.954] CreateFileW (lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0121.954] GetFileAttributesExW (in: lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), fInfoLevelId=0x0, lpFileInformation=0x124721e8 | out: lpFileInformation=0x124721e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0121.955] CreateFileW (lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0121.955] GetFileAttributesExW (in: lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), fInfoLevelId=0x0, lpFileInformation=0x12472238 | out: lpFileInformation=0x12472238*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0121.955] CreateFileW (lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0121.955] GetFileAttributesExW (in: lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), fInfoLevelId=0x0, lpFileInformation=0x12472288 | out: lpFileInformation=0x12472288*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0121.955] CreateFileW (lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0121.955] GetFileAttributesExW (in: lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), fInfoLevelId=0x0, lpFileInformation=0x124722d8 | out: lpFileInformation=0x124722d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0121.955] CreateFileW (lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0121.955] GetFileAttributesExW (in: lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), fInfoLevelId=0x0, lpFileInformation=0x12472328 | out: lpFileInformation=0x12472328*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0121.955] CreateFileW (lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0121.955] GetFileAttributesExW (in: lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), fInfoLevelId=0x0, lpFileInformation=0x12472378 | out: lpFileInformation=0x12472378*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0121.955] CreateFileW (lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0121.955] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0x1246a0d0, nSize=0x64 | out: lpBuffer="") returned 0x63
	[0121.956] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124723c8 | out: lpFileInformation=0x124723c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0121.956] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1246a1a0, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0121.956] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12472418 | out: lpFileInformation=0x12472418*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0121.956] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x150
	[0121.956] GetConsoleMode (in: hConsoleHandle=0x150, lpMode=0x12423aa4 | out: lpMode=0x12423aa4) returned 0
	[0121.956] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134
	[0121.956] GetConsoleMode (in: hConsoleHandle=0x134, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0121.956] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0121.956] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0121.956] GetEnvironmentStringsW () returned 0x79d8a8*
	[0121.957] FreeEnvironmentStringsW (penv=0x79d8a8) returned 1
	[0121.958] GetCurrentProcess () returned 0xffffffff
	[0121.958] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x150, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x123ce450, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x123ce450*=0x154) returned 1
	[0121.958] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x134, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x123ce454, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x123ce454*=0x130) returned 1
	[0121.958] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x138, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x123ce458, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x123ce458*=0x13c) returned 1
	[0121.958] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c \"taskkill /f /im sqlbrowser.exe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x400, lpEnvironment=0x12498000, lpCurrentDirectory=0x0, lpStartupInfo=0x12423acc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x154, hStdOutput=0x130, hStdError=0x13c), lpProcessInformation=0x12423aa8 | out: lpCommandLine="cmd.exe /c \"taskkill /f /im sqlbrowser.exe \"", lpProcessInformation=0x12423aa8*(hProcess=0x144, hThread=0x140, dwProcessId=0x654, dwThreadId=0x238)) returned 1
	[0122.056] SetEvent (hEvent=0x168) returned 1
	[0122.056] CloseHandle (hObject=0x140) returned 1
	[0122.056] CloseHandle (hObject=0x13c) returned 1
	[0122.056] CloseHandle (hObject=0x130) returned 1
	[0122.056] CloseHandle (hObject=0x154) returned 1
	[0122.056] CloseHandle (hObject=0x150) returned 1
	[0122.056] CloseHandle (hObject=0x134) returned 1
	[0122.056] CloseHandle (hObject=0x138) returned 1
	[0122.056] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0
	[0123.627] SetEvent (hEvent=0x168) returned 1
	[0123.627] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0x12423bdc | out: lpExitCode=0x12423bdc*=0x80) returned 1
	[0123.627] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0x123cc860, lpExitTime=0x123cc868, lpKernelTime=0x123cc870, lpUserTime=0x123cc878 | out: lpCreationTime=0x123cc860, lpExitTime=0x123cc868, lpKernelTime=0x123cc870, lpUserTime=0x123cc878) returned 1
	[0123.627] CloseHandle (hObject=0x144) returned 1
	[0123.630] SetEvent (hEvent=0x124) returned 1
	[0123.630] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x5) returned 0x102
	[0123.637] SetEvent (hEvent=0x168) returned 1
	[0123.637] SetEvent (hEvent=0x124) returned 1
	[0123.637] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1243a680, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0123.637] GetFileAttributesExW (in: lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12430d28 | out: lpFileInformation=0x12430d28*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0123.637] CreateFileW (lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0123.637] GetFileAttributesExW (in: lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), fInfoLevelId=0x0, lpFileInformation=0x12430d78 | out: lpFileInformation=0x12430d78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0123.637] CreateFileW (lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0123.638] GetFileAttributesExW (in: lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), fInfoLevelId=0x0, lpFileInformation=0x12430dc8 | out: lpFileInformation=0x12430dc8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0123.638] CreateFileW (lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0123.643] GetFileAttributesExW (in: lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), fInfoLevelId=0x0, lpFileInformation=0x12430e18 | out: lpFileInformation=0x12430e18*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0123.643] CreateFileW (lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0123.643] GetFileAttributesExW (in: lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x12430e68 | out: lpFileInformation=0x12430e68*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0123.643] CreateFileW (lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0123.643] GetFileAttributesExW (in: lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), fInfoLevelId=0x0, lpFileInformation=0x12430eb8 | out: lpFileInformation=0x12430eb8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0123.643] CreateFileW (lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0123.643] GetFileAttributesExW (in: lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), fInfoLevelId=0x0, lpFileInformation=0x12430f08 | out: lpFileInformation=0x12430f08*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0123.643] CreateFileW (lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0123.644] GetFileAttributesExW (in: lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), fInfoLevelId=0x0, lpFileInformation=0x12430f58 | out: lpFileInformation=0x12430f58*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0123.644] CreateFileW (lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0123.644] GetFileAttributesExW (in: lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), fInfoLevelId=0x0, lpFileInformation=0x12430fa8 | out: lpFileInformation=0x12430fa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0123.644] CreateFileW (lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0123.644] GetFileAttributesExW (in: lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), fInfoLevelId=0x0, lpFileInformation=0x12430ff8 | out: lpFileInformation=0x12430ff8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0123.644] CreateFileW (lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0123.644] GetFileAttributesExW (in: lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), fInfoLevelId=0x0, lpFileInformation=0x12431048 | out: lpFileInformation=0x12431048*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0123.644] CreateFileW (lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0123.644] GetFileAttributesExW (in: lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), fInfoLevelId=0x0, lpFileInformation=0x12431098 | out: lpFileInformation=0x12431098*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0123.644] CreateFileW (lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0123.645] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0x1243a750, nSize=0x64 | out: lpBuffer="") returned 0x63
	[0123.645] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124310e8 | out: lpFileInformation=0x124310e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0123.645] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1243a820, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0123.645] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12431138 | out: lpFileInformation=0x12431138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0123.645] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x144
	[0123.645] GetConsoleMode (in: hConsoleHandle=0x144, lpMode=0x12423aa4 | out: lpMode=0x12423aa4) returned 0
	[0123.645] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0123.645] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0123.645] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134
	[0123.646] GetConsoleMode (in: hConsoleHandle=0x134, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0123.646] GetEnvironmentStringsW () returned 0x79d8a8*
	[0123.646] FreeEnvironmentStringsW (penv=0x79d8a8) returned 1
	[0123.646] GetCurrentProcess () returned 0xffffffff
	[0123.646] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x144, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x12412ec0, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x12412ec0*=0x150) returned 1
	[0123.646] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x138, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x12412ec4, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x12412ec4*=0x154) returned 1
	[0123.646] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x134, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x12412ec8, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x12412ec8*=0x130) returned 1
	[0123.646] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c \"taskkill /f /im sqlservr.exe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x400, lpEnvironment=0x12463500, lpCurrentDirectory=0x0, lpStartupInfo=0x12423acc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x150, hStdOutput=0x154, hStdError=0x130), lpProcessInformation=0x12423aa8 | out: lpCommandLine="cmd.exe /c \"taskkill /f /im sqlservr.exe \"", lpProcessInformation=0x12423aa8*(hProcess=0x140, hThread=0x13c, dwProcessId=0x1258, dwThreadId=0x121c)) returned 1
	[0123.684] CloseHandle (hObject=0x13c) returned 1
	[0123.684] CloseHandle (hObject=0x130) returned 1
	[0123.684] CloseHandle (hObject=0x154) returned 1
	[0123.684] CloseHandle (hObject=0x150) returned 1
	[0123.684] CloseHandle (hObject=0x144) returned 1
	[0123.684] CloseHandle (hObject=0x138) returned 1
	[0123.684] CloseHandle (hObject=0x134) returned 1
	[0123.684] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0xffffffff) returned 0x0
	[0124.979] SetEvent (hEvent=0x168) returned 1
	[0124.979] GetExitCodeProcess (in: hProcess=0x140, lpExitCode=0x12423bdc | out: lpExitCode=0x12423bdc*=0x80) returned 1
	[0124.979] GetProcessTimes (in: hProcess=0x140, lpCreationTime=0x12411740, lpExitTime=0x12411748, lpKernelTime=0x12411750, lpUserTime=0x12411758 | out: lpCreationTime=0x12411740, lpExitTime=0x12411748, lpKernelTime=0x12411750, lpUserTime=0x12411758) returned 1
	[0124.979] CloseHandle (hObject=0x140) returned 1
	[0124.979] SetEvent (hEvent=0x124) returned 1
	[0124.980] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x5) returned 0x102
	[0124.988] SetEvent (hEvent=0x168) returned 1
	[0124.988] SetEvent (hEvent=0x124) returned 1
	[0124.988] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1246a270, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0124.989] GetFileAttributesExW (in: lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12472468 | out: lpFileInformation=0x12472468*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0124.989] CreateFileW (lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0124.989] GetFileAttributesExW (in: lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), fInfoLevelId=0x0, lpFileInformation=0x124724b8 | out: lpFileInformation=0x124724b8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0124.989] CreateFileW (lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0124.989] GetFileAttributesExW (in: lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), fInfoLevelId=0x0, lpFileInformation=0x12472508 | out: lpFileInformation=0x12472508*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0124.989] CreateFileW (lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0124.989] GetFileAttributesExW (in: lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), fInfoLevelId=0x0, lpFileInformation=0x12472558 | out: lpFileInformation=0x12472558*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0124.989] CreateFileW (lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0124.989] GetFileAttributesExW (in: lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x124725a8 | out: lpFileInformation=0x124725a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0124.990] CreateFileW (lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0124.990] GetFileAttributesExW (in: lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), fInfoLevelId=0x0, lpFileInformation=0x124725f8 | out: lpFileInformation=0x124725f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0124.990] CreateFileW (lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0124.990] GetFileAttributesExW (in: lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), fInfoLevelId=0x0, lpFileInformation=0x12472648 | out: lpFileInformation=0x12472648*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0124.990] CreateFileW (lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0124.990] GetFileAttributesExW (in: lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), fInfoLevelId=0x0, lpFileInformation=0x12472698 | out: lpFileInformation=0x12472698*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0124.990] CreateFileW (lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0124.990] GetFileAttributesExW (in: lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), fInfoLevelId=0x0, lpFileInformation=0x124726e8 | out: lpFileInformation=0x124726e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0124.990] CreateFileW (lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0124.990] GetFileAttributesExW (in: lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), fInfoLevelId=0x0, lpFileInformation=0x12472738 | out: lpFileInformation=0x12472738*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0124.990] CreateFileW (lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0124.991] GetFileAttributesExW (in: lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), fInfoLevelId=0x0, lpFileInformation=0x12472788 | out: lpFileInformation=0x12472788*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0124.991] CreateFileW (lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0124.991] GetFileAttributesExW (in: lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), fInfoLevelId=0x0, lpFileInformation=0x124727d8 | out: lpFileInformation=0x124727d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0124.991] CreateFileW (lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0124.991] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0x1246a340, nSize=0x64 | out: lpBuffer="") returned 0x63
	[0124.991] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12472828 | out: lpFileInformation=0x12472828*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0124.991] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1246a410, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0124.991] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12472878 | out: lpFileInformation=0x12472878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0124.991] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x140
	[0124.991] GetConsoleMode (in: hConsoleHandle=0x140, lpMode=0x12423aa4 | out: lpMode=0x12423aa4) returned 0
	[0124.991] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134
	[0124.992] GetConsoleMode (in: hConsoleHandle=0x134, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0124.992] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0124.992] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0124.992] GetEnvironmentStringsW () returned 0x79d8a8*
	[0124.992] FreeEnvironmentStringsW (penv=0x79d8a8) returned 1
	[0124.992] GetCurrentProcess () returned 0xffffffff
	[0124.992] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x140, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x123ce870, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x123ce870*=0x144) returned 1
	[0124.992] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x134, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x123ce874, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x123ce874*=0x150) returned 1
	[0124.992] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x138, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x123ce878, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x123ce878*=0x154) returned 1
	[0124.992] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c \"taskkill /f /im sqlwriter.exe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x400, lpEnvironment=0x12498a80, lpCurrentDirectory=0x0, lpStartupInfo=0x12423acc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x144, hStdOutput=0x150, hStdError=0x154), lpProcessInformation=0x12423aa8 | out: lpCommandLine="cmd.exe /c \"taskkill /f /im sqlwriter.exe \"", lpProcessInformation=0x12423aa8*(hProcess=0x13c, hThread=0x130, dwProcessId=0x9a8, dwThreadId=0x998)) returned 1
	[0125.025] SetEvent (hEvent=0x168) returned 1
	[0125.025] CloseHandle (hObject=0x130) returned 1
	[0125.026] CloseHandle (hObject=0x154) returned 1
	[0125.026] CloseHandle (hObject=0x150) returned 1
	[0125.026] CloseHandle (hObject=0x144) returned 1
	[0125.026] CloseHandle (hObject=0x140) returned 1
	[0125.026] CloseHandle (hObject=0x134) returned 1
	[0125.026] CloseHandle (hObject=0x138) returned 1
	[0125.026] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0xffffffff) returned 0x0
	[0126.755] SetEvent (hEvent=0x168) returned 1
	[0126.755] GetExitCodeProcess (in: hProcess=0x13c, lpExitCode=0x12423bdc | out: lpExitCode=0x12423bdc*=0x80) returned 1
	[0126.755] GetProcessTimes (in: hProcess=0x13c, lpCreationTime=0x123ccec0, lpExitTime=0x123ccec8, lpKernelTime=0x123cced0, lpUserTime=0x123cced8 | out: lpCreationTime=0x123ccec0, lpExitTime=0x123ccec8, lpKernelTime=0x123cced0, lpUserTime=0x123cced8) returned 1
	[0126.755] CloseHandle (hObject=0x13c) returned 1
	[0126.756] SetEvent (hEvent=0x124) returned 1
	[0126.756] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x5) returned 0x102
	[0126.763] SetEvent (hEvent=0x168) returned 1
	[0126.763] SetEvent (hEvent=0x124) returned 1
	[0126.763] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1243a8f0, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0126.763] GetFileAttributesExW (in: lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12431188 | out: lpFileInformation=0x12431188*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0126.763] CreateFileW (lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0126.763] GetFileAttributesExW (in: lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), fInfoLevelId=0x0, lpFileInformation=0x124311d8 | out: lpFileInformation=0x124311d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0126.763] CreateFileW (lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0126.763] GetFileAttributesExW (in: lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), fInfoLevelId=0x0, lpFileInformation=0x12431228 | out: lpFileInformation=0x12431228*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0126.764] CreateFileW (lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0126.764] GetFileAttributesExW (in: lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), fInfoLevelId=0x0, lpFileInformation=0x12431278 | out: lpFileInformation=0x12431278*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0126.764] CreateFileW (lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0126.764] GetFileAttributesExW (in: lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x124312c8 | out: lpFileInformation=0x124312c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0126.764] CreateFileW (lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0126.764] GetFileAttributesExW (in: lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), fInfoLevelId=0x0, lpFileInformation=0x12431318 | out: lpFileInformation=0x12431318*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0126.769] CreateFileW (lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0126.770] GetFileAttributesExW (in: lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), fInfoLevelId=0x0, lpFileInformation=0x12431368 | out: lpFileInformation=0x12431368*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0126.770] CreateFileW (lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0126.770] GetFileAttributesExW (in: lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), fInfoLevelId=0x0, lpFileInformation=0x124313b8 | out: lpFileInformation=0x124313b8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0126.770] CreateFileW (lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0126.770] GetFileAttributesExW (in: lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), fInfoLevelId=0x0, lpFileInformation=0x12431408 | out: lpFileInformation=0x12431408*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0126.770] CreateFileW (lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0126.770] GetFileAttributesExW (in: lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), fInfoLevelId=0x0, lpFileInformation=0x12431458 | out: lpFileInformation=0x12431458*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0126.770] CreateFileW (lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0126.770] GetFileAttributesExW (in: lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), fInfoLevelId=0x0, lpFileInformation=0x124314a8 | out: lpFileInformation=0x124314a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0126.771] CreateFileW (lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0126.771] GetFileAttributesExW (in: lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), fInfoLevelId=0x0, lpFileInformation=0x124314f8 | out: lpFileInformation=0x124314f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0126.771] CreateFileW (lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0126.771] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0x1243a9c0, nSize=0x64 | out: lpBuffer="") returned 0x63
	[0126.771] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12431548 | out: lpFileInformation=0x12431548*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0126.771] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1243aa90, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0126.771] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12431598 | out: lpFileInformation=0x12431598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0126.771] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c
	[0126.772] GetConsoleMode (in: hConsoleHandle=0x13c, lpMode=0x12423aa4 | out: lpMode=0x12423aa4) returned 0
	[0126.772] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0126.772] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0126.772] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134
	[0126.772] GetConsoleMode (in: hConsoleHandle=0x134, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0126.772] GetEnvironmentStringsW () returned 0x79e0b0*
	[0126.772] FreeEnvironmentStringsW (penv=0x79e0b0) returned 1
	[0126.772] GetCurrentProcess () returned 0xffffffff
	[0126.772] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x13c, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124132e0, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124132e0*=0x140) returned 1
	[0126.772] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x138, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124132e4, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124132e4*=0x144) returned 1
	[0126.772] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x134, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124132e8, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124132e8*=0x150) returned 1
	[0126.773] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c \"taskkill /f /im oracle.exe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x400, lpEnvironment=0x1249e000, lpCurrentDirectory=0x0, lpStartupInfo=0x12423acc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x140, hStdOutput=0x144, hStdError=0x150), lpProcessInformation=0x12423aa8 | out: lpCommandLine="cmd.exe /c \"taskkill /f /im oracle.exe \"", lpProcessInformation=0x12423aa8*(hProcess=0x130, hThread=0x154, dwProcessId=0x8ec, dwThreadId=0xd2c)) returned 1
	[0126.921] SetEvent (hEvent=0x168) returned 1
	[0126.921] CloseHandle (hObject=0x154) returned 1
	[0126.921] CloseHandle (hObject=0x150) returned 1
	[0126.921] CloseHandle (hObject=0x144) returned 1
	[0126.921] CloseHandle (hObject=0x140) returned 1
	[0126.921] CloseHandle (hObject=0x13c) returned 1
	[0126.921] CloseHandle (hObject=0x138) returned 1
	[0126.921] CloseHandle (hObject=0x134) returned 1
	[0126.921] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0xffffffff) returned 0x0
	[0128.411] SetEvent (hEvent=0x168) returned 1
	[0128.412] GetExitCodeProcess (in: hProcess=0x130, lpExitCode=0x12423bdc | out: lpExitCode=0x12423bdc*=0x80) returned 1
	[0128.412] GetProcessTimes (in: hProcess=0x130, lpCreationTime=0x12411da0, lpExitTime=0x12411da8, lpKernelTime=0x12411db0, lpUserTime=0x12411db8 | out: lpCreationTime=0x12411da0, lpExitTime=0x12411da8, lpKernelTime=0x12411db0, lpUserTime=0x12411db8) returned 1
	[0128.412] CloseHandle (hObject=0x130) returned 1
	[0128.413] SetEvent (hEvent=0x124) returned 1
	[0128.413] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x5) returned 0x102
	[0128.422] SetEvent (hEvent=0x168) returned 1
	[0128.422] SetEvent (hEvent=0x124) returned 1
	[0128.423] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1246a4e0, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0128.423] GetFileAttributesExW (in: lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124728c8 | out: lpFileInformation=0x124728c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0128.424] CreateFileW (lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0128.424] GetFileAttributesExW (in: lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), fInfoLevelId=0x0, lpFileInformation=0x12472918 | out: lpFileInformation=0x12472918*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0128.424] CreateFileW (lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0128.425] GetFileAttributesExW (in: lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), fInfoLevelId=0x0, lpFileInformation=0x12472968 | out: lpFileInformation=0x12472968*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0128.425] CreateFileW (lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0128.425] GetFileAttributesExW (in: lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), fInfoLevelId=0x0, lpFileInformation=0x124729b8 | out: lpFileInformation=0x124729b8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0128.425] CreateFileW (lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0128.425] GetFileAttributesExW (in: lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x12472a08 | out: lpFileInformation=0x12472a08*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0128.425] CreateFileW (lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0128.425] GetFileAttributesExW (in: lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), fInfoLevelId=0x0, lpFileInformation=0x12472a58 | out: lpFileInformation=0x12472a58*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0128.425] CreateFileW (lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0128.425] GetFileAttributesExW (in: lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), fInfoLevelId=0x0, lpFileInformation=0x12472aa8 | out: lpFileInformation=0x12472aa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0128.426] CreateFileW (lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0128.434] GetFileAttributesExW (in: lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), fInfoLevelId=0x0, lpFileInformation=0x12472af8 | out: lpFileInformation=0x12472af8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0128.434] CreateFileW (lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0128.434] GetFileAttributesExW (in: lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), fInfoLevelId=0x0, lpFileInformation=0x12472b48 | out: lpFileInformation=0x12472b48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0128.434] CreateFileW (lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0128.434] GetFileAttributesExW (in: lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), fInfoLevelId=0x0, lpFileInformation=0x12472b98 | out: lpFileInformation=0x12472b98*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0128.435] CreateFileW (lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0128.435] GetFileAttributesExW (in: lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), fInfoLevelId=0x0, lpFileInformation=0x12472be8 | out: lpFileInformation=0x12472be8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0128.435] CreateFileW (lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0128.435] GetFileAttributesExW (in: lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), fInfoLevelId=0x0, lpFileInformation=0x12472c38 | out: lpFileInformation=0x12472c38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0128.435] CreateFileW (lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0128.435] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0x1246a5b0, nSize=0x64 | out: lpBuffer="") returned 0x63
	[0128.435] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12472c88 | out: lpFileInformation=0x12472c88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0128.436] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1246a680, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0128.436] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12472cd8 | out: lpFileInformation=0x12472cd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0128.436] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130
	[0128.436] GetConsoleMode (in: hConsoleHandle=0x130, lpMode=0x12423aa4 | out: lpMode=0x12423aa4) returned 0
	[0128.436] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134
	[0128.436] GetConsoleMode (in: hConsoleHandle=0x134, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0128.436] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0128.437] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0128.437] GetEnvironmentStringsW () returned 0x79e0b0*
	[0128.437] FreeEnvironmentStringsW (penv=0x79e0b0) returned 1
	[0128.437] GetCurrentProcess () returned 0xffffffff
	[0128.437] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x130, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x123cec90, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x123cec90*=0x13c) returned 1
	[0128.437] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x134, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x123cec94, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x123cec94*=0x140) returned 1
	[0128.437] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x138, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x123cec98, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x123cec98*=0x144) returned 1
	[0128.438] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c \"taskkill /f /im ocssd.exe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x400, lpEnvironment=0x12499500, lpCurrentDirectory=0x0, lpStartupInfo=0x12423acc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x13c, hStdOutput=0x140, hStdError=0x144), lpProcessInformation=0x12423aa8 | out: lpCommandLine="cmd.exe /c \"taskkill /f /im ocssd.exe \"", lpProcessInformation=0x12423aa8*(hProcess=0x154, hThread=0x150, dwProcessId=0xb98, dwThreadId=0x990)) returned 1
	[0128.481] SetEvent (hEvent=0x168) returned 1
	[0128.481] CloseHandle (hObject=0x150) returned 1
	[0128.481] CloseHandle (hObject=0x144) returned 1
	[0128.481] CloseHandle (hObject=0x140) returned 1
	[0128.481] CloseHandle (hObject=0x13c) returned 1
	[0128.481] CloseHandle (hObject=0x130) returned 1
	[0128.482] CloseHandle (hObject=0x134) returned 1
	[0128.482] CloseHandle (hObject=0x138) returned 1
	[0128.482] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0xffffffff) returned 0x0
	[0130.092] SetEvent (hEvent=0x168) returned 1
	[0130.092] GetExitCodeProcess (in: hProcess=0x154, lpExitCode=0x12423bdc | out: lpExitCode=0x12423bdc*=0x80) returned 1
	[0130.092] GetProcessTimes (in: hProcess=0x154, lpCreationTime=0x123cd520, lpExitTime=0x123cd528, lpKernelTime=0x123cd530, lpUserTime=0x123cd538 | out: lpCreationTime=0x123cd520, lpExitTime=0x123cd528, lpKernelTime=0x123cd530, lpUserTime=0x123cd538) returned 1
	[0130.092] CloseHandle (hObject=0x154) returned 1
	[0130.093] SetEvent (hEvent=0x124) returned 1
	[0130.093] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x4) returned 0x102
	[0130.099] SetEvent (hEvent=0x168) returned 1
	[0130.099] SetEvent (hEvent=0x124) returned 1
	[0130.100] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1243ab60, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0130.100] GetFileAttributesExW (in: lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124315e8 | out: lpFileInformation=0x124315e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0130.100] CreateFileW (lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0130.100] GetFileAttributesExW (in: lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), fInfoLevelId=0x0, lpFileInformation=0x12431638 | out: lpFileInformation=0x12431638*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0130.100] CreateFileW (lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0130.100] GetFileAttributesExW (in: lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), fInfoLevelId=0x0, lpFileInformation=0x12431688 | out: lpFileInformation=0x12431688*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0130.101] CreateFileW (lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0130.101] GetFileAttributesExW (in: lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), fInfoLevelId=0x0, lpFileInformation=0x124316d8 | out: lpFileInformation=0x124316d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0130.101] CreateFileW (lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0130.101] GetFileAttributesExW (in: lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x12431728 | out: lpFileInformation=0x12431728*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0130.101] CreateFileW (lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0130.102] GetFileAttributesExW (in: lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), fInfoLevelId=0x0, lpFileInformation=0x12431778 | out: lpFileInformation=0x12431778*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0130.102] CreateFileW (lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0130.102] GetFileAttributesExW (in: lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), fInfoLevelId=0x0, lpFileInformation=0x124317c8 | out: lpFileInformation=0x124317c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0130.102] CreateFileW (lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0130.102] GetFileAttributesExW (in: lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), fInfoLevelId=0x0, lpFileInformation=0x12431818 | out: lpFileInformation=0x12431818*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0130.219] CreateFileW (lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0130.219] GetFileAttributesExW (in: lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), fInfoLevelId=0x0, lpFileInformation=0x12431868 | out: lpFileInformation=0x12431868*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0130.219] CreateFileW (lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0130.219] GetFileAttributesExW (in: lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), fInfoLevelId=0x0, lpFileInformation=0x124318b8 | out: lpFileInformation=0x124318b8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0130.219] CreateFileW (lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0130.219] GetFileAttributesExW (in: lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), fInfoLevelId=0x0, lpFileInformation=0x12431908 | out: lpFileInformation=0x12431908*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0130.219] CreateFileW (lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0130.220] GetFileAttributesExW (in: lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), fInfoLevelId=0x0, lpFileInformation=0x12431958 | out: lpFileInformation=0x12431958*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0130.220] CreateFileW (lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0130.220] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0x1243ac30, nSize=0x64 | out: lpBuffer="") returned 0x63
	[0130.220] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124319a8 | out: lpFileInformation=0x124319a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0130.220] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1243ad00, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0130.220] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124319f8 | out: lpFileInformation=0x124319f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0130.220] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154
	[0130.220] GetConsoleMode (in: hConsoleHandle=0x154, lpMode=0x12423aa4 | out: lpMode=0x12423aa4) returned 0
	[0130.221] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0130.221] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0130.221] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134
	[0130.221] GetConsoleMode (in: hConsoleHandle=0x134, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0130.221] GetEnvironmentStringsW () returned 0x79e0b0*
	[0130.222] FreeEnvironmentStringsW (penv=0x79e0b0) returned 1
	[0130.222] GetCurrentProcess () returned 0xffffffff
	[0130.222] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x154, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x12413700, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x12413700*=0x130) returned 1
	[0130.222] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x138, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x12413704, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x12413704*=0x13c) returned 1
	[0130.222] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x134, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x12413708, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x12413708*=0x140) returned 1
	[0130.223] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c \"taskkill /f /im dbsnmp.exe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x400, lpEnvironment=0x1249ea80, lpCurrentDirectory=0x0, lpStartupInfo=0x12423acc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x130, hStdOutput=0x13c, hStdError=0x140), lpProcessInformation=0x12423aa8 | out: lpCommandLine="cmd.exe /c \"taskkill /f /im dbsnmp.exe \"", lpProcessInformation=0x12423aa8*(hProcess=0x150, hThread=0x144, dwProcessId=0x92c, dwThreadId=0x4c8)) returned 1
	[0130.267] SetEvent (hEvent=0x168) returned 1
	[0130.267] CloseHandle (hObject=0x144) returned 1
	[0130.267] CloseHandle (hObject=0x140) returned 1
	[0130.267] CloseHandle (hObject=0x13c) returned 1
	[0130.267] CloseHandle (hObject=0x130) returned 1
	[0130.267] CloseHandle (hObject=0x154) returned 1
	[0130.268] CloseHandle (hObject=0x138) returned 1
	[0130.268] CloseHandle (hObject=0x134) returned 1
	[0130.268] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0
	[0131.618] SetEvent (hEvent=0x168) returned 1
	[0131.618] GetExitCodeProcess (in: hProcess=0x150, lpExitCode=0x12423bdc | out: lpExitCode=0x12423bdc*=0x80) returned 1
	[0131.618] GetProcessTimes (in: hProcess=0x150, lpCreationTime=0x124a0400, lpExitTime=0x124a0408, lpKernelTime=0x124a0410, lpUserTime=0x124a0418 | out: lpCreationTime=0x124a0400, lpExitTime=0x124a0408, lpKernelTime=0x124a0410, lpUserTime=0x124a0418) returned 1
	[0131.618] CloseHandle (hObject=0x150) returned 1
	[0131.619] SetEvent (hEvent=0x124) returned 1
	[0131.619] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x5) returned 0x102
	[0131.629] SetEvent (hEvent=0x168) returned 1
	[0131.629] SetEvent (hEvent=0x124) returned 1
	[0131.629] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1246a750, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0131.629] GetFileAttributesExW (in: lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12472d28 | out: lpFileInformation=0x12472d28*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0131.630] CreateFileW (lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0131.630] GetFileAttributesExW (in: lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), fInfoLevelId=0x0, lpFileInformation=0x12472d78 | out: lpFileInformation=0x12472d78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0131.630] CreateFileW (lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0131.630] GetFileAttributesExW (in: lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), fInfoLevelId=0x0, lpFileInformation=0x12472dc8 | out: lpFileInformation=0x12472dc8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0131.630] CreateFileW (lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0131.630] GetFileAttributesExW (in: lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), fInfoLevelId=0x0, lpFileInformation=0x12472e18 | out: lpFileInformation=0x12472e18*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0131.630] CreateFileW (lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0131.630] GetFileAttributesExW (in: lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x12472e68 | out: lpFileInformation=0x12472e68*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0131.631] CreateFileW (lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0131.631] GetFileAttributesExW (in: lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), fInfoLevelId=0x0, lpFileInformation=0x12472eb8 | out: lpFileInformation=0x12472eb8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0131.631] CreateFileW (lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0131.631] GetFileAttributesExW (in: lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), fInfoLevelId=0x0, lpFileInformation=0x12472f08 | out: lpFileInformation=0x12472f08*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0131.631] CreateFileW (lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0131.631] GetFileAttributesExW (in: lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), fInfoLevelId=0x0, lpFileInformation=0x12472f58 | out: lpFileInformation=0x12472f58*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0131.631] CreateFileW (lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0131.631] GetFileAttributesExW (in: lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), fInfoLevelId=0x0, lpFileInformation=0x12472fa8 | out: lpFileInformation=0x12472fa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0131.631] CreateFileW (lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0131.631] GetFileAttributesExW (in: lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), fInfoLevelId=0x0, lpFileInformation=0x12472ff8 | out: lpFileInformation=0x12472ff8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0131.632] CreateFileW (lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0131.632] GetFileAttributesExW (in: lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), fInfoLevelId=0x0, lpFileInformation=0x12473048 | out: lpFileInformation=0x12473048*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0131.632] CreateFileW (lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0131.632] GetFileAttributesExW (in: lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), fInfoLevelId=0x0, lpFileInformation=0x12473098 | out: lpFileInformation=0x12473098*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0131.632] CreateFileW (lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0131.632] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0x1246a820, nSize=0x64 | out: lpBuffer="") returned 0x63
	[0131.632] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124730e8 | out: lpFileInformation=0x124730e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0131.632] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1246a8f0, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0131.632] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12473138 | out: lpFileInformation=0x12473138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0131.633] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x150
	[0131.633] GetConsoleMode (in: hConsoleHandle=0x150, lpMode=0x12423aa4 | out: lpMode=0x12423aa4) returned 0
	[0131.633] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134
	[0131.633] GetConsoleMode (in: hConsoleHandle=0x134, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0131.633] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0131.633] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0131.633] GetEnvironmentStringsW () returned 0x79e0b0*
	[0131.634] FreeEnvironmentStringsW (penv=0x79e0b0) returned 1
	[0131.634] GetCurrentProcess () returned 0xffffffff
	[0131.634] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x150, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x123cf0b0, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x123cf0b0*=0x154) returned 1
	[0131.634] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x134, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x123cf0b4, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x123cf0b4*=0x130) returned 1
	[0131.634] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x138, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x123cf0b8, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x123cf0b8*=0x13c) returned 1
	[0131.635] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c \"taskkill /f /im synctime.exe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x400, lpEnvironment=0x124a6000, lpCurrentDirectory=0x0, lpStartupInfo=0x12423acc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x154, hStdOutput=0x130, hStdError=0x13c), lpProcessInformation=0x12423aa8 | out: lpCommandLine="cmd.exe /c \"taskkill /f /im synctime.exe \"", lpProcessInformation=0x12423aa8*(hProcess=0x144, hThread=0x140, dwProcessId=0x101c, dwThreadId=0x1030)) returned 1
	[0131.730] SetEvent (hEvent=0x168) returned 1
	[0131.730] CloseHandle (hObject=0x140) returned 1
	[0131.730] CloseHandle (hObject=0x13c) returned 1
	[0131.730] CloseHandle (hObject=0x130) returned 1
	[0131.730] CloseHandle (hObject=0x154) returned 1
	[0131.731] CloseHandle (hObject=0x150) returned 1
	[0131.731] CloseHandle (hObject=0x134) returned 1
	[0131.731] CloseHandle (hObject=0x138) returned 1
	[0131.731] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0
	[0133.297] SetEvent (hEvent=0x168) returned 1
	[0133.297] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0x12423bdc | out: lpExitCode=0x12423bdc*=0x80) returned 1
	[0133.297] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0x123cdb80, lpExitTime=0x123cdb88, lpKernelTime=0x123cdb90, lpUserTime=0x123cdb98 | out: lpCreationTime=0x123cdb80, lpExitTime=0x123cdb88, lpKernelTime=0x123cdb90, lpUserTime=0x123cdb98) returned 1
	[0133.297] CloseHandle (hObject=0x144) returned 1
	[0133.297] SetEvent (hEvent=0x124) returned 1
	[0133.297] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x5) returned 0x102
	[0133.303] SetEvent (hEvent=0x168) returned 1
	[0133.303] SetEvent (hEvent=0x124) returned 1
	[0133.303] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1243add0, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0133.303] GetFileAttributesExW (in: lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12431a48 | out: lpFileInformation=0x12431a48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0133.303] CreateFileW (lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0133.303] GetFileAttributesExW (in: lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), fInfoLevelId=0x0, lpFileInformation=0x12431a98 | out: lpFileInformation=0x12431a98*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0133.303] CreateFileW (lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0133.303] GetFileAttributesExW (in: lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), fInfoLevelId=0x0, lpFileInformation=0x12431ae8 | out: lpFileInformation=0x12431ae8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0133.303] CreateFileW (lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0133.304] GetFileAttributesExW (in: lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), fInfoLevelId=0x0, lpFileInformation=0x12431b38 | out: lpFileInformation=0x12431b38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0133.304] CreateFileW (lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0133.304] GetFileAttributesExW (in: lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x12431b88 | out: lpFileInformation=0x12431b88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0133.304] CreateFileW (lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0133.304] GetFileAttributesExW (in: lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), fInfoLevelId=0x0, lpFileInformation=0x12431bd8 | out: lpFileInformation=0x12431bd8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0133.304] CreateFileW (lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0133.304] GetFileAttributesExW (in: lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), fInfoLevelId=0x0, lpFileInformation=0x12431c28 | out: lpFileInformation=0x12431c28*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0133.304] CreateFileW (lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0133.304] GetFileAttributesExW (in: lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), fInfoLevelId=0x0, lpFileInformation=0x12431c78 | out: lpFileInformation=0x12431c78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0133.304] CreateFileW (lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0133.305] GetFileAttributesExW (in: lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), fInfoLevelId=0x0, lpFileInformation=0x12431cc8 | out: lpFileInformation=0x12431cc8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0133.305] CreateFileW (lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0133.305] GetFileAttributesExW (in: lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), fInfoLevelId=0x0, lpFileInformation=0x12431d18 | out: lpFileInformation=0x12431d18*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0133.305] CreateFileW (lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0133.305] GetFileAttributesExW (in: lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), fInfoLevelId=0x0, lpFileInformation=0x12431d68 | out: lpFileInformation=0x12431d68*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0133.305] CreateFileW (lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0133.305] GetFileAttributesExW (in: lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), fInfoLevelId=0x0, lpFileInformation=0x12431db8 | out: lpFileInformation=0x12431db8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0133.305] CreateFileW (lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0133.305] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0x1243aea0, nSize=0x64 | out: lpBuffer="") returned 0x63
	[0133.305] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12431e08 | out: lpFileInformation=0x12431e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0133.306] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1243af70, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0133.306] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12431e58 | out: lpFileInformation=0x12431e58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0133.306] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x144
	[0133.306] GetConsoleMode (in: hConsoleHandle=0x144, lpMode=0x12423aa4 | out: lpMode=0x12423aa4) returned 0
	[0133.306] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0133.306] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0133.306] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134
	[0133.306] GetConsoleMode (in: hConsoleHandle=0x134, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0133.306] GetEnvironmentStringsW () returned 0x79e0b0*
	[0133.306] FreeEnvironmentStringsW (penv=0x79e0b0) returned 1
	[0133.306] GetCurrentProcess () returned 0xffffffff
	[0133.306] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x144, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x12413b20, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x12413b20*=0x150) returned 1
	[0133.306] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x138, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x12413b24, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x12413b24*=0x154) returned 1
	[0133.306] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x134, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x12413b28, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x12413b28*=0x130) returned 1
	[0133.307] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c \"taskkill /f /im mydesktopqos.exe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x400, lpEnvironment=0x1249f500, lpCurrentDirectory=0x0, lpStartupInfo=0x12423acc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x150, hStdOutput=0x154, hStdError=0x130), lpProcessInformation=0x12423aa8 | out: lpCommandLine="cmd.exe /c \"taskkill /f /im mydesktopqos.exe \"", lpProcessInformation=0x12423aa8*(hProcess=0x140, hThread=0x13c, dwProcessId=0x10fc, dwThreadId=0x1100)) returned 1
	[0133.506] SetEvent (hEvent=0x168) returned 1
	[0133.506] CloseHandle (hObject=0x13c) returned 1
	[0133.506] CloseHandle (hObject=0x130) returned 1
	[0133.506] CloseHandle (hObject=0x154) returned 1
	[0133.506] CloseHandle (hObject=0x150) returned 1
	[0133.506] CloseHandle (hObject=0x144) returned 1
	[0133.507] CloseHandle (hObject=0x138) returned 1
	[0133.507] CloseHandle (hObject=0x134) returned 1
	[0133.507] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0xffffffff) returned 0x0
	[0138.250] SetEvent (hEvent=0x168) returned 1
	[0138.250] GetExitCodeProcess (in: hProcess=0x140, lpExitCode=0x12423bdc | out: lpExitCode=0x12423bdc*=0x80) returned 1
	[0138.250] GetProcessTimes (in: hProcess=0x140, lpCreationTime=0x124a0a20, lpExitTime=0x124a0a28, lpKernelTime=0x124a0a30, lpUserTime=0x124a0a38 | out: lpCreationTime=0x124a0a20, lpExitTime=0x124a0a28, lpKernelTime=0x124a0a30, lpUserTime=0x124a0a38) returned 1
	[0138.250] CloseHandle (hObject=0x140) returned 1
	[0138.251] SetEvent (hEvent=0x124) returned 1
	[0138.251] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x4) returned 0x102
	[0138.262] SetEvent (hEvent=0x124) returned 1
	[0138.262] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1246a9c0, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0138.262] GetFileAttributesExW (in: lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12473188 | out: lpFileInformation=0x12473188*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0138.263] CreateFileW (lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0138.263] GetFileAttributesExW (in: lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), fInfoLevelId=0x0, lpFileInformation=0x124731d8 | out: lpFileInformation=0x124731d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0138.263] CreateFileW (lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0138.263] GetFileAttributesExW (in: lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), fInfoLevelId=0x0, lpFileInformation=0x12473228 | out: lpFileInformation=0x12473228*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0138.263] CreateFileW (lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0138.264] GetFileAttributesExW (in: lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), fInfoLevelId=0x0, lpFileInformation=0x12473278 | out: lpFileInformation=0x12473278*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0138.264] CreateFileW (lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0138.264] GetFileAttributesExW (in: lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x124732c8 | out: lpFileInformation=0x124732c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0138.264] CreateFileW (lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0138.264] GetFileAttributesExW (in: lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), fInfoLevelId=0x0, lpFileInformation=0x12473318 | out: lpFileInformation=0x12473318*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0138.264] CreateFileW (lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0138.264] GetFileAttributesExW (in: lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), fInfoLevelId=0x0, lpFileInformation=0x12473368 | out: lpFileInformation=0x12473368*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0138.264] CreateFileW (lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0138.264] GetFileAttributesExW (in: lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), fInfoLevelId=0x0, lpFileInformation=0x124733b8 | out: lpFileInformation=0x124733b8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0138.265] CreateFileW (lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0138.265] GetFileAttributesExW (in: lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), fInfoLevelId=0x0, lpFileInformation=0x12473408 | out: lpFileInformation=0x12473408*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0138.265] CreateFileW (lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0138.265] GetFileAttributesExW (in: lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), fInfoLevelId=0x0, lpFileInformation=0x12473458 | out: lpFileInformation=0x12473458*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0138.265] CreateFileW (lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0138.310] GetFileAttributesExW (in: lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), fInfoLevelId=0x0, lpFileInformation=0x124734a8 | out: lpFileInformation=0x124734a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0138.310] CreateFileW (lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0138.310] GetFileAttributesExW (in: lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), fInfoLevelId=0x0, lpFileInformation=0x124734f8 | out: lpFileInformation=0x124734f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0138.311] CreateFileW (lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0138.311] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0x1246aa90, nSize=0x64 | out: lpBuffer="") returned 0x63
	[0138.311] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12473548 | out: lpFileInformation=0x12473548*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0138.312] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1246ab60, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0138.312] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12473598 | out: lpFileInformation=0x12473598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0138.312] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x140
	[0138.312] GetConsoleMode (in: hConsoleHandle=0x140, lpMode=0x12423aa4 | out: lpMode=0x12423aa4) returned 0
	[0138.312] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134
	[0138.312] GetConsoleMode (in: hConsoleHandle=0x134, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0138.312] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0138.312] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0138.312] GetEnvironmentStringsW () returned 0x79e0b0*
	[0138.313] FreeEnvironmentStringsW (penv=0x79e0b0) returned 1
	[0138.314] GetCurrentProcess () returned 0xffffffff
	[0138.314] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x140, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x123cf4d0, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x123cf4d0*=0x144) returned 1
	[0138.314] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x134, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x123cf4d4, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x123cf4d4*=0x150) returned 1
	[0138.314] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x138, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x123cf4d8, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x123cf4d8*=0x154) returned 1
	[0138.314] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c \"taskkill /f /im agntsvc.exeisqlplussvc.exe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x400, lpEnvironment=0x124a6a80, lpCurrentDirectory=0x0, lpStartupInfo=0x12423acc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x144, hStdOutput=0x150, hStdError=0x154), lpProcessInformation=0x12423aa8 | out: lpCommandLine="cmd.exe /c \"taskkill /f /im agntsvc.exeisqlplussvc.exe \"", lpProcessInformation=0x12423aa8*(hProcess=0x13c, hThread=0x130, dwProcessId=0x1158, dwThreadId=0x115c)) returned 1
	[0138.444] SetEvent (hEvent=0x168) returned 1
	[0138.444] CloseHandle (hObject=0x130) returned 1
	[0138.444] CloseHandle (hObject=0x154) returned 1
	[0138.444] CloseHandle (hObject=0x150) returned 1
	[0138.444] CloseHandle (hObject=0x144) returned 1
	[0138.444] CloseHandle (hObject=0x140) returned 1
	[0138.444] CloseHandle (hObject=0x134) returned 1
	[0138.444] CloseHandle (hObject=0x138) returned 1
	[0138.444] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0xffffffff) returned 0x0
	[0140.208] SetEvent (hEvent=0x168) returned 1
	[0140.208] GetExitCodeProcess (in: hProcess=0x13c, lpExitCode=0x12423bdc | out: lpExitCode=0x12423bdc*=0x80) returned 1
	[0140.209] GetProcessTimes (in: hProcess=0x13c, lpCreationTime=0x124ac1a0, lpExitTime=0x124ac1a8, lpKernelTime=0x124ac1b0, lpUserTime=0x124ac1b8 | out: lpCreationTime=0x124ac1a0, lpExitTime=0x124ac1a8, lpKernelTime=0x124ac1b0, lpUserTime=0x124ac1b8) returned 1
	[0140.210] CloseHandle (hObject=0x13c) returned 1
	[0140.211] SetEvent (hEvent=0x124) returned 1
	[0140.211] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x5) returned 0x102
	[0140.234] SetEvent (hEvent=0x124) returned 1
	[0140.235] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1243b040, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0140.236] GetFileAttributesExW (in: lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12431ea8 | out: lpFileInformation=0x12431ea8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0140.237] CreateFileW (lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0140.237] GetFileAttributesExW (in: lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), fInfoLevelId=0x0, lpFileInformation=0x12431ef8 | out: lpFileInformation=0x12431ef8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0140.237] CreateFileW (lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0140.237] GetFileAttributesExW (in: lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), fInfoLevelId=0x0, lpFileInformation=0x12431f48 | out: lpFileInformation=0x12431f48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0140.237] CreateFileW (lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0140.237] GetFileAttributesExW (in: lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), fInfoLevelId=0x0, lpFileInformation=0x12431f98 | out: lpFileInformation=0x12431f98*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0140.237] CreateFileW (lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0140.237] GetFileAttributesExW (in: lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x124b2008 | out: lpFileInformation=0x124b2008*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0140.237] CreateFileW (lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0140.238] GetFileAttributesExW (in: lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), fInfoLevelId=0x0, lpFileInformation=0x124b2058 | out: lpFileInformation=0x124b2058*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0140.238] CreateFileW (lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0140.238] GetFileAttributesExW (in: lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), fInfoLevelId=0x0, lpFileInformation=0x124b20a8 | out: lpFileInformation=0x124b20a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0140.238] CreateFileW (lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0140.238] GetFileAttributesExW (in: lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), fInfoLevelId=0x0, lpFileInformation=0x124b20f8 | out: lpFileInformation=0x124b20f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0140.238] CreateFileW (lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0140.238] GetFileAttributesExW (in: lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), fInfoLevelId=0x0, lpFileInformation=0x124b2148 | out: lpFileInformation=0x124b2148*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0140.238] CreateFileW (lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0140.238] GetFileAttributesExW (in: lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), fInfoLevelId=0x0, lpFileInformation=0x124b2198 | out: lpFileInformation=0x124b2198*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0140.238] CreateFileW (lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0140.238] GetFileAttributesExW (in: lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), fInfoLevelId=0x0, lpFileInformation=0x124b21e8 | out: lpFileInformation=0x124b21e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0140.238] CreateFileW (lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0140.239] GetFileAttributesExW (in: lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), fInfoLevelId=0x0, lpFileInformation=0x124b2238 | out: lpFileInformation=0x124b2238*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0140.239] CreateFileW (lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0140.239] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0x1243b110, nSize=0x64 | out: lpBuffer="") returned 0x63
	[0140.239] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124b2288 | out: lpFileInformation=0x124b2288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0140.239] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1243b1e0, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0140.240] VirtualAlloc (lpAddress=0x0, dwSize=0xafc7c, flAllocationType=0x3000, flProtect=0x4) returned 0x32d30000
	[0140.241] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124b22d8 | out: lpFileInformation=0x124b22d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0140.241] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c
	[0140.241] GetConsoleMode (in: hConsoleHandle=0x13c, lpMode=0x12423aa4 | out: lpMode=0x12423aa4) returned 0
	[0140.241] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0140.241] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0140.241] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134
	[0140.241] GetConsoleMode (in: hConsoleHandle=0x134, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0140.241] GetEnvironmentStringsW () returned 0x79e0b0*
	[0140.242] FreeEnvironmentStringsW (penv=0x79e0b0) returned 1
	[0140.242] GetCurrentProcess () returned 0xffffffff
	[0140.242] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x13c, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x12413f40, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x12413f40*=0x140) returned 1
	[0140.243] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x138, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x12413f44, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x12413f44*=0x144) returned 1
	[0140.243] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x134, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x12413f48, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x12413f48*=0x150) returned 1
	[0140.243] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c \"taskkill /f /im xfssvccon.exe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x400, lpEnvironment=0x124ba000, lpCurrentDirectory=0x0, lpStartupInfo=0x12423acc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x140, hStdOutput=0x144, hStdError=0x150), lpProcessInformation=0x12423aa8 | out: lpCommandLine="cmd.exe /c \"taskkill /f /im xfssvccon.exe \"", lpProcessInformation=0x12423aa8*(hProcess=0x130, hThread=0x154, dwProcessId=0x11d4, dwThreadId=0x11d8)) returned 1
	[0140.495] SetEvent (hEvent=0x168) returned 1
	[0140.495] CloseHandle (hObject=0x154) returned 1
	[0140.495] CloseHandle (hObject=0x150) returned 1
	[0140.495] CloseHandle (hObject=0x144) returned 1
	[0140.495] CloseHandle (hObject=0x140) returned 1
	[0140.496] CloseHandle (hObject=0x13c) returned 1
	[0140.496] CloseHandle (hObject=0x138) returned 1
	[0140.496] CloseHandle (hObject=0x134) returned 1
	[0140.496] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0xffffffff) returned 0x0
	[0141.866] SetEvent (hEvent=0x168) returned 1
	[0141.866] GetExitCodeProcess (in: hProcess=0x130, lpExitCode=0x12423bdc | out: lpExitCode=0x12423bdc*=0x80) returned 1
	[0141.867] GetProcessTimes (in: hProcess=0x130, lpCreationTime=0x124a1080, lpExitTime=0x124a1088, lpKernelTime=0x124a1090, lpUserTime=0x124a1098 | out: lpCreationTime=0x124a1080, lpExitTime=0x124a1088, lpKernelTime=0x124a1090, lpUserTime=0x124a1098) returned 1
	[0141.867] CloseHandle (hObject=0x130) returned 1
	[0141.867] SetEvent (hEvent=0x124) returned 1
	[0141.867] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x5) returned 0x102
	[0141.883] SetEvent (hEvent=0x168) returned 1
	[0141.883] SetEvent (hEvent=0x124) returned 1
	[0141.883] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1246ac30, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0141.884] GetFileAttributesExW (in: lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124735e8 | out: lpFileInformation=0x124735e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0141.884] CreateFileW (lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0141.884] GetFileAttributesExW (in: lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), fInfoLevelId=0x0, lpFileInformation=0x12473638 | out: lpFileInformation=0x12473638*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0141.884] CreateFileW (lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0141.884] GetFileAttributesExW (in: lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), fInfoLevelId=0x0, lpFileInformation=0x12473688 | out: lpFileInformation=0x12473688*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0141.884] CreateFileW (lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0141.884] GetFileAttributesExW (in: lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), fInfoLevelId=0x0, lpFileInformation=0x124736d8 | out: lpFileInformation=0x124736d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0141.884] CreateFileW (lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0141.884] GetFileAttributesExW (in: lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x12473728 | out: lpFileInformation=0x12473728*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0141.885] CreateFileW (lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0141.885] GetFileAttributesExW (in: lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), fInfoLevelId=0x0, lpFileInformation=0x12473778 | out: lpFileInformation=0x12473778*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0141.885] CreateFileW (lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0141.885] GetFileAttributesExW (in: lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), fInfoLevelId=0x0, lpFileInformation=0x124737c8 | out: lpFileInformation=0x124737c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0141.885] CreateFileW (lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0141.885] GetFileAttributesExW (in: lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), fInfoLevelId=0x0, lpFileInformation=0x12473818 | out: lpFileInformation=0x12473818*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0141.885] CreateFileW (lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0141.885] GetFileAttributesExW (in: lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), fInfoLevelId=0x0, lpFileInformation=0x12473868 | out: lpFileInformation=0x12473868*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0141.885] CreateFileW (lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0141.885] GetFileAttributesExW (in: lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), fInfoLevelId=0x0, lpFileInformation=0x124738b8 | out: lpFileInformation=0x124738b8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0141.886] CreateFileW (lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0141.886] GetFileAttributesExW (in: lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), fInfoLevelId=0x0, lpFileInformation=0x12473908 | out: lpFileInformation=0x12473908*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0141.886] CreateFileW (lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0141.886] GetFileAttributesExW (in: lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), fInfoLevelId=0x0, lpFileInformation=0x12473958 | out: lpFileInformation=0x12473958*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0141.886] CreateFileW (lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0141.886] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0x1246ad00, nSize=0x64 | out: lpBuffer="") returned 0x63
	[0141.886] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124739a8 | out: lpFileInformation=0x124739a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0141.886] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1246add0, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0141.886] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124739f8 | out: lpFileInformation=0x124739f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0141.886] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130
	[0141.886] GetConsoleMode (in: hConsoleHandle=0x130, lpMode=0x12423aa4 | out: lpMode=0x12423aa4) returned 0
	[0141.886] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134
	[0141.887] GetConsoleMode (in: hConsoleHandle=0x134, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0141.887] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0141.887] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0141.887] GetEnvironmentStringsW () returned 0x79e0b0*
	[0141.887] FreeEnvironmentStringsW (penv=0x79e0b0) returned 1
	[0141.887] GetCurrentProcess () returned 0xffffffff
	[0141.887] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x130, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x123cf8f0, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x123cf8f0*=0x13c) returned 1
	[0141.887] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x134, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x123cf8f4, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x123cf8f4*=0x140) returned 1
	[0141.887] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x138, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x123cf8f8, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x123cf8f8*=0x144) returned 1
	[0141.888] VirtualAlloc (lpAddress=0x124c0000, dwSize=0x100000, flAllocationType=0x1000, flProtect=0x4) returned 0x124c0000
	[0141.890] VirtualAlloc (lpAddress=0x11164000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x11164000
	[0141.891] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c \"taskkill /f /im mydesktopservice.exe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x400, lpEnvironment=0x124a7500, lpCurrentDirectory=0x0, lpStartupInfo=0x12423acc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x13c, hStdOutput=0x140, hStdError=0x144), lpProcessInformation=0x12423aa8 | out: lpCommandLine="cmd.exe /c \"taskkill /f /im mydesktopservice.exe \"", lpProcessInformation=0x12423aa8*(hProcess=0x154, hThread=0x150, dwProcessId=0x2e4, dwThreadId=0x5dc)) returned 1
	[0141.920] CloseHandle (hObject=0x150) returned 1
	[0141.920] CloseHandle (hObject=0x144) returned 1
	[0141.920] CloseHandle (hObject=0x140) returned 1
	[0141.920] CloseHandle (hObject=0x13c) returned 1
	[0141.920] CloseHandle (hObject=0x130) returned 1
	[0141.920] CloseHandle (hObject=0x134) returned 1
	[0141.920] CloseHandle (hObject=0x138) returned 1
	[0141.920] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0xffffffff) returned 0x0
	[0143.394] SetEvent (hEvent=0x168) returned 1
	[0143.395] GetExitCodeProcess (in: hProcess=0x154, lpExitCode=0x12423bdc | out: lpExitCode=0x12423bdc*=0x80) returned 1
	[0143.395] GetProcessTimes (in: hProcess=0x154, lpCreationTime=0x124ac7c0, lpExitTime=0x124ac7c8, lpKernelTime=0x124ac7d0, lpUserTime=0x124ac7d8 | out: lpCreationTime=0x124ac7c0, lpExitTime=0x124ac7c8, lpKernelTime=0x124ac7d0, lpUserTime=0x124ac7d8) returned 1
	[0143.395] CloseHandle (hObject=0x154) returned 1
	[0143.395] SetEvent (hEvent=0x124) returned 1
	[0143.395] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x5) returned 0x102
	[0143.406] SetEvent (hEvent=0x168) returned 1
	[0143.406] SetEvent (hEvent=0x124) returned 1
	[0143.406] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1243b2b0, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0143.406] GetFileAttributesExW (in: lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124b2328 | out: lpFileInformation=0x124b2328*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0143.407] CreateFileW (lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0143.407] GetFileAttributesExW (in: lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), fInfoLevelId=0x0, lpFileInformation=0x124b2378 | out: lpFileInformation=0x124b2378*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0143.407] CreateFileW (lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0143.407] GetFileAttributesExW (in: lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), fInfoLevelId=0x0, lpFileInformation=0x124b23c8 | out: lpFileInformation=0x124b23c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0143.407] CreateFileW (lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0143.407] GetFileAttributesExW (in: lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), fInfoLevelId=0x0, lpFileInformation=0x124b2418 | out: lpFileInformation=0x124b2418*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0143.407] CreateFileW (lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0143.407] GetFileAttributesExW (in: lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x124b2468 | out: lpFileInformation=0x124b2468*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0143.407] CreateFileW (lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0143.407] GetFileAttributesExW (in: lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), fInfoLevelId=0x0, lpFileInformation=0x124b24b8 | out: lpFileInformation=0x124b24b8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0143.407] CreateFileW (lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0143.408] GetFileAttributesExW (in: lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), fInfoLevelId=0x0, lpFileInformation=0x124b2508 | out: lpFileInformation=0x124b2508*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0143.408] CreateFileW (lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0143.408] GetFileAttributesExW (in: lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), fInfoLevelId=0x0, lpFileInformation=0x124b2558 | out: lpFileInformation=0x124b2558*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0143.408] CreateFileW (lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0143.408] GetFileAttributesExW (in: lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), fInfoLevelId=0x0, lpFileInformation=0x124b25a8 | out: lpFileInformation=0x124b25a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0143.408] CreateFileW (lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0143.408] GetFileAttributesExW (in: lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), fInfoLevelId=0x0, lpFileInformation=0x124b25f8 | out: lpFileInformation=0x124b25f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0143.408] CreateFileW (lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0143.408] GetFileAttributesExW (in: lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), fInfoLevelId=0x0, lpFileInformation=0x124b2648 | out: lpFileInformation=0x124b2648*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0143.408] CreateFileW (lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0143.409] GetFileAttributesExW (in: lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), fInfoLevelId=0x0, lpFileInformation=0x124b2698 | out: lpFileInformation=0x124b2698*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0143.409] CreateFileW (lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0143.409] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0x1243b380, nSize=0x64 | out: lpBuffer="") returned 0x63
	[0143.409] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124b26e8 | out: lpFileInformation=0x124b26e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0143.409] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1243b450, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0143.409] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124b2738 | out: lpFileInformation=0x124b2738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0143.409] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154
	[0143.409] GetConsoleMode (in: hConsoleHandle=0x154, lpMode=0x12423aa4 | out: lpMode=0x12423aa4) returned 0
	[0143.409] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0143.409] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0143.409] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134
	[0143.409] GetConsoleMode (in: hConsoleHandle=0x134, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0143.410] GetEnvironmentStringsW () returned 0x79e0b0*
	[0143.410] FreeEnvironmentStringsW (penv=0x79e0b0) returned 1
	[0143.410] GetCurrentProcess () returned 0xffffffff
	[0143.410] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x154, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124c2360, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124c2360*=0x130) returned 1
	[0143.410] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x138, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124c2364, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124c2364*=0x13c) returned 1
	[0143.410] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x134, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124c2368, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124c2368*=0x140) returned 1
	[0143.410] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c \"taskkill /f /im ocautoupds.exe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x400, lpEnvironment=0x124baa80, lpCurrentDirectory=0x0, lpStartupInfo=0x12423acc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x130, hStdOutput=0x13c, hStdError=0x140), lpProcessInformation=0x12423aa8 | out: lpCommandLine="cmd.exe /c \"taskkill /f /im ocautoupds.exe \"", lpProcessInformation=0x12423aa8*(hProcess=0x150, hThread=0x144, dwProcessId=0xff8, dwThreadId=0x5e0)) returned 1
	[0143.440] CloseHandle (hObject=0x144) returned 1
	[0143.440] CloseHandle (hObject=0x140) returned 1
	[0143.440] CloseHandle (hObject=0x13c) returned 1
	[0143.440] CloseHandle (hObject=0x130) returned 1
	[0143.440] CloseHandle (hObject=0x154) returned 1
	[0143.440] CloseHandle (hObject=0x138) returned 1
	[0143.440] CloseHandle (hObject=0x134) returned 1
	[0143.440] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0
	[0144.690] SetEvent (hEvent=0x168) returned 1
	[0144.690] GetExitCodeProcess (in: hProcess=0x150, lpExitCode=0x12423bdc | out: lpExitCode=0x12423bdc*=0x80) returned 1
	[0144.690] GetProcessTimes (in: hProcess=0x150, lpCreationTime=0x124a16a0, lpExitTime=0x124a16a8, lpKernelTime=0x124a16b0, lpUserTime=0x124a16b8 | out: lpCreationTime=0x124a16a0, lpExitTime=0x124a16a8, lpKernelTime=0x124a16b0, lpUserTime=0x124a16b8) returned 1
	[0144.690] CloseHandle (hObject=0x150) returned 1
	[0144.691] SetEvent (hEvent=0x124) returned 1
	[0144.691] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x5) returned 0x102
	[0144.699] SetEvent (hEvent=0x168) returned 1
	[0144.699] SetEvent (hEvent=0x124) returned 1
	[0144.699] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1246af70, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0144.699] GetFileAttributesExW (in: lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12473a48 | out: lpFileInformation=0x12473a48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0144.700] CreateFileW (lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0144.700] GetFileAttributesExW (in: lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), fInfoLevelId=0x0, lpFileInformation=0x12473a98 | out: lpFileInformation=0x12473a98*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0144.700] CreateFileW (lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0144.700] GetFileAttributesExW (in: lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), fInfoLevelId=0x0, lpFileInformation=0x12473ae8 | out: lpFileInformation=0x12473ae8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0144.700] CreateFileW (lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0144.701] GetFileAttributesExW (in: lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), fInfoLevelId=0x0, lpFileInformation=0x12473b38 | out: lpFileInformation=0x12473b38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0144.701] CreateFileW (lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0144.701] GetFileAttributesExW (in: lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x12473b88 | out: lpFileInformation=0x12473b88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0144.706] CreateFileW (lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0144.706] GetFileAttributesExW (in: lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), fInfoLevelId=0x0, lpFileInformation=0x12473bd8 | out: lpFileInformation=0x12473bd8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0144.706] CreateFileW (lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0144.707] GetFileAttributesExW (in: lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), fInfoLevelId=0x0, lpFileInformation=0x12473c28 | out: lpFileInformation=0x12473c28*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0144.707] CreateFileW (lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0144.707] GetFileAttributesExW (in: lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), fInfoLevelId=0x0, lpFileInformation=0x12473c78 | out: lpFileInformation=0x12473c78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0144.707] CreateFileW (lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0144.707] GetFileAttributesExW (in: lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), fInfoLevelId=0x0, lpFileInformation=0x12473cc8 | out: lpFileInformation=0x12473cc8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0144.707] CreateFileW (lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0144.707] GetFileAttributesExW (in: lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), fInfoLevelId=0x0, lpFileInformation=0x12473d18 | out: lpFileInformation=0x12473d18*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0144.707] CreateFileW (lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0144.708] GetFileAttributesExW (in: lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), fInfoLevelId=0x0, lpFileInformation=0x12473d68 | out: lpFileInformation=0x12473d68*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0144.708] CreateFileW (lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0144.708] GetFileAttributesExW (in: lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), fInfoLevelId=0x0, lpFileInformation=0x12473db8 | out: lpFileInformation=0x12473db8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0144.708] CreateFileW (lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0144.708] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0x1246b040, nSize=0x64 | out: lpBuffer="") returned 0x63
	[0144.708] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12473e08 | out: lpFileInformation=0x12473e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0144.708] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1246b110, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0144.708] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12473e58 | out: lpFileInformation=0x12473e58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0144.709] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x150
	[0144.709] GetConsoleMode (in: hConsoleHandle=0x150, lpMode=0x12423aa4 | out: lpMode=0x12423aa4) returned 0
	[0144.709] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134
	[0144.709] GetConsoleMode (in: hConsoleHandle=0x134, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0144.709] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0144.709] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0144.709] GetEnvironmentStringsW () returned 0x79e0b0*
	[0144.709] FreeEnvironmentStringsW (penv=0x79e0b0) returned 1
	[0144.709] GetCurrentProcess () returned 0xffffffff
	[0144.710] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x150, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x123cfd10, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x123cfd10*=0x154) returned 1
	[0144.710] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x134, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x123cfd14, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x123cfd14*=0x130) returned 1
	[0144.710] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x138, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x123cfd18, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x123cfd18*=0x13c) returned 1
	[0144.710] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c \"taskkill /f /im agntsvc.exeagntsvc.exe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x400, lpEnvironment=0x124ce000, lpCurrentDirectory=0x0, lpStartupInfo=0x12423acc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x154, hStdOutput=0x130, hStdError=0x13c), lpProcessInformation=0x12423aa8 | out: lpCommandLine="cmd.exe /c \"taskkill /f /im agntsvc.exeagntsvc.exe \"", lpProcessInformation=0x12423aa8*(hProcess=0x144, hThread=0x140, dwProcessId=0xc2c, dwThreadId=0x1398)) returned 1
	[0144.795] SetEvent (hEvent=0x168) returned 1
	[0144.795] CloseHandle (hObject=0x140) returned 1
	[0144.795] CloseHandle (hObject=0x13c) returned 1
	[0144.796] CloseHandle (hObject=0x130) returned 1
	[0144.796] CloseHandle (hObject=0x154) returned 1
	[0144.796] CloseHandle (hObject=0x150) returned 1
	[0144.796] CloseHandle (hObject=0x134) returned 1
	[0144.796] CloseHandle (hObject=0x138) returned 1
	[0144.796] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0
	[0146.007] SetEvent (hEvent=0x168) returned 1
	[0146.007] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0x12423bdc | out: lpExitCode=0x12423bdc*=0x80) returned 1
	[0146.007] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0x124acde0, lpExitTime=0x124acde8, lpKernelTime=0x124acdf0, lpUserTime=0x124acdf8 | out: lpCreationTime=0x124acde0, lpExitTime=0x124acde8, lpKernelTime=0x124acdf0, lpUserTime=0x124acdf8) returned 1
	[0146.007] CloseHandle (hObject=0x144) returned 1
	[0146.007] SetEvent (hEvent=0x124) returned 1
	[0146.007] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x5) returned 0x102
	[0146.046] SetEvent (hEvent=0x124) returned 1
	[0146.046] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1243b520, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0146.046] GetFileAttributesExW (in: lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124b2788 | out: lpFileInformation=0x124b2788*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0146.047] CreateFileW (lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0146.047] GetFileAttributesExW (in: lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), fInfoLevelId=0x0, lpFileInformation=0x124b27d8 | out: lpFileInformation=0x124b27d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0146.055] CreateFileW (lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0146.056] GetFileAttributesExW (in: lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), fInfoLevelId=0x0, lpFileInformation=0x124b2828 | out: lpFileInformation=0x124b2828*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0146.056] CreateFileW (lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0146.056] GetFileAttributesExW (in: lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), fInfoLevelId=0x0, lpFileInformation=0x124b2878 | out: lpFileInformation=0x124b2878*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0146.056] CreateFileW (lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0146.056] GetFileAttributesExW (in: lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x124b28c8 | out: lpFileInformation=0x124b28c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0146.056] CreateFileW (lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0146.057] GetFileAttributesExW (in: lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), fInfoLevelId=0x0, lpFileInformation=0x124b2918 | out: lpFileInformation=0x124b2918*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0146.057] CreateFileW (lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0146.057] GetFileAttributesExW (in: lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), fInfoLevelId=0x0, lpFileInformation=0x124b2968 | out: lpFileInformation=0x124b2968*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0146.057] CreateFileW (lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0146.057] GetFileAttributesExW (in: lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), fInfoLevelId=0x0, lpFileInformation=0x124b29b8 | out: lpFileInformation=0x124b29b8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0146.057] CreateFileW (lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0146.057] GetFileAttributesExW (in: lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), fInfoLevelId=0x0, lpFileInformation=0x124b2a08 | out: lpFileInformation=0x124b2a08*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0146.058] CreateFileW (lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0146.058] GetFileAttributesExW (in: lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), fInfoLevelId=0x0, lpFileInformation=0x124b2a58 | out: lpFileInformation=0x124b2a58*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0146.058] CreateFileW (lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0146.058] GetFileAttributesExW (in: lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), fInfoLevelId=0x0, lpFileInformation=0x124b2aa8 | out: lpFileInformation=0x124b2aa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0146.058] CreateFileW (lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0146.059] GetFileAttributesExW (in: lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), fInfoLevelId=0x0, lpFileInformation=0x124b2af8 | out: lpFileInformation=0x124b2af8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0146.059] CreateFileW (lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0146.059] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0x1243b5f0, nSize=0x64 | out: lpBuffer="") returned 0x63
	[0146.059] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124b2b48 | out: lpFileInformation=0x124b2b48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0146.059] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1243b6c0, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0146.060] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124b2b98 | out: lpFileInformation=0x124b2b98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0146.060] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x144
	[0146.060] GetConsoleMode (in: hConsoleHandle=0x144, lpMode=0x12423aa4 | out: lpMode=0x12423aa4) returned 0
	[0146.060] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0146.060] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0146.060] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134
	[0146.060] GetConsoleMode (in: hConsoleHandle=0x134, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0146.060] GetEnvironmentStringsW () returned 0x79e0b0*
	[0146.061] FreeEnvironmentStringsW (penv=0x79e0b0) returned 1
	[0146.061] GetCurrentProcess () returned 0xffffffff
	[0146.061] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x144, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124c2780, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124c2780*=0x150) returned 1
	[0146.061] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x138, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124c2784, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124c2784*=0x154) returned 1
	[0146.061] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x134, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124c2788, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124c2788*=0x130) returned 1
	[0146.062] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c \"taskkill /f /im agntsvc.exeencsvc.exe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x400, lpEnvironment=0x124bb500, lpCurrentDirectory=0x0, lpStartupInfo=0x12423acc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x150, hStdOutput=0x154, hStdError=0x130), lpProcessInformation=0x12423aa8 | out: lpCommandLine="cmd.exe /c \"taskkill /f /im agntsvc.exeencsvc.exe \"", lpProcessInformation=0x12423aa8*(hProcess=0x140, hThread=0x13c, dwProcessId=0x514, dwThreadId=0xf00)) returned 1
	[0146.109] CloseHandle (hObject=0x13c) returned 1
	[0146.109] CloseHandle (hObject=0x130) returned 1
	[0146.109] CloseHandle (hObject=0x154) returned 1
	[0146.109] CloseHandle (hObject=0x150) returned 1
	[0146.109] CloseHandle (hObject=0x144) returned 1
	[0146.109] CloseHandle (hObject=0x138) returned 1
	[0146.110] CloseHandle (hObject=0x134) returned 1
	[0146.110] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0xffffffff) returned 0x0
	[0147.509] SetEvent (hEvent=0x168) returned 1
	[0147.509] GetExitCodeProcess (in: hProcess=0x140, lpExitCode=0x12423bdc | out: lpExitCode=0x12423bdc*=0x80) returned 1
	[0147.509] GetProcessTimes (in: hProcess=0x140, lpCreationTime=0x124a1cc0, lpExitTime=0x124a1cc8, lpKernelTime=0x124a1cd0, lpUserTime=0x124a1cd8 | out: lpCreationTime=0x124a1cc0, lpExitTime=0x124a1cc8, lpKernelTime=0x124a1cd0, lpUserTime=0x124a1cd8) returned 1
	[0147.509] CloseHandle (hObject=0x140) returned 1
	[0147.509] SetEvent (hEvent=0x124) returned 1
	[0147.509] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x5) returned 0x102
	[0147.515] SetEvent (hEvent=0x168) returned 1
	[0147.515] SetEvent (hEvent=0x124) returned 1
	[0147.516] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1246b1e0, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0147.516] GetFileAttributesExW (in: lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12473ea8 | out: lpFileInformation=0x12473ea8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0147.516] CreateFileW (lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0147.521] GetFileAttributesExW (in: lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), fInfoLevelId=0x0, lpFileInformation=0x12473ef8 | out: lpFileInformation=0x12473ef8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0147.521] CreateFileW (lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0147.521] GetFileAttributesExW (in: lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), fInfoLevelId=0x0, lpFileInformation=0x12473f48 | out: lpFileInformation=0x12473f48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0147.521] CreateFileW (lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0147.521] GetFileAttributesExW (in: lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), fInfoLevelId=0x0, lpFileInformation=0x12473f98 | out: lpFileInformation=0x12473f98*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0147.521] CreateFileW (lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0147.522] GetFileAttributesExW (in: lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x124d2008 | out: lpFileInformation=0x124d2008*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0147.522] CreateFileW (lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0147.522] GetFileAttributesExW (in: lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), fInfoLevelId=0x0, lpFileInformation=0x124d2058 | out: lpFileInformation=0x124d2058*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0147.522] CreateFileW (lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0147.522] GetFileAttributesExW (in: lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), fInfoLevelId=0x0, lpFileInformation=0x124d20a8 | out: lpFileInformation=0x124d20a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0147.522] CreateFileW (lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0147.522] GetFileAttributesExW (in: lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), fInfoLevelId=0x0, lpFileInformation=0x124d20f8 | out: lpFileInformation=0x124d20f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0147.522] CreateFileW (lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0147.522] GetFileAttributesExW (in: lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), fInfoLevelId=0x0, lpFileInformation=0x124d2148 | out: lpFileInformation=0x124d2148*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0147.522] CreateFileW (lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0147.523] GetFileAttributesExW (in: lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), fInfoLevelId=0x0, lpFileInformation=0x124d2198 | out: lpFileInformation=0x124d2198*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0147.523] CreateFileW (lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0147.523] GetFileAttributesExW (in: lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), fInfoLevelId=0x0, lpFileInformation=0x124d21e8 | out: lpFileInformation=0x124d21e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0147.523] CreateFileW (lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0147.523] GetFileAttributesExW (in: lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), fInfoLevelId=0x0, lpFileInformation=0x124d2238 | out: lpFileInformation=0x124d2238*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0147.523] CreateFileW (lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0147.523] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0x1246b2b0, nSize=0x64 | out: lpBuffer="") returned 0x63
	[0147.523] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124d2288 | out: lpFileInformation=0x124d2288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0147.523] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1246b380, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0147.523] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124d22d8 | out: lpFileInformation=0x124d22d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0147.523] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x140
	[0147.524] GetConsoleMode (in: hConsoleHandle=0x140, lpMode=0x12423aa4 | out: lpMode=0x12423aa4) returned 0
	[0147.524] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134
	[0147.524] GetConsoleMode (in: hConsoleHandle=0x134, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0147.524] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0147.524] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0147.524] GetEnvironmentStringsW () returned 0x79e0b0*
	[0147.524] FreeEnvironmentStringsW (penv=0x79e0b0) returned 1
	[0147.525] GetCurrentProcess () returned 0xffffffff
	[0147.525] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x140, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124da130, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124da130*=0x144) returned 1
	[0147.525] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x134, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124da134, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124da134*=0x150) returned 1
	[0147.525] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x138, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124da138, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124da138*=0x154) returned 1
	[0147.525] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c \"taskkill /f /im firefoxconfig.exe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x400, lpEnvironment=0x124cea80, lpCurrentDirectory=0x0, lpStartupInfo=0x12423acc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x144, hStdOutput=0x150, hStdError=0x154), lpProcessInformation=0x12423aa8 | out: lpCommandLine="cmd.exe /c \"taskkill /f /im firefoxconfig.exe \"", lpProcessInformation=0x12423aa8*(hProcess=0x13c, hThread=0x130, dwProcessId=0xd88, dwThreadId=0xe5c)) returned 1
	[0147.562] CloseHandle (hObject=0x130) returned 1
	[0147.562] CloseHandle (hObject=0x154) returned 1
	[0147.562] CloseHandle (hObject=0x150) returned 1
	[0147.562] CloseHandle (hObject=0x144) returned 1
	[0147.562] CloseHandle (hObject=0x140) returned 1
	[0147.562] CloseHandle (hObject=0x134) returned 1
	[0147.562] CloseHandle (hObject=0x138) returned 1
	[0147.562] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0xffffffff) returned 0x0
	[0149.003] SetEvent (hEvent=0x168) returned 1
	[0149.003] GetExitCodeProcess (in: hProcess=0x13c, lpExitCode=0x12423bdc | out: lpExitCode=0x12423bdc*=0x80) returned 1
	[0149.003] GetProcessTimes (in: hProcess=0x13c, lpCreationTime=0x124ad400, lpExitTime=0x124ad408, lpKernelTime=0x124ad410, lpUserTime=0x124ad418 | out: lpCreationTime=0x124ad400, lpExitTime=0x124ad408, lpKernelTime=0x124ad410, lpUserTime=0x124ad418) returned 1
	[0149.003] CloseHandle (hObject=0x13c) returned 1
	[0149.003] SetEvent (hEvent=0x124) returned 1
	[0149.003] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x5) returned 0x102
	[0149.080] SetEvent (hEvent=0x168) returned 1
	[0149.080] SetEvent (hEvent=0x124) returned 1
	[0149.080] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1243b860, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0149.080] GetFileAttributesExW (in: lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124b2be8 | out: lpFileInformation=0x124b2be8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0149.080] CreateFileW (lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0149.080] GetFileAttributesExW (in: lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), fInfoLevelId=0x0, lpFileInformation=0x124b2c38 | out: lpFileInformation=0x124b2c38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0149.080] CreateFileW (lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0149.081] GetFileAttributesExW (in: lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), fInfoLevelId=0x0, lpFileInformation=0x124b2c88 | out: lpFileInformation=0x124b2c88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0149.081] CreateFileW (lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0149.081] GetFileAttributesExW (in: lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), fInfoLevelId=0x0, lpFileInformation=0x124b2cd8 | out: lpFileInformation=0x124b2cd8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0149.081] CreateFileW (lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0149.103] GetFileAttributesExW (in: lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x124b2d28 | out: lpFileInformation=0x124b2d28*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0149.103] CreateFileW (lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0149.103] GetFileAttributesExW (in: lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), fInfoLevelId=0x0, lpFileInformation=0x124b2d78 | out: lpFileInformation=0x124b2d78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0149.103] CreateFileW (lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0149.103] GetFileAttributesExW (in: lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), fInfoLevelId=0x0, lpFileInformation=0x124b2dc8 | out: lpFileInformation=0x124b2dc8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0149.103] CreateFileW (lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0149.104] GetFileAttributesExW (in: lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), fInfoLevelId=0x0, lpFileInformation=0x124b2e18 | out: lpFileInformation=0x124b2e18*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0149.104] CreateFileW (lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0149.104] GetFileAttributesExW (in: lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), fInfoLevelId=0x0, lpFileInformation=0x124b2e68 | out: lpFileInformation=0x124b2e68*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0149.104] CreateFileW (lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0149.104] GetFileAttributesExW (in: lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), fInfoLevelId=0x0, lpFileInformation=0x124b2eb8 | out: lpFileInformation=0x124b2eb8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0149.104] CreateFileW (lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0149.105] GetFileAttributesExW (in: lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), fInfoLevelId=0x0, lpFileInformation=0x124b2f08 | out: lpFileInformation=0x124b2f08*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0149.105] CreateFileW (lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0149.105] GetFileAttributesExW (in: lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), fInfoLevelId=0x0, lpFileInformation=0x124b2f58 | out: lpFileInformation=0x124b2f58*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0149.105] CreateFileW (lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0149.105] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0x1243b930, nSize=0x64 | out: lpBuffer="") returned 0x63
	[0149.105] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124b2fa8 | out: lpFileInformation=0x124b2fa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0149.105] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1243ba00, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0149.105] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124b2ff8 | out: lpFileInformation=0x124b2ff8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0149.106] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c
	[0149.106] GetConsoleMode (in: hConsoleHandle=0x13c, lpMode=0x12423aa4 | out: lpMode=0x12423aa4) returned 0
	[0149.106] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0149.106] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0149.106] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134
	[0149.106] GetConsoleMode (in: hConsoleHandle=0x134, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0149.106] GetEnvironmentStringsW () returned 0x79e0b0*
	[0149.107] FreeEnvironmentStringsW (penv=0x79e0b0) returned 1
	[0149.107] GetCurrentProcess () returned 0xffffffff
	[0149.107] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x13c, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124c2ba0, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124c2ba0*=0x140) returned 1
	[0149.107] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x138, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124c2ba4, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124c2ba4*=0x144) returned 1
	[0149.107] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x134, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124c2ba8, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124c2ba8*=0x150) returned 1
	[0149.107] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c \"taskkill /f /im tbirdconfig.exe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x400, lpEnvironment=0x124e2000, lpCurrentDirectory=0x0, lpStartupInfo=0x12423acc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x140, hStdOutput=0x144, hStdError=0x150), lpProcessInformation=0x12423aa8 | out: lpCommandLine="cmd.exe /c \"taskkill /f /im tbirdconfig.exe \"", lpProcessInformation=0x12423aa8*(hProcess=0x130, hThread=0x154, dwProcessId=0xe58, dwThreadId=0x2c8)) returned 1
	[0149.229] SetEvent (hEvent=0x168) returned 1
	[0149.229] CloseHandle (hObject=0x154) returned 1
	[0149.229] CloseHandle (hObject=0x150) returned 1
	[0149.229] CloseHandle (hObject=0x144) returned 1
	[0149.229] CloseHandle (hObject=0x140) returned 1
	[0149.229] CloseHandle (hObject=0x13c) returned 1
	[0149.229] CloseHandle (hObject=0x138) returned 1
	[0149.229] CloseHandle (hObject=0x134) returned 1
	[0149.229] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0xffffffff) returned 0x0
	[0150.684] SetEvent (hEvent=0x168) returned 1
	[0150.684] GetExitCodeProcess (in: hProcess=0x130, lpExitCode=0x12423bdc | out: lpExitCode=0x12423bdc*=0x80) returned 1
	[0150.684] GetProcessTimes (in: hProcess=0x130, lpCreationTime=0x124dc2e0, lpExitTime=0x124dc2e8, lpKernelTime=0x124dc2f0, lpUserTime=0x124dc2f8 | out: lpCreationTime=0x124dc2e0, lpExitTime=0x124dc2e8, lpKernelTime=0x124dc2f0, lpUserTime=0x124dc2f8) returned 1
	[0150.684] CloseHandle (hObject=0x130) returned 1
	[0150.685] SetEvent (hEvent=0x124) returned 1
	[0150.685] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x5) returned 0x102
	[0150.766] SetEvent (hEvent=0x168) returned 1
	[0150.766] SetEvent (hEvent=0x124) returned 1
	[0150.766] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1246b450, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0150.766] GetFileAttributesExW (in: lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124d2328 | out: lpFileInformation=0x124d2328*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0150.767] CreateFileW (lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0150.767] GetFileAttributesExW (in: lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), fInfoLevelId=0x0, lpFileInformation=0x124d2378 | out: lpFileInformation=0x124d2378*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0150.767] CreateFileW (lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0150.767] GetFileAttributesExW (in: lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), fInfoLevelId=0x0, lpFileInformation=0x124d23c8 | out: lpFileInformation=0x124d23c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0150.767] CreateFileW (lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0150.767] GetFileAttributesExW (in: lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), fInfoLevelId=0x0, lpFileInformation=0x124d2418 | out: lpFileInformation=0x124d2418*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0150.767] CreateFileW (lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0150.767] GetFileAttributesExW (in: lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x124d2468 | out: lpFileInformation=0x124d2468*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0150.767] CreateFileW (lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0150.767] GetFileAttributesExW (in: lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), fInfoLevelId=0x0, lpFileInformation=0x124d24b8 | out: lpFileInformation=0x124d24b8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0150.768] CreateFileW (lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0150.768] GetFileAttributesExW (in: lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), fInfoLevelId=0x0, lpFileInformation=0x124d2508 | out: lpFileInformation=0x124d2508*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0150.768] CreateFileW (lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0150.768] GetFileAttributesExW (in: lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), fInfoLevelId=0x0, lpFileInformation=0x124d2558 | out: lpFileInformation=0x124d2558*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0150.768] CreateFileW (lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0150.768] GetFileAttributesExW (in: lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), fInfoLevelId=0x0, lpFileInformation=0x124d25a8 | out: lpFileInformation=0x124d25a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0150.768] CreateFileW (lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0150.768] GetFileAttributesExW (in: lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), fInfoLevelId=0x0, lpFileInformation=0x124d25f8 | out: lpFileInformation=0x124d25f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0150.768] CreateFileW (lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0150.768] GetFileAttributesExW (in: lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), fInfoLevelId=0x0, lpFileInformation=0x124d2648 | out: lpFileInformation=0x124d2648*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0150.768] CreateFileW (lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0150.768] GetFileAttributesExW (in: lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), fInfoLevelId=0x0, lpFileInformation=0x124d2698 | out: lpFileInformation=0x124d2698*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0150.768] CreateFileW (lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0150.769] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0x1246b520, nSize=0x64 | out: lpBuffer="") returned 0x63
	[0150.769] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124d26e8 | out: lpFileInformation=0x124d26e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0150.769] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1246b5f0, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0150.769] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124d2738 | out: lpFileInformation=0x124d2738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0150.769] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130
	[0150.769] GetConsoleMode (in: hConsoleHandle=0x130, lpMode=0x12423aa4 | out: lpMode=0x12423aa4) returned 0
	[0150.769] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134
	[0150.769] GetConsoleMode (in: hConsoleHandle=0x134, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0150.769] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0150.769] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0150.769] GetEnvironmentStringsW () returned 0x79e0b0*
	[0150.770] FreeEnvironmentStringsW (penv=0x79e0b0) returned 1
	[0150.770] GetCurrentProcess () returned 0xffffffff
	[0150.770] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x130, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124da550, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124da550*=0x13c) returned 1
	[0150.770] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x134, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124da554, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124da554*=0x140) returned 1
	[0150.770] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x138, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124da558, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124da558*=0x144) returned 1
	[0150.770] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c \"taskkill /f /im ocomm.exe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x400, lpEnvironment=0x124cf500, lpCurrentDirectory=0x0, lpStartupInfo=0x12423acc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x13c, hStdOutput=0x140, hStdError=0x144), lpProcessInformation=0x12423aa8 | out: lpCommandLine="cmd.exe /c \"taskkill /f /im ocomm.exe \"", lpProcessInformation=0x12423aa8*(hProcess=0x154, hThread=0x150, dwProcessId=0xec, dwThreadId=0x1230)) returned 1
	[0150.859] SetEvent (hEvent=0x168) returned 1
	[0150.859] CloseHandle (hObject=0x150) returned 1
	[0150.859] CloseHandle (hObject=0x144) returned 1
	[0150.859] CloseHandle (hObject=0x140) returned 1
	[0150.859] CloseHandle (hObject=0x13c) returned 1
	[0150.859] CloseHandle (hObject=0x130) returned 1
	[0150.859] CloseHandle (hObject=0x134) returned 1
	[0150.859] CloseHandle (hObject=0x138) returned 1
	[0150.859] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0xffffffff) returned 0x0
	[0152.474] SetEvent (hEvent=0x168) returned 1
	[0152.474] GetExitCodeProcess (in: hProcess=0x154, lpExitCode=0x12423bdc | out: lpExitCode=0x12423bdc*=0x80) returned 1
	[0152.474] GetProcessTimes (in: hProcess=0x154, lpCreationTime=0x124ada60, lpExitTime=0x124ada68, lpKernelTime=0x124ada70, lpUserTime=0x124ada78 | out: lpCreationTime=0x124ada60, lpExitTime=0x124ada68, lpKernelTime=0x124ada70, lpUserTime=0x124ada78) returned 1
	[0152.474] CloseHandle (hObject=0x154) returned 1
	[0152.474] SetEvent (hEvent=0x124) returned 1
	[0152.474] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x4) returned 0x102
	[0152.506] SetEvent (hEvent=0x124) returned 1
	[0152.506] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1243bad0, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0152.506] GetFileAttributesExW (in: lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124b3048 | out: lpFileInformation=0x124b3048*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0152.506] CreateFileW (lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0152.506] GetFileAttributesExW (in: lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), fInfoLevelId=0x0, lpFileInformation=0x124b3098 | out: lpFileInformation=0x124b3098*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0152.506] CreateFileW (lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0152.507] GetFileAttributesExW (in: lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), fInfoLevelId=0x0, lpFileInformation=0x124b30e8 | out: lpFileInformation=0x124b30e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0152.507] CreateFileW (lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0152.507] GetFileAttributesExW (in: lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), fInfoLevelId=0x0, lpFileInformation=0x124b3138 | out: lpFileInformation=0x124b3138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0152.507] CreateFileW (lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0152.507] GetFileAttributesExW (in: lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x124b3188 | out: lpFileInformation=0x124b3188*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0152.507] CreateFileW (lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0152.507] GetFileAttributesExW (in: lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), fInfoLevelId=0x0, lpFileInformation=0x124b31d8 | out: lpFileInformation=0x124b31d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0152.507] CreateFileW (lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0152.507] GetFileAttributesExW (in: lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), fInfoLevelId=0x0, lpFileInformation=0x124b3228 | out: lpFileInformation=0x124b3228*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0152.507] CreateFileW (lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0152.507] GetFileAttributesExW (in: lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), fInfoLevelId=0x0, lpFileInformation=0x124b3278 | out: lpFileInformation=0x124b3278*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0152.507] CreateFileW (lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0152.508] GetFileAttributesExW (in: lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), fInfoLevelId=0x0, lpFileInformation=0x124b32c8 | out: lpFileInformation=0x124b32c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0152.508] CreateFileW (lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0152.508] GetFileAttributesExW (in: lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), fInfoLevelId=0x0, lpFileInformation=0x124b3318 | out: lpFileInformation=0x124b3318*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0152.508] CreateFileW (lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0152.508] GetFileAttributesExW (in: lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), fInfoLevelId=0x0, lpFileInformation=0x124b3368 | out: lpFileInformation=0x124b3368*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0152.508] CreateFileW (lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0152.508] GetFileAttributesExW (in: lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), fInfoLevelId=0x0, lpFileInformation=0x124b33b8 | out: lpFileInformation=0x124b33b8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0152.508] CreateFileW (lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0152.508] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0x1243bba0, nSize=0x64 | out: lpBuffer="") returned 0x63
	[0152.508] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124b3408 | out: lpFileInformation=0x124b3408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0152.508] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1243bc70, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0152.509] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124b3458 | out: lpFileInformation=0x124b3458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0152.509] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154
	[0152.509] GetConsoleMode (in: hConsoleHandle=0x154, lpMode=0x12423aa4 | out: lpMode=0x12423aa4) returned 0
	[0152.509] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0152.509] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0152.509] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134
	[0152.509] GetConsoleMode (in: hConsoleHandle=0x134, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0152.509] GetEnvironmentStringsW () returned 0x79e0b0*
	[0152.510] FreeEnvironmentStringsW (penv=0x79e0b0) returned 1
	[0152.510] GetCurrentProcess () returned 0xffffffff
	[0152.510] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x154, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124c2fc0, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124c2fc0*=0x130) returned 1
	[0152.510] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x138, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124c2fc4, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124c2fc4*=0x13c) returned 1
	[0152.510] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x134, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124c2fc8, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124c2fc8*=0x140) returned 1
	[0152.510] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c \"taskkill /f /im mysqld.exe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x400, lpEnvironment=0x124e2a80, lpCurrentDirectory=0x0, lpStartupInfo=0x12423acc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x130, hStdOutput=0x13c, hStdError=0x140), lpProcessInformation=0x12423aa8 | out: lpCommandLine="cmd.exe /c \"taskkill /f /im mysqld.exe \"", lpProcessInformation=0x12423aa8*(hProcess=0x150, hThread=0x144, dwProcessId=0x120c, dwThreadId=0x1274)) returned 1
	[0152.578] SetEvent (hEvent=0x168) returned 1
	[0152.578] CloseHandle (hObject=0x144) returned 1
	[0152.578] CloseHandle (hObject=0x140) returned 1
	[0152.578] CloseHandle (hObject=0x13c) returned 1
	[0152.578] CloseHandle (hObject=0x130) returned 1
	[0152.578] CloseHandle (hObject=0x154) returned 1
	[0152.579] CloseHandle (hObject=0x138) returned 1
	[0152.579] CloseHandle (hObject=0x134) returned 1
	[0152.579] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0
	[0155.583] SetEvent (hEvent=0x168) returned 1
	[0155.584] GetExitCodeProcess (in: hProcess=0x150, lpExitCode=0x12423bdc | out: lpExitCode=0x12423bdc*=0x80) returned 1
	[0155.584] GetProcessTimes (in: hProcess=0x150, lpCreationTime=0x124dc940, lpExitTime=0x124dc948, lpKernelTime=0x124dc950, lpUserTime=0x124dc958 | out: lpCreationTime=0x124dc940, lpExitTime=0x124dc948, lpKernelTime=0x124dc950, lpUserTime=0x124dc958) returned 1
	[0155.584] CloseHandle (hObject=0x150) returned 1
	[0155.585] SetEvent (hEvent=0x124) returned 1
	[0155.586] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x5) returned 0x102
	[0155.604] SetEvent (hEvent=0x168) returned 1
	[0155.604] SetEvent (hEvent=0x124) returned 1
	[0155.605] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1246b6c0, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0155.606] GetFileAttributesExW (in: lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124d2788 | out: lpFileInformation=0x124d2788*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.607] CreateFileW (lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0155.607] GetFileAttributesExW (in: lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), fInfoLevelId=0x0, lpFileInformation=0x124d27d8 | out: lpFileInformation=0x124d27d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.607] CreateFileW (lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0155.607] GetFileAttributesExW (in: lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), fInfoLevelId=0x0, lpFileInformation=0x124d2828 | out: lpFileInformation=0x124d2828*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.607] CreateFileW (lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0155.607] GetFileAttributesExW (in: lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), fInfoLevelId=0x0, lpFileInformation=0x124d2878 | out: lpFileInformation=0x124d2878*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.607] CreateFileW (lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0155.608] GetFileAttributesExW (in: lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x124d28c8 | out: lpFileInformation=0x124d28c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.608] CreateFileW (lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0155.608] GetFileAttributesExW (in: lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), fInfoLevelId=0x0, lpFileInformation=0x124d2918 | out: lpFileInformation=0x124d2918*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.608] CreateFileW (lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0155.608] GetFileAttributesExW (in: lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), fInfoLevelId=0x0, lpFileInformation=0x124d2968 | out: lpFileInformation=0x124d2968*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.608] CreateFileW (lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0155.608] GetFileAttributesExW (in: lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), fInfoLevelId=0x0, lpFileInformation=0x124d29b8 | out: lpFileInformation=0x124d29b8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.608] CreateFileW (lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0155.608] GetFileAttributesExW (in: lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), fInfoLevelId=0x0, lpFileInformation=0x124d2a08 | out: lpFileInformation=0x124d2a08*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.609] CreateFileW (lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0155.609] GetFileAttributesExW (in: lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), fInfoLevelId=0x0, lpFileInformation=0x124d2a58 | out: lpFileInformation=0x124d2a58*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.609] CreateFileW (lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0155.609] GetFileAttributesExW (in: lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), fInfoLevelId=0x0, lpFileInformation=0x124d2aa8 | out: lpFileInformation=0x124d2aa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.611] CreateFileW (lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0155.611] GetFileAttributesExW (in: lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), fInfoLevelId=0x0, lpFileInformation=0x124d2af8 | out: lpFileInformation=0x124d2af8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0155.612] CreateFileW (lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0155.612] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0x1246b790, nSize=0x64 | out: lpBuffer="") returned 0x63
	[0155.612] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124d2b48 | out: lpFileInformation=0x124d2b48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0155.612] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1246b860, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0155.613] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124d2b98 | out: lpFileInformation=0x124d2b98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0155.613] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x150
	[0155.613] GetConsoleMode (in: hConsoleHandle=0x150, lpMode=0x12423aa4 | out: lpMode=0x12423aa4) returned 0
	[0155.613] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134
	[0155.614] GetConsoleMode (in: hConsoleHandle=0x134, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0155.614] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0155.614] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0155.614] GetEnvironmentStringsW () returned 0x79e0b0*
	[0155.615] FreeEnvironmentStringsW (penv=0x79e0b0) returned 1
	[0155.616] GetCurrentProcess () returned 0xffffffff
	[0155.616] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x150, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124da970, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124da970*=0x154) returned 1
	[0155.617] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x134, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124da974, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124da974*=0x130) returned 1
	[0155.617] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x138, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124da978, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124da978*=0x13c) returned 1
	[0155.617] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c \"taskkill /f /im mysqld-nt.exe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x400, lpEnvironment=0x124ee000, lpCurrentDirectory=0x0, lpStartupInfo=0x12423acc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x154, hStdOutput=0x130, hStdError=0x13c), lpProcessInformation=0x12423aa8 | out: lpCommandLine="cmd.exe /c \"taskkill /f /im mysqld-nt.exe \"", lpProcessInformation=0x12423aa8*(hProcess=0x144, hThread=0x140, dwProcessId=0x13cc, dwThreadId=0xdb0)) returned 1
	[0155.714] SetEvent (hEvent=0x168) returned 1
	[0155.714] CloseHandle (hObject=0x140) returned 1
	[0155.714] CloseHandle (hObject=0x13c) returned 1
	[0155.714] CloseHandle (hObject=0x130) returned 1
	[0155.714] CloseHandle (hObject=0x154) returned 1
	[0155.715] CloseHandle (hObject=0x150) returned 1
	[0155.715] CloseHandle (hObject=0x134) returned 1
	[0155.715] CloseHandle (hObject=0x138) returned 1
	[0155.715] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0
	[0156.979] SetEvent (hEvent=0x168) returned 1
	[0156.980] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0x12423bdc | out: lpExitCode=0x12423bdc*=0x80) returned 1
	[0156.981] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0x124e60c0, lpExitTime=0x124e60c8, lpKernelTime=0x124e60d0, lpUserTime=0x124e60d8 | out: lpCreationTime=0x124e60c0, lpExitTime=0x124e60c8, lpKernelTime=0x124e60d0, lpUserTime=0x124e60d8) returned 1
	[0156.981] CloseHandle (hObject=0x144) returned 1
	[0156.981] SetEvent (hEvent=0x124) returned 1
	[0156.982] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x5) returned 0x102
	[0156.989] SetEvent (hEvent=0x124) returned 1
	[0156.989] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1243bd40, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0156.989] GetFileAttributesExW (in: lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124b34a8 | out: lpFileInformation=0x124b34a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0156.990] CreateFileW (lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0156.990] GetFileAttributesExW (in: lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), fInfoLevelId=0x0, lpFileInformation=0x124b34f8 | out: lpFileInformation=0x124b34f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0156.990] CreateFileW (lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0156.990] GetFileAttributesExW (in: lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), fInfoLevelId=0x0, lpFileInformation=0x124b3548 | out: lpFileInformation=0x124b3548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0156.990] CreateFileW (lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0156.990] GetFileAttributesExW (in: lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), fInfoLevelId=0x0, lpFileInformation=0x124b3598 | out: lpFileInformation=0x124b3598*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0156.990] CreateFileW (lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0156.991] GetFileAttributesExW (in: lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x124b35e8 | out: lpFileInformation=0x124b35e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0156.991] CreateFileW (lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0156.991] GetFileAttributesExW (in: lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), fInfoLevelId=0x0, lpFileInformation=0x124b3638 | out: lpFileInformation=0x124b3638*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0157.005] CreateFileW (lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0157.006] GetFileAttributesExW (in: lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), fInfoLevelId=0x0, lpFileInformation=0x124b3688 | out: lpFileInformation=0x124b3688*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0157.006] CreateFileW (lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0157.006] GetFileAttributesExW (in: lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), fInfoLevelId=0x0, lpFileInformation=0x124b36d8 | out: lpFileInformation=0x124b36d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0157.006] CreateFileW (lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0157.006] GetFileAttributesExW (in: lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), fInfoLevelId=0x0, lpFileInformation=0x124b3728 | out: lpFileInformation=0x124b3728*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0157.006] CreateFileW (lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0157.006] GetFileAttributesExW (in: lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), fInfoLevelId=0x0, lpFileInformation=0x124b3778 | out: lpFileInformation=0x124b3778*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0157.006] CreateFileW (lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0157.006] GetFileAttributesExW (in: lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), fInfoLevelId=0x0, lpFileInformation=0x124b37c8 | out: lpFileInformation=0x124b37c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0157.007] CreateFileW (lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0157.007] GetFileAttributesExW (in: lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), fInfoLevelId=0x0, lpFileInformation=0x124b3818 | out: lpFileInformation=0x124b3818*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0157.007] CreateFileW (lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0157.007] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0x1243be10, nSize=0x64 | out: lpBuffer="") returned 0x63
	[0157.007] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124b3868 | out: lpFileInformation=0x124b3868*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0157.007] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1243bee0, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0157.007] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124b38b8 | out: lpFileInformation=0x124b38b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0157.007] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x144
	[0157.007] GetConsoleMode (in: hConsoleHandle=0x144, lpMode=0x12423aa4 | out: lpMode=0x12423aa4) returned 0
	[0157.008] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0157.008] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0157.008] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134
	[0157.008] GetConsoleMode (in: hConsoleHandle=0x134, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0157.008] GetEnvironmentStringsW () returned 0x79e0b0*
	[0157.008] FreeEnvironmentStringsW (penv=0x79e0b0) returned 1
	[0157.009] GetCurrentProcess () returned 0xffffffff
	[0157.009] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x144, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124c33e0, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124c33e0*=0x150) returned 1
	[0157.009] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x138, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124c33e4, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124c33e4*=0x154) returned 1
	[0157.009] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x134, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124c33e8, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124c33e8*=0x130) returned 1
	[0157.009] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c \"taskkill /f /im mysqld-opt.exe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x400, lpEnvironment=0x124e3500, lpCurrentDirectory=0x0, lpStartupInfo=0x12423acc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x150, hStdOutput=0x154, hStdError=0x130), lpProcessInformation=0x12423aa8 | out: lpCommandLine="cmd.exe /c \"taskkill /f /im mysqld-opt.exe \"", lpProcessInformation=0x12423aa8*(hProcess=0x140, hThread=0x13c, dwProcessId=0x654, dwThreadId=0xcbc)) returned 1
	[0157.088] SetEvent (hEvent=0x168) returned 1
	[0157.088] CloseHandle (hObject=0x13c) returned 1
	[0157.088] CloseHandle (hObject=0x130) returned 1
	[0157.088] CloseHandle (hObject=0x154) returned 1
	[0157.088] CloseHandle (hObject=0x150) returned 1
	[0157.088] CloseHandle (hObject=0x144) returned 1
	[0157.088] CloseHandle (hObject=0x138) returned 1
	[0157.088] CloseHandle (hObject=0x134) returned 1
	[0157.088] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0xffffffff) returned 0x0
	[0158.488] SetEvent (hEvent=0x168) returned 1
	[0158.488] GetExitCodeProcess (in: hProcess=0x140, lpExitCode=0x12423bdc | out: lpExitCode=0x12423bdc*=0x80) returned 1
	[0158.488] GetProcessTimes (in: hProcess=0x140, lpCreationTime=0x124dcf60, lpExitTime=0x124dcf68, lpKernelTime=0x124dcf70, lpUserTime=0x124dcf78 | out: lpCreationTime=0x124dcf60, lpExitTime=0x124dcf68, lpKernelTime=0x124dcf70, lpUserTime=0x124dcf78) returned 1
	[0158.488] CloseHandle (hObject=0x140) returned 1
	[0158.489] SetEvent (hEvent=0x124) returned 1
	[0158.489] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x5) returned 0x102
	[0158.547] SetEvent (hEvent=0x168) returned 1
	[0158.547] SetEvent (hEvent=0x124) returned 1
	[0158.547] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1246b930, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0158.547] GetFileAttributesExW (in: lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124d2be8 | out: lpFileInformation=0x124d2be8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0158.547] CreateFileW (lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0158.547] GetFileAttributesExW (in: lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), fInfoLevelId=0x0, lpFileInformation=0x124d2c38 | out: lpFileInformation=0x124d2c38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0158.547] CreateFileW (lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0158.547] GetFileAttributesExW (in: lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), fInfoLevelId=0x0, lpFileInformation=0x124d2c88 | out: lpFileInformation=0x124d2c88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0158.548] CreateFileW (lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0158.548] GetFileAttributesExW (in: lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), fInfoLevelId=0x0, lpFileInformation=0x124d2cd8 | out: lpFileInformation=0x124d2cd8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0158.548] CreateFileW (lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0158.548] GetFileAttributesExW (in: lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x124d2d28 | out: lpFileInformation=0x124d2d28*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0158.548] CreateFileW (lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0158.548] GetFileAttributesExW (in: lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), fInfoLevelId=0x0, lpFileInformation=0x124d2d78 | out: lpFileInformation=0x124d2d78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0158.548] CreateFileW (lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0158.549] GetFileAttributesExW (in: lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), fInfoLevelId=0x0, lpFileInformation=0x124d2dc8 | out: lpFileInformation=0x124d2dc8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0158.549] CreateFileW (lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0158.549] GetFileAttributesExW (in: lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), fInfoLevelId=0x0, lpFileInformation=0x124d2e18 | out: lpFileInformation=0x124d2e18*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0158.549] CreateFileW (lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0158.549] GetFileAttributesExW (in: lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), fInfoLevelId=0x0, lpFileInformation=0x124d2e68 | out: lpFileInformation=0x124d2e68*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0158.549] CreateFileW (lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0158.549] GetFileAttributesExW (in: lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), fInfoLevelId=0x0, lpFileInformation=0x124d2eb8 | out: lpFileInformation=0x124d2eb8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0158.549] CreateFileW (lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0158.549] GetFileAttributesExW (in: lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), fInfoLevelId=0x0, lpFileInformation=0x124d2f08 | out: lpFileInformation=0x124d2f08*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0158.550] CreateFileW (lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0158.550] GetFileAttributesExW (in: lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), fInfoLevelId=0x0, lpFileInformation=0x124d2f58 | out: lpFileInformation=0x124d2f58*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0158.550] CreateFileW (lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0158.550] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0x1246ba00, nSize=0x64 | out: lpBuffer="") returned 0x63
	[0158.550] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124d2fa8 | out: lpFileInformation=0x124d2fa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0158.550] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1246bad0, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0158.550] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124d2ff8 | out: lpFileInformation=0x124d2ff8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0158.550] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x140
	[0158.551] GetConsoleMode (in: hConsoleHandle=0x140, lpMode=0x12423aa4 | out: lpMode=0x12423aa4) returned 0
	[0158.551] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134
	[0158.551] GetConsoleMode (in: hConsoleHandle=0x134, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0158.551] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0158.551] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0158.551] GetEnvironmentStringsW () returned 0x79e0b0*
	[0158.551] FreeEnvironmentStringsW (penv=0x79e0b0) returned 1
	[0158.551] GetCurrentProcess () returned 0xffffffff
	[0158.551] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x140, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124dad90, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124dad90*=0x144) returned 1
	[0158.551] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x134, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124dad94, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124dad94*=0x150) returned 1
	[0158.551] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x138, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124dad98, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124dad98*=0x154) returned 1
	[0158.552] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c \"taskkill /f /im dbeng50.exe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x400, lpEnvironment=0x124eea80, lpCurrentDirectory=0x0, lpStartupInfo=0x12423acc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x144, hStdOutput=0x150, hStdError=0x154), lpProcessInformation=0x12423aa8 | out: lpCommandLine="cmd.exe /c \"taskkill /f /im dbeng50.exe \"", lpProcessInformation=0x12423aa8*(hProcess=0x13c, hThread=0x130, dwProcessId=0x1240, dwThreadId=0x1374)) returned 1
	[0158.607] SetEvent (hEvent=0x168) returned 1
	[0158.607] CloseHandle (hObject=0x130) returned 1
	[0158.607] CloseHandle (hObject=0x154) returned 1
	[0158.607] CloseHandle (hObject=0x150) returned 1
	[0158.607] CloseHandle (hObject=0x144) returned 1
	[0158.607] CloseHandle (hObject=0x140) returned 1
	[0158.607] CloseHandle (hObject=0x134) returned 1
	[0158.607] CloseHandle (hObject=0x138) returned 1
	[0158.607] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0xffffffff) returned 0x0
	[0163.178] SetEvent (hEvent=0x168) returned 1
	[0163.178] GetExitCodeProcess (in: hProcess=0x13c, lpExitCode=0x12423bdc | out: lpExitCode=0x12423bdc*=0x80) returned 1
	[0163.179] GetProcessTimes (in: hProcess=0x13c, lpCreationTime=0x124e6720, lpExitTime=0x124e6728, lpKernelTime=0x124e6730, lpUserTime=0x124e6738 | out: lpCreationTime=0x124e6720, lpExitTime=0x124e6728, lpKernelTime=0x124e6730, lpUserTime=0x124e6738) returned 1
	[0163.179] CloseHandle (hObject=0x13c) returned 1
	[0163.179] SetEvent (hEvent=0x124) returned 1
	[0163.179] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x5) returned 0x102
	[0163.262] SetEvent (hEvent=0x168) returned 1
	[0163.262] SetEvent (hEvent=0x124) returned 1
	[0163.262] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x124f6000, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0163.262] GetFileAttributesExW (in: lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124b3908 | out: lpFileInformation=0x124b3908*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0163.262] CreateFileW (lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0163.262] GetFileAttributesExW (in: lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), fInfoLevelId=0x0, lpFileInformation=0x124b3958 | out: lpFileInformation=0x124b3958*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0163.262] CreateFileW (lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0163.263] GetFileAttributesExW (in: lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), fInfoLevelId=0x0, lpFileInformation=0x124b39a8 | out: lpFileInformation=0x124b39a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0163.263] CreateFileW (lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0163.263] GetFileAttributesExW (in: lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), fInfoLevelId=0x0, lpFileInformation=0x124b39f8 | out: lpFileInformation=0x124b39f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0163.263] CreateFileW (lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0163.263] GetFileAttributesExW (in: lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x124b3a48 | out: lpFileInformation=0x124b3a48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0163.263] CreateFileW (lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0163.263] GetFileAttributesExW (in: lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), fInfoLevelId=0x0, lpFileInformation=0x124b3a98 | out: lpFileInformation=0x124b3a98*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0163.263] CreateFileW (lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0163.264] GetFileAttributesExW (in: lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), fInfoLevelId=0x0, lpFileInformation=0x124b3ae8 | out: lpFileInformation=0x124b3ae8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0163.264] CreateFileW (lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0163.264] GetFileAttributesExW (in: lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), fInfoLevelId=0x0, lpFileInformation=0x124b3b38 | out: lpFileInformation=0x124b3b38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0163.264] CreateFileW (lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0163.265] GetFileAttributesExW (in: lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), fInfoLevelId=0x0, lpFileInformation=0x124b3b88 | out: lpFileInformation=0x124b3b88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0163.265] CreateFileW (lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0163.265] GetFileAttributesExW (in: lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), fInfoLevelId=0x0, lpFileInformation=0x124b3bd8 | out: lpFileInformation=0x124b3bd8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0163.265] CreateFileW (lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0163.265] GetFileAttributesExW (in: lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), fInfoLevelId=0x0, lpFileInformation=0x124b3c28 | out: lpFileInformation=0x124b3c28*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0163.265] CreateFileW (lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0163.266] GetFileAttributesExW (in: lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), fInfoLevelId=0x0, lpFileInformation=0x124b3c78 | out: lpFileInformation=0x124b3c78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0163.266] CreateFileW (lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0163.266] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0x124f60d0, nSize=0x64 | out: lpBuffer="") returned 0x63
	[0163.266] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124b3cc8 | out: lpFileInformation=0x124b3cc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0163.266] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x124f61a0, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0163.266] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124b3d18 | out: lpFileInformation=0x124b3d18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0163.266] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c
	[0163.266] GetConsoleMode (in: hConsoleHandle=0x13c, lpMode=0x12423aa4 | out: lpMode=0x12423aa4) returned 0
	[0163.267] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0163.267] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0163.267] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134
	[0163.267] GetConsoleMode (in: hConsoleHandle=0x134, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0163.267] GetEnvironmentStringsW () returned 0x79e0b0*
	[0163.267] FreeEnvironmentStringsW (penv=0x79e0b0) returned 1
	[0163.267] GetCurrentProcess () returned 0xffffffff
	[0163.268] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x13c, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124c3800, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124c3800*=0x140) returned 1
	[0163.268] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x138, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124c3804, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124c3804*=0x144) returned 1
	[0163.268] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x134, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124c3808, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124c3808*=0x150) returned 1
	[0163.269] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c \"taskkill /f /im sqbcoreservice.exe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x400, lpEnvironment=0x12500000, lpCurrentDirectory=0x0, lpStartupInfo=0x12423acc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x140, hStdOutput=0x144, hStdError=0x150), lpProcessInformation=0x12423aa8 | out: lpCommandLine="cmd.exe /c \"taskkill /f /im sqbcoreservice.exe \"", lpProcessInformation=0x12423aa8*(hProcess=0x130, hThread=0x154, dwProcessId=0xc68, dwThreadId=0x520)) returned 1
	[0163.427] SetEvent (hEvent=0x168) returned 1
	[0163.427] CloseHandle (hObject=0x154) returned 1
	[0163.427] CloseHandle (hObject=0x150) returned 1
	[0163.427] CloseHandle (hObject=0x144) returned 1
	[0163.427] CloseHandle (hObject=0x140) returned 1
	[0163.427] CloseHandle (hObject=0x13c) returned 1
	[0163.427] CloseHandle (hObject=0x138) returned 1
	[0163.427] CloseHandle (hObject=0x134) returned 1
	[0163.427] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0xffffffff) returned 0x0
	[0165.662] SetEvent (hEvent=0x168) returned 1
	[0165.662] GetExitCodeProcess (in: hProcess=0x130, lpExitCode=0x12423bdc | out: lpExitCode=0x12423bdc*=0x80) returned 1
	[0165.662] GetProcessTimes (in: hProcess=0x130, lpCreationTime=0x124dd580, lpExitTime=0x124dd588, lpKernelTime=0x124dd590, lpUserTime=0x124dd598 | out: lpCreationTime=0x124dd580, lpExitTime=0x124dd588, lpKernelTime=0x124dd590, lpUserTime=0x124dd598) returned 1
	[0165.662] CloseHandle (hObject=0x130) returned 1
	[0165.663] SetEvent (hEvent=0x124) returned 1
	[0165.663] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x5) returned 0x102
	[0165.670] SetEvent (hEvent=0x168) returned 1
	[0165.670] SetEvent (hEvent=0x124) returned 1
	[0165.670] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1246bba0, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0165.670] GetFileAttributesExW (in: lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124d3048 | out: lpFileInformation=0x124d3048*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0165.671] CreateFileW (lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0165.671] GetFileAttributesExW (in: lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), fInfoLevelId=0x0, lpFileInformation=0x124d3098 | out: lpFileInformation=0x124d3098*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0165.671] CreateFileW (lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0165.671] GetFileAttributesExW (in: lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), fInfoLevelId=0x0, lpFileInformation=0x124d30e8 | out: lpFileInformation=0x124d30e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0165.671] CreateFileW (lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0165.672] GetFileAttributesExW (in: lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), fInfoLevelId=0x0, lpFileInformation=0x124d3138 | out: lpFileInformation=0x124d3138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0165.672] CreateFileW (lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0165.672] GetFileAttributesExW (in: lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x124d3188 | out: lpFileInformation=0x124d3188*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0165.672] CreateFileW (lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0165.672] GetFileAttributesExW (in: lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), fInfoLevelId=0x0, lpFileInformation=0x124d31d8 | out: lpFileInformation=0x124d31d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0165.672] CreateFileW (lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0165.672] GetFileAttributesExW (in: lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), fInfoLevelId=0x0, lpFileInformation=0x124d3228 | out: lpFileInformation=0x124d3228*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0165.672] CreateFileW (lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0165.672] GetFileAttributesExW (in: lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), fInfoLevelId=0x0, lpFileInformation=0x124d3278 | out: lpFileInformation=0x124d3278*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0165.673] CreateFileW (lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0165.673] GetFileAttributesExW (in: lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), fInfoLevelId=0x0, lpFileInformation=0x124d32c8 | out: lpFileInformation=0x124d32c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0165.673] CreateFileW (lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0165.720] GetFileAttributesExW (in: lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), fInfoLevelId=0x0, lpFileInformation=0x124d3318 | out: lpFileInformation=0x124d3318*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0165.720] CreateFileW (lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0165.720] GetFileAttributesExW (in: lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), fInfoLevelId=0x0, lpFileInformation=0x124d3368 | out: lpFileInformation=0x124d3368*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0165.720] CreateFileW (lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0165.721] GetFileAttributesExW (in: lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), fInfoLevelId=0x0, lpFileInformation=0x124d33b8 | out: lpFileInformation=0x124d33b8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0165.721] CreateFileW (lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0165.721] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0x1246bc70, nSize=0x64 | out: lpBuffer="") returned 0x63
	[0165.721] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124d3408 | out: lpFileInformation=0x124d3408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0165.721] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1246bd40, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0165.721] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124d3458 | out: lpFileInformation=0x124d3458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0165.722] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130
	[0165.722] GetConsoleMode (in: hConsoleHandle=0x130, lpMode=0x12423aa4 | out: lpMode=0x12423aa4) returned 0
	[0165.722] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134
	[0165.722] GetConsoleMode (in: hConsoleHandle=0x134, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0165.722] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0165.722] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0165.722] GetEnvironmentStringsW () returned 0x79e0b0*
	[0165.723] FreeEnvironmentStringsW (penv=0x79e0b0) returned 1
	[0165.723] GetCurrentProcess () returned 0xffffffff
	[0165.723] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x130, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124db1b0, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124db1b0*=0x13c) returned 1
	[0165.723] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x134, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124db1b4, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124db1b4*=0x140) returned 1
	[0165.723] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x138, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124db1b8, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124db1b8*=0x144) returned 1
	[0165.723] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c \"taskkill /f /im excel.exe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x400, lpEnvironment=0x124ef500, lpCurrentDirectory=0x0, lpStartupInfo=0x12423acc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x13c, hStdOutput=0x140, hStdError=0x144), lpProcessInformation=0x12423aa8 | out: lpCommandLine="cmd.exe /c \"taskkill /f /im excel.exe \"", lpProcessInformation=0x12423aa8*(hProcess=0x154, hThread=0x150, dwProcessId=0xb0c, dwThreadId=0x884)) returned 1
	[0165.817] SetEvent (hEvent=0x168) returned 1
	[0165.817] CloseHandle (hObject=0x150) returned 1
	[0165.817] CloseHandle (hObject=0x144) returned 1
	[0165.817] CloseHandle (hObject=0x140) returned 1
	[0165.817] CloseHandle (hObject=0x13c) returned 1
	[0165.817] CloseHandle (hObject=0x130) returned 1
	[0165.817] CloseHandle (hObject=0x134) returned 1
	[0165.817] CloseHandle (hObject=0x138) returned 1
	[0165.817] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0xffffffff) returned 0x0
	[0172.813] SetEvent (hEvent=0x168) returned 1
	[0172.813] GetExitCodeProcess (in: hProcess=0x154, lpExitCode=0x12423bdc | out: lpExitCode=0x12423bdc*=0x80) returned 1
	[0172.813] GetProcessTimes (in: hProcess=0x154, lpCreationTime=0x124e6d80, lpExitTime=0x124e6d88, lpKernelTime=0x124e6d90, lpUserTime=0x124e6d98 | out: lpCreationTime=0x124e6d80, lpExitTime=0x124e6d88, lpKernelTime=0x124e6d90, lpUserTime=0x124e6d98) returned 1
	[0172.814] CloseHandle (hObject=0x154) returned 1
	[0172.814] SetEvent (hEvent=0x124) returned 1
	[0172.814] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x5) returned 0x102
	[0172.859] SetEvent (hEvent=0x168) returned 1
	[0172.859] SetEvent (hEvent=0x124) returned 1
	[0172.860] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x124f6340, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0172.861] GetFileAttributesExW (in: lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124b3d68 | out: lpFileInformation=0x124b3d68*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0172.861] CreateFileW (lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0172.861] GetFileAttributesExW (in: lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), fInfoLevelId=0x0, lpFileInformation=0x124b3db8 | out: lpFileInformation=0x124b3db8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0172.862] CreateFileW (lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0172.862] GetFileAttributesExW (in: lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), fInfoLevelId=0x0, lpFileInformation=0x124b3e08 | out: lpFileInformation=0x124b3e08*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0172.862] CreateFileW (lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0172.862] GetFileAttributesExW (in: lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), fInfoLevelId=0x0, lpFileInformation=0x124b3e58 | out: lpFileInformation=0x124b3e58*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0172.862] CreateFileW (lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0172.862] GetFileAttributesExW (in: lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x124b3ea8 | out: lpFileInformation=0x124b3ea8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0172.862] CreateFileW (lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0172.862] GetFileAttributesExW (in: lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), fInfoLevelId=0x0, lpFileInformation=0x124b3ef8 | out: lpFileInformation=0x124b3ef8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0172.863] CreateFileW (lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0172.863] GetFileAttributesExW (in: lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), fInfoLevelId=0x0, lpFileInformation=0x124b3f48 | out: lpFileInformation=0x124b3f48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0172.863] CreateFileW (lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0172.863] GetFileAttributesExW (in: lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), fInfoLevelId=0x0, lpFileInformation=0x124b3f98 | out: lpFileInformation=0x124b3f98*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0172.863] CreateFileW (lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0172.863] GetFileAttributesExW (in: lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), fInfoLevelId=0x0, lpFileInformation=0x12508008 | out: lpFileInformation=0x12508008*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0172.863] CreateFileW (lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0172.864] GetFileAttributesExW (in: lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), fInfoLevelId=0x0, lpFileInformation=0x12508058 | out: lpFileInformation=0x12508058*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0172.864] CreateFileW (lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0172.864] GetFileAttributesExW (in: lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), fInfoLevelId=0x0, lpFileInformation=0x125080a8 | out: lpFileInformation=0x125080a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0172.864] CreateFileW (lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0172.864] GetFileAttributesExW (in: lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), fInfoLevelId=0x0, lpFileInformation=0x125080f8 | out: lpFileInformation=0x125080f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0172.864] CreateFileW (lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0172.864] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0x124f6410, nSize=0x64 | out: lpBuffer="") returned 0x63
	[0172.865] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12508148 | out: lpFileInformation=0x12508148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0172.865] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x124f64e0, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0172.865] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12508198 | out: lpFileInformation=0x12508198*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0172.866] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154
	[0172.866] GetConsoleMode (in: hConsoleHandle=0x154, lpMode=0x12423aa4 | out: lpMode=0x12423aa4) returned 0
	[0172.866] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0172.866] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0172.866] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134
	[0172.866] GetConsoleMode (in: hConsoleHandle=0x134, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0172.866] GetEnvironmentStringsW () returned 0x79e0b0*
	[0172.867] FreeEnvironmentStringsW (penv=0x79e0b0) returned 1
	[0172.868] GetCurrentProcess () returned 0xffffffff
	[0172.868] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x154, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124c3c20, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124c3c20*=0x130) returned 1
	[0172.868] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x138, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124c3c24, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124c3c24*=0x13c) returned 1
	[0172.868] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x134, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124c3c28, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124c3c28*=0x140) returned 1
	[0172.868] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c \"taskkill /f /im infopath.exe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x400, lpEnvironment=0x12500a80, lpCurrentDirectory=0x0, lpStartupInfo=0x12423acc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x130, hStdOutput=0x13c, hStdError=0x140), lpProcessInformation=0x12423aa8 | out: lpCommandLine="cmd.exe /c \"taskkill /f /im infopath.exe \"", lpProcessInformation=0x12423aa8*(hProcess=0x150, hThread=0x144, dwProcessId=0x81c, dwThreadId=0xd2c)) returned 1
	[0172.936] SetEvent (hEvent=0x168) returned 1
	[0172.936] CloseHandle (hObject=0x144) returned 1
	[0172.936] CloseHandle (hObject=0x140) returned 1
	[0172.936] CloseHandle (hObject=0x13c) returned 1
	[0172.936] CloseHandle (hObject=0x130) returned 1
	[0172.937] CloseHandle (hObject=0x154) returned 1
	[0172.937] CloseHandle (hObject=0x138) returned 1
	[0172.937] CloseHandle (hObject=0x134) returned 1
	[0172.937] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0
	[0174.938] SetEvent (hEvent=0x168) returned 1
	[0174.938] GetExitCodeProcess (in: hProcess=0x150, lpExitCode=0x12423bdc | out: lpExitCode=0x12423bdc*=0x80) returned 1
	[0174.938] GetProcessTimes (in: hProcess=0x150, lpCreationTime=0x124ddbe0, lpExitTime=0x124ddbe8, lpKernelTime=0x124ddbf0, lpUserTime=0x124ddbf8 | out: lpCreationTime=0x124ddbe0, lpExitTime=0x124ddbe8, lpKernelTime=0x124ddbf0, lpUserTime=0x124ddbf8) returned 1
	[0174.938] CloseHandle (hObject=0x150) returned 1
	[0174.938] SetEvent (hEvent=0x124) returned 1
	[0174.939] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x4) returned 0x102
	[0174.950] SetEvent (hEvent=0x168) returned 1
	[0174.950] SetEvent (hEvent=0x124) returned 1
	[0174.950] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1246be10, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0174.951] GetFileAttributesExW (in: lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124d34a8 | out: lpFileInformation=0x124d34a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0174.951] CreateFileW (lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0174.951] GetFileAttributesExW (in: lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), fInfoLevelId=0x0, lpFileInformation=0x124d34f8 | out: lpFileInformation=0x124d34f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0174.951] CreateFileW (lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0174.951] GetFileAttributesExW (in: lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), fInfoLevelId=0x0, lpFileInformation=0x124d3548 | out: lpFileInformation=0x124d3548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0174.951] CreateFileW (lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0174.951] GetFileAttributesExW (in: lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), fInfoLevelId=0x0, lpFileInformation=0x124d3598 | out: lpFileInformation=0x124d3598*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0174.951] CreateFileW (lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0174.952] GetFileAttributesExW (in: lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x124d35e8 | out: lpFileInformation=0x124d35e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0174.952] CreateFileW (lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0174.952] GetFileAttributesExW (in: lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), fInfoLevelId=0x0, lpFileInformation=0x124d3638 | out: lpFileInformation=0x124d3638*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0174.952] CreateFileW (lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0174.952] GetFileAttributesExW (in: lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), fInfoLevelId=0x0, lpFileInformation=0x124d3688 | out: lpFileInformation=0x124d3688*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0174.952] CreateFileW (lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0174.952] GetFileAttributesExW (in: lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), fInfoLevelId=0x0, lpFileInformation=0x124d36d8 | out: lpFileInformation=0x124d36d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0174.952] CreateFileW (lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0174.952] GetFileAttributesExW (in: lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), fInfoLevelId=0x0, lpFileInformation=0x124d3728 | out: lpFileInformation=0x124d3728*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0174.953] CreateFileW (lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0174.953] GetFileAttributesExW (in: lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), fInfoLevelId=0x0, lpFileInformation=0x124d3778 | out: lpFileInformation=0x124d3778*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0174.953] CreateFileW (lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0174.953] GetFileAttributesExW (in: lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), fInfoLevelId=0x0, lpFileInformation=0x124d37c8 | out: lpFileInformation=0x124d37c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0174.953] CreateFileW (lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0174.953] GetFileAttributesExW (in: lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), fInfoLevelId=0x0, lpFileInformation=0x124d3818 | out: lpFileInformation=0x124d3818*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0174.953] CreateFileW (lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0174.953] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0x1246bee0, nSize=0x64 | out: lpBuffer="") returned 0x63
	[0174.954] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124d3868 | out: lpFileInformation=0x124d3868*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0174.954] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1250c000, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0174.954] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124d38b8 | out: lpFileInformation=0x124d38b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0174.954] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x150
	[0174.954] GetConsoleMode (in: hConsoleHandle=0x150, lpMode=0x12423aa4 | out: lpMode=0x12423aa4) returned 0
	[0174.954] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134
	[0174.954] GetConsoleMode (in: hConsoleHandle=0x134, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0174.954] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0174.954] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0174.954] GetEnvironmentStringsW () returned 0x79e0b0*
	[0174.955] FreeEnvironmentStringsW (penv=0x79e0b0) returned 1
	[0174.955] GetCurrentProcess () returned 0xffffffff
	[0174.955] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x150, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124db5d0, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124db5d0*=0x154) returned 1
	[0174.955] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x134, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124db5d4, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124db5d4*=0x130) returned 1
	[0174.955] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x138, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124db5d8, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124db5d8*=0x13c) returned 1
	[0174.956] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c \"taskkill /f /im msaccess.exe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x400, lpEnvironment=0x12512000, lpCurrentDirectory=0x0, lpStartupInfo=0x12423acc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x154, hStdOutput=0x130, hStdError=0x13c), lpProcessInformation=0x12423aa8 | out: lpCommandLine="cmd.exe /c \"taskkill /f /im msaccess.exe \"", lpProcessInformation=0x12423aa8*(hProcess=0x144, hThread=0x140, dwProcessId=0xc54, dwThreadId=0xb98)) returned 1
	[0174.994] CloseHandle (hObject=0x140) returned 1
	[0174.994] CloseHandle (hObject=0x13c) returned 1
	[0174.994] CloseHandle (hObject=0x130) returned 1
	[0174.994] CloseHandle (hObject=0x154) returned 1
	[0174.994] CloseHandle (hObject=0x150) returned 1
	[0174.994] CloseHandle (hObject=0x134) returned 1
	[0174.994] CloseHandle (hObject=0x138) returned 1
	[0174.994] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0
	[0176.550] SetEvent (hEvent=0x168) returned 1
	[0176.550] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0x12423bdc | out: lpExitCode=0x12423bdc*=0x80) returned 1
	[0176.550] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0x124e73e0, lpExitTime=0x124e73e8, lpKernelTime=0x124e73f0, lpUserTime=0x124e73f8 | out: lpCreationTime=0x124e73e0, lpExitTime=0x124e73e8, lpKernelTime=0x124e73f0, lpUserTime=0x124e73f8) returned 1
	[0176.550] CloseHandle (hObject=0x144) returned 1
	[0176.550] SetEvent (hEvent=0x124) returned 1
	[0176.550] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x4) returned 0x102
	[0176.555] SetEvent (hEvent=0x124) returned 1
	[0176.556] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x124f65b0, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0176.556] GetFileAttributesExW (in: lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x125081e8 | out: lpFileInformation=0x125081e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.556] CreateFileW (lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0176.556] GetFileAttributesExW (in: lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), fInfoLevelId=0x0, lpFileInformation=0x12508238 | out: lpFileInformation=0x12508238*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.556] CreateFileW (lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0176.556] GetFileAttributesExW (in: lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), fInfoLevelId=0x0, lpFileInformation=0x12508288 | out: lpFileInformation=0x12508288*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.556] CreateFileW (lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0176.556] GetFileAttributesExW (in: lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), fInfoLevelId=0x0, lpFileInformation=0x125082d8 | out: lpFileInformation=0x125082d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.556] CreateFileW (lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0176.556] GetFileAttributesExW (in: lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x12508328 | out: lpFileInformation=0x12508328*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.557] CreateFileW (lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0176.557] GetFileAttributesExW (in: lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), fInfoLevelId=0x0, lpFileInformation=0x12508378 | out: lpFileInformation=0x12508378*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.557] CreateFileW (lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0176.557] GetFileAttributesExW (in: lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), fInfoLevelId=0x0, lpFileInformation=0x125083c8 | out: lpFileInformation=0x125083c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.557] CreateFileW (lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0176.557] GetFileAttributesExW (in: lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), fInfoLevelId=0x0, lpFileInformation=0x12508418 | out: lpFileInformation=0x12508418*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.557] CreateFileW (lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0176.557] GetFileAttributesExW (in: lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), fInfoLevelId=0x0, lpFileInformation=0x12508468 | out: lpFileInformation=0x12508468*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.557] CreateFileW (lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0176.558] GetFileAttributesExW (in: lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), fInfoLevelId=0x0, lpFileInformation=0x125084b8 | out: lpFileInformation=0x125084b8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.558] CreateFileW (lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0176.558] GetFileAttributesExW (in: lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), fInfoLevelId=0x0, lpFileInformation=0x12508508 | out: lpFileInformation=0x12508508*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.558] CreateFileW (lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0176.558] GetFileAttributesExW (in: lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), fInfoLevelId=0x0, lpFileInformation=0x12508558 | out: lpFileInformation=0x12508558*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0176.558] CreateFileW (lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0176.558] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0x124f6680, nSize=0x64 | out: lpBuffer="") returned 0x63
	[0176.558] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x125085a8 | out: lpFileInformation=0x125085a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0176.558] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x124f6750, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0176.558] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x125085f8 | out: lpFileInformation=0x125085f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0176.558] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x144
	[0176.559] GetConsoleMode (in: hConsoleHandle=0x144, lpMode=0x12423aa4 | out: lpMode=0x12423aa4) returned 0
	[0176.559] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0176.559] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0176.559] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134
	[0176.559] GetConsoleMode (in: hConsoleHandle=0x134, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0176.559] GetEnvironmentStringsW () returned 0x79e0b0*
	[0176.559] FreeEnvironmentStringsW (penv=0x79e0b0) returned 1
	[0176.560] GetCurrentProcess () returned 0xffffffff
	[0176.560] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x144, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x1251c040, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x1251c040*=0x150) returned 1
	[0176.560] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x138, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x1251c044, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x1251c044*=0x154) returned 1
	[0176.560] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x134, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x1251c048, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x1251c048*=0x130) returned 1
	[0176.560] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c \"taskkill /f /im mspub.exe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x400, lpEnvironment=0x12501500, lpCurrentDirectory=0x0, lpStartupInfo=0x12423acc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x150, hStdOutput=0x154, hStdError=0x130), lpProcessInformation=0x12423aa8 | out: lpCommandLine="cmd.exe /c \"taskkill /f /im mspub.exe \"", lpProcessInformation=0x12423aa8*(hProcess=0x140, hThread=0x13c, dwProcessId=0x92c, dwThreadId=0x10f4)) returned 1
	[0176.610] CloseHandle (hObject=0x13c) returned 1
	[0176.610] CloseHandle (hObject=0x130) returned 1
	[0176.610] CloseHandle (hObject=0x154) returned 1
	[0176.610] CloseHandle (hObject=0x150) returned 1
	[0176.610] CloseHandle (hObject=0x144) returned 1
	[0176.610] CloseHandle (hObject=0x138) returned 1
	[0176.610] CloseHandle (hObject=0x134) returned 1
	[0176.610] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0xffffffff) returned 0x0
	[0178.025] SetEvent (hEvent=0x168) returned 1
	[0178.025] GetExitCodeProcess (in: hProcess=0x140, lpExitCode=0x12423bdc | out: lpExitCode=0x12423bdc*=0x80) returned 1
	[0178.026] GetProcessTimes (in: hProcess=0x140, lpCreationTime=0x1251a240, lpExitTime=0x1251a248, lpKernelTime=0x1251a250, lpUserTime=0x1251a258 | out: lpCreationTime=0x1251a240, lpExitTime=0x1251a248, lpKernelTime=0x1251a250, lpUserTime=0x1251a258) returned 1
	[0178.026] CloseHandle (hObject=0x140) returned 1
	[0178.026] SetEvent (hEvent=0x124) returned 1
	[0178.026] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x4) returned 0x102
	[0178.038] SetEvent (hEvent=0x168) returned 1
	[0178.038] SetEvent (hEvent=0x124) returned 1
	[0178.038] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1250c0d0, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0178.038] GetFileAttributesExW (in: lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124d3908 | out: lpFileInformation=0x124d3908*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0178.038] CreateFileW (lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0178.038] GetFileAttributesExW (in: lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), fInfoLevelId=0x0, lpFileInformation=0x124d3958 | out: lpFileInformation=0x124d3958*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0178.038] CreateFileW (lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0178.039] GetFileAttributesExW (in: lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), fInfoLevelId=0x0, lpFileInformation=0x124d39a8 | out: lpFileInformation=0x124d39a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0178.039] CreateFileW (lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0178.039] GetFileAttributesExW (in: lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), fInfoLevelId=0x0, lpFileInformation=0x124d39f8 | out: lpFileInformation=0x124d39f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0178.039] CreateFileW (lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0178.039] GetFileAttributesExW (in: lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x124d3a48 | out: lpFileInformation=0x124d3a48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0178.039] CreateFileW (lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0178.039] GetFileAttributesExW (in: lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), fInfoLevelId=0x0, lpFileInformation=0x124d3a98 | out: lpFileInformation=0x124d3a98*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0178.039] CreateFileW (lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0178.040] GetFileAttributesExW (in: lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), fInfoLevelId=0x0, lpFileInformation=0x124d3ae8 | out: lpFileInformation=0x124d3ae8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0178.040] CreateFileW (lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0178.040] GetFileAttributesExW (in: lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), fInfoLevelId=0x0, lpFileInformation=0x124d3b38 | out: lpFileInformation=0x124d3b38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0178.040] CreateFileW (lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0178.040] GetFileAttributesExW (in: lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), fInfoLevelId=0x0, lpFileInformation=0x124d3b88 | out: lpFileInformation=0x124d3b88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0178.040] CreateFileW (lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0178.040] GetFileAttributesExW (in: lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), fInfoLevelId=0x0, lpFileInformation=0x124d3bd8 | out: lpFileInformation=0x124d3bd8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0178.040] CreateFileW (lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0178.040] GetFileAttributesExW (in: lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), fInfoLevelId=0x0, lpFileInformation=0x124d3c28 | out: lpFileInformation=0x124d3c28*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0178.041] CreateFileW (lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0178.041] GetFileAttributesExW (in: lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), fInfoLevelId=0x0, lpFileInformation=0x124d3c78 | out: lpFileInformation=0x124d3c78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0178.041] CreateFileW (lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0178.041] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0x1250c1a0, nSize=0x64 | out: lpBuffer="") returned 0x63
	[0178.041] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124d3cc8 | out: lpFileInformation=0x124d3cc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0178.041] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1250c270, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0178.041] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124d3d18 | out: lpFileInformation=0x124d3d18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0178.042] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x140
	[0178.042] GetConsoleMode (in: hConsoleHandle=0x140, lpMode=0x12423aa4 | out: lpMode=0x12423aa4) returned 0
	[0178.042] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134
	[0178.042] GetConsoleMode (in: hConsoleHandle=0x134, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0178.042] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0178.042] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0178.042] GetEnvironmentStringsW () returned 0x79e0b0*
	[0178.042] FreeEnvironmentStringsW (penv=0x79e0b0) returned 1
	[0178.043] GetCurrentProcess () returned 0xffffffff
	[0178.043] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x140, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124db9f0, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124db9f0*=0x144) returned 1
	[0178.043] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x134, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124db9f4, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124db9f4*=0x150) returned 1
	[0178.043] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x138, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124db9f8, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124db9f8*=0x154) returned 1
	[0178.043] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c \"taskkill /f /im onenote.exe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x400, lpEnvironment=0x12512a80, lpCurrentDirectory=0x0, lpStartupInfo=0x12423acc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x144, hStdOutput=0x150, hStdError=0x154), lpProcessInformation=0x12423aa8 | out: lpCommandLine="cmd.exe /c \"taskkill /f /im onenote.exe \"", lpProcessInformation=0x12423aa8*(hProcess=0x13c, hThread=0x130, dwProcessId=0x101c, dwThreadId=0x908)) returned 1
	[0178.080] CloseHandle (hObject=0x130) returned 1
	[0178.080] CloseHandle (hObject=0x154) returned 1
	[0178.080] CloseHandle (hObject=0x150) returned 1
	[0178.080] CloseHandle (hObject=0x144) returned 1
	[0178.080] CloseHandle (hObject=0x140) returned 1
	[0178.080] CloseHandle (hObject=0x134) returned 1
	[0178.081] CloseHandle (hObject=0x138) returned 1
	[0178.081] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0xffffffff) returned 0x0
	[0179.256] SetEvent (hEvent=0x168) returned 1
	[0179.256] GetExitCodeProcess (in: hProcess=0x13c, lpExitCode=0x12423bdc | out: lpExitCode=0x12423bdc*=0x80) returned 1
	[0179.257] GetProcessTimes (in: hProcess=0x13c, lpCreationTime=0x124e7a40, lpExitTime=0x124e7a48, lpKernelTime=0x124e7a50, lpUserTime=0x124e7a58 | out: lpCreationTime=0x124e7a40, lpExitTime=0x124e7a48, lpKernelTime=0x124e7a50, lpUserTime=0x124e7a58) returned 1
	[0179.257] CloseHandle (hObject=0x13c) returned 1
	[0179.257] SetEvent (hEvent=0x124) returned 1
	[0179.257] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x5) returned 0x102
	[0179.263] SetEvent (hEvent=0x168) returned 1
	[0179.263] SetEvent (hEvent=0x124) returned 1
	[0179.263] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x124f6820, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0179.263] GetFileAttributesExW (in: lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12508648 | out: lpFileInformation=0x12508648*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0179.263] CreateFileW (lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0179.264] GetFileAttributesExW (in: lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), fInfoLevelId=0x0, lpFileInformation=0x12508698 | out: lpFileInformation=0x12508698*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0179.268] CreateFileW (lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0179.268] GetFileAttributesExW (in: lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), fInfoLevelId=0x0, lpFileInformation=0x125086e8 | out: lpFileInformation=0x125086e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0179.268] CreateFileW (lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0179.268] GetFileAttributesExW (in: lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), fInfoLevelId=0x0, lpFileInformation=0x12508738 | out: lpFileInformation=0x12508738*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0179.268] CreateFileW (lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0179.268] GetFileAttributesExW (in: lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x12508788 | out: lpFileInformation=0x12508788*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0179.268] CreateFileW (lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0179.268] GetFileAttributesExW (in: lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), fInfoLevelId=0x0, lpFileInformation=0x125087d8 | out: lpFileInformation=0x125087d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0179.268] CreateFileW (lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0179.269] GetFileAttributesExW (in: lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), fInfoLevelId=0x0, lpFileInformation=0x12508828 | out: lpFileInformation=0x12508828*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0179.269] CreateFileW (lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0179.269] GetFileAttributesExW (in: lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), fInfoLevelId=0x0, lpFileInformation=0x12508878 | out: lpFileInformation=0x12508878*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0179.269] CreateFileW (lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0179.269] GetFileAttributesExW (in: lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), fInfoLevelId=0x0, lpFileInformation=0x125088c8 | out: lpFileInformation=0x125088c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0179.269] CreateFileW (lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0179.269] GetFileAttributesExW (in: lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), fInfoLevelId=0x0, lpFileInformation=0x12508918 | out: lpFileInformation=0x12508918*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0179.269] CreateFileW (lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0179.269] GetFileAttributesExW (in: lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), fInfoLevelId=0x0, lpFileInformation=0x12508968 | out: lpFileInformation=0x12508968*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0179.269] CreateFileW (lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0179.269] GetFileAttributesExW (in: lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), fInfoLevelId=0x0, lpFileInformation=0x125089b8 | out: lpFileInformation=0x125089b8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0179.269] CreateFileW (lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0179.270] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0x124f68f0, nSize=0x64 | out: lpBuffer="") returned 0x63
	[0179.270] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12508a08 | out: lpFileInformation=0x12508a08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0179.270] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x124f69c0, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0179.270] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12508a58 | out: lpFileInformation=0x12508a58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0179.271] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c
	[0179.271] GetConsoleMode (in: hConsoleHandle=0x13c, lpMode=0x12423aa4 | out: lpMode=0x12423aa4) returned 0
	[0179.271] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0179.271] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0179.271] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134
	[0179.271] GetConsoleMode (in: hConsoleHandle=0x134, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0179.271] GetEnvironmentStringsW () returned 0x79e0b0*
	[0179.271] FreeEnvironmentStringsW (penv=0x79e0b0) returned 1
	[0179.271] GetCurrentProcess () returned 0xffffffff
	[0179.272] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x13c, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x1251c460, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x1251c460*=0x140) returned 1
	[0179.272] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x138, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x1251c464, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x1251c464*=0x144) returned 1
	[0179.272] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x134, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x1251c468, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x1251c468*=0x150) returned 1
	[0179.272] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c \"taskkill /f /im outlook.exe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x400, lpEnvironment=0x1252a000, lpCurrentDirectory=0x0, lpStartupInfo=0x12423acc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x140, hStdOutput=0x144, hStdError=0x150), lpProcessInformation=0x12423aa8 | out: lpCommandLine="cmd.exe /c \"taskkill /f /im outlook.exe \"", lpProcessInformation=0x12423aa8*(hProcess=0x130, hThread=0x154, dwProcessId=0x1120, dwThreadId=0x110c)) returned 1
	[0179.305] SetEvent (hEvent=0x168) returned 1
	[0179.305] CloseHandle (hObject=0x154) returned 1
	[0179.305] CloseHandle (hObject=0x150) returned 1
	[0179.305] CloseHandle (hObject=0x144) returned 1
	[0179.306] CloseHandle (hObject=0x140) returned 1
	[0179.306] CloseHandle (hObject=0x13c) returned 1
	[0179.306] CloseHandle (hObject=0x138) returned 1
	[0179.306] CloseHandle (hObject=0x134) returned 1
	[0179.306] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0xffffffff) returned 0x0
	[0180.526] SetEvent (hEvent=0x168) returned 1
	[0180.526] GetExitCodeProcess (in: hProcess=0x130, lpExitCode=0x12423bdc | out: lpExitCode=0x12423bdc*=0x0) returned 1
	[0180.526] GetProcessTimes (in: hProcess=0x130, lpCreationTime=0x1251a8a0, lpExitTime=0x1251a8a8, lpKernelTime=0x1251a8b0, lpUserTime=0x1251a8b8 | out: lpCreationTime=0x1251a8a0, lpExitTime=0x1251a8a8, lpKernelTime=0x1251a8b0, lpUserTime=0x1251a8b8) returned 1
	[0180.526] CloseHandle (hObject=0x130) returned 1
	[0180.527] SetEvent (hEvent=0x124) returned 1
	[0180.527] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x5) returned 0x102
	[0180.620] SetEvent (hEvent=0x168) returned 1
	[0180.620] SetEvent (hEvent=0x124) returned 1
	[0180.620] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1250c340, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0180.620] GetFileAttributesExW (in: lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x124d3d68 | out: lpFileInformation=0x124d3d68*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0180.620] CreateFileW (lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0180.620] GetFileAttributesExW (in: lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), fInfoLevelId=0x0, lpFileInformation=0x124d3db8 | out: lpFileInformation=0x124d3db8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0180.620] CreateFileW (lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0180.620] GetFileAttributesExW (in: lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), fInfoLevelId=0x0, lpFileInformation=0x124d3e08 | out: lpFileInformation=0x124d3e08*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0180.621] CreateFileW (lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0180.621] GetFileAttributesExW (in: lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), fInfoLevelId=0x0, lpFileInformation=0x124d3e58 | out: lpFileInformation=0x124d3e58*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0180.621] CreateFileW (lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0180.621] GetFileAttributesExW (in: lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x124d3ea8 | out: lpFileInformation=0x124d3ea8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0180.621] CreateFileW (lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0180.621] GetFileAttributesExW (in: lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), fInfoLevelId=0x0, lpFileInformation=0x124d3ef8 | out: lpFileInformation=0x124d3ef8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0180.621] CreateFileW (lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0180.621] GetFileAttributesExW (in: lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), fInfoLevelId=0x0, lpFileInformation=0x124d3f48 | out: lpFileInformation=0x124d3f48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0180.621] CreateFileW (lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0180.621] GetFileAttributesExW (in: lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), fInfoLevelId=0x0, lpFileInformation=0x124d3f98 | out: lpFileInformation=0x124d3f98*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0180.621] CreateFileW (lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0180.621] GetFileAttributesExW (in: lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), fInfoLevelId=0x0, lpFileInformation=0x1252c008 | out: lpFileInformation=0x1252c008*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0180.622] CreateFileW (lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0180.622] GetFileAttributesExW (in: lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), fInfoLevelId=0x0, lpFileInformation=0x1252c058 | out: lpFileInformation=0x1252c058*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0180.622] CreateFileW (lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0180.622] GetFileAttributesExW (in: lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), fInfoLevelId=0x0, lpFileInformation=0x1252c0a8 | out: lpFileInformation=0x1252c0a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0180.622] CreateFileW (lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0180.622] GetFileAttributesExW (in: lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), fInfoLevelId=0x0, lpFileInformation=0x1252c0f8 | out: lpFileInformation=0x1252c0f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0180.622] CreateFileW (lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0180.622] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0x1250c410, nSize=0x64 | out: lpBuffer="") returned 0x63
	[0180.622] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x1252c148 | out: lpFileInformation=0x1252c148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0180.622] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1250c4e0, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0180.623] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x1252c198 | out: lpFileInformation=0x1252c198*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0180.623] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130
	[0180.623] GetConsoleMode (in: hConsoleHandle=0x130, lpMode=0x12423aa4 | out: lpMode=0x12423aa4) returned 0
	[0180.623] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134
	[0180.623] GetConsoleMode (in: hConsoleHandle=0x134, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0180.623] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0180.623] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0180.623] GetEnvironmentStringsW () returned 0x79e0b0*
	[0180.623] FreeEnvironmentStringsW (penv=0x79e0b0) returned 1
	[0180.623] GetCurrentProcess () returned 0xffffffff
	[0180.623] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x130, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124dbe10, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124dbe10*=0x13c) returned 1
	[0180.624] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x134, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124dbe14, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124dbe14*=0x140) returned 1
	[0180.624] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x138, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x124dbe18, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x124dbe18*=0x144) returned 1
	[0180.624] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c \"taskkill /f /im powerpnt.exe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x400, lpEnvironment=0x12513500, lpCurrentDirectory=0x0, lpStartupInfo=0x12423acc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x13c, hStdOutput=0x140, hStdError=0x144), lpProcessInformation=0x12423aa8 | out: lpCommandLine="cmd.exe /c \"taskkill /f /im powerpnt.exe \"", lpProcessInformation=0x12423aa8*(hProcess=0x154, hThread=0x150, dwProcessId=0x1104, dwThreadId=0x1100)) returned 1
	[0180.724] SetEvent (hEvent=0x168) returned 1
	[0180.724] CloseHandle (hObject=0x150) returned 1
	[0180.724] CloseHandle (hObject=0x144) returned 1
	[0180.724] CloseHandle (hObject=0x140) returned 1
	[0180.724] CloseHandle (hObject=0x13c) returned 1
	[0180.724] CloseHandle (hObject=0x130) returned 1
	[0180.724] CloseHandle (hObject=0x134) returned 1
	[0180.724] CloseHandle (hObject=0x138) returned 1
	[0180.724] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0xffffffff) returned 0x0
	[0181.988] SetEvent (hEvent=0x168) returned 1
	[0181.988] GetExitCodeProcess (in: hProcess=0x154, lpExitCode=0x12423bdc | out: lpExitCode=0x12423bdc*=0x80) returned 1
	[0181.988] GetProcessTimes (in: hProcess=0x154, lpCreationTime=0x125300a0, lpExitTime=0x125300a8, lpKernelTime=0x125300b0, lpUserTime=0x125300b8 | out: lpCreationTime=0x125300a0, lpExitTime=0x125300a8, lpKernelTime=0x125300b0, lpUserTime=0x125300b8) returned 1
	[0181.988] CloseHandle (hObject=0x154) returned 1
	[0181.988] SetEvent (hEvent=0x124) returned 1
	[0181.989] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x5) returned 0x102
	[0182.021] SetEvent (hEvent=0x168) returned 1
	[0182.021] SetEvent (hEvent=0x124) returned 1
	[0182.021] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x124f6a90, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0182.021] GetFileAttributesExW (in: lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12508aa8 | out: lpFileInformation=0x12508aa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0182.022] CreateFileW (lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0182.022] GetFileAttributesExW (in: lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), fInfoLevelId=0x0, lpFileInformation=0x12508af8 | out: lpFileInformation=0x12508af8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0182.022] CreateFileW (lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0182.022] GetFileAttributesExW (in: lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), fInfoLevelId=0x0, lpFileInformation=0x12508b48 | out: lpFileInformation=0x12508b48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0182.022] CreateFileW (lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0182.022] GetFileAttributesExW (in: lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), fInfoLevelId=0x0, lpFileInformation=0x12508b98 | out: lpFileInformation=0x12508b98*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0182.022] CreateFileW (lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0182.022] GetFileAttributesExW (in: lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x12508be8 | out: lpFileInformation=0x12508be8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0182.023] CreateFileW (lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0182.023] GetFileAttributesExW (in: lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), fInfoLevelId=0x0, lpFileInformation=0x12508c38 | out: lpFileInformation=0x12508c38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0182.023] CreateFileW (lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0182.023] GetFileAttributesExW (in: lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), fInfoLevelId=0x0, lpFileInformation=0x12508c88 | out: lpFileInformation=0x12508c88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0182.023] CreateFileW (lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0182.024] GetFileAttributesExW (in: lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), fInfoLevelId=0x0, lpFileInformation=0x12508cd8 | out: lpFileInformation=0x12508cd8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0182.024] CreateFileW (lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0182.024] GetFileAttributesExW (in: lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), fInfoLevelId=0x0, lpFileInformation=0x12508d28 | out: lpFileInformation=0x12508d28*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0182.024] CreateFileW (lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0182.024] GetFileAttributesExW (in: lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), fInfoLevelId=0x0, lpFileInformation=0x12508d78 | out: lpFileInformation=0x12508d78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0182.024] CreateFileW (lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0182.024] GetFileAttributesExW (in: lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), fInfoLevelId=0x0, lpFileInformation=0x12508dc8 | out: lpFileInformation=0x12508dc8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0182.024] CreateFileW (lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0182.025] GetFileAttributesExW (in: lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), fInfoLevelId=0x0, lpFileInformation=0x12508e18 | out: lpFileInformation=0x12508e18*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0182.025] CreateFileW (lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0182.025] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0x124f6b60, nSize=0x64 | out: lpBuffer="") returned 0x63
	[0182.025] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12508e68 | out: lpFileInformation=0x12508e68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0182.025] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x124f6c30, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0182.025] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12508eb8 | out: lpFileInformation=0x12508eb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0182.025] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154
	[0182.026] GetConsoleMode (in: hConsoleHandle=0x154, lpMode=0x12423aa4 | out: lpMode=0x12423aa4) returned 0
	[0182.026] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0182.026] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0182.026] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134
	[0182.026] GetConsoleMode (in: hConsoleHandle=0x134, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0182.026] GetEnvironmentStringsW () returned 0x79e0b0*
	[0182.026] FreeEnvironmentStringsW (penv=0x79e0b0) returned 1
	[0182.026] GetCurrentProcess () returned 0xffffffff
	[0182.027] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x154, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x1251c880, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x1251c880*=0x130) returned 1
	[0182.027] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x138, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x1251c884, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x1251c884*=0x13c) returned 1
	[0182.027] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x134, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x1251c888, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x1251c888*=0x140) returned 1
	[0182.027] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c \"taskkill /f /im steam.exe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x400, lpEnvironment=0x1252aa80, lpCurrentDirectory=0x0, lpStartupInfo=0x12423acc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x130, hStdOutput=0x13c, hStdError=0x140), lpProcessInformation=0x12423aa8 | out: lpCommandLine="cmd.exe /c \"taskkill /f /im steam.exe \"", lpProcessInformation=0x12423aa8*(hProcess=0x150, hThread=0x144, dwProcessId=0x11b8, dwThreadId=0x118c)) returned 1
	[0182.081] SetEvent (hEvent=0x168) returned 1
	[0182.081] CloseHandle (hObject=0x144) returned 1
	[0182.081] CloseHandle (hObject=0x140) returned 1
	[0182.081] CloseHandle (hObject=0x13c) returned 1
	[0182.081] CloseHandle (hObject=0x130) returned 1
	[0182.081] CloseHandle (hObject=0x154) returned 1
	[0182.081] CloseHandle (hObject=0x138) returned 1
	[0182.081] CloseHandle (hObject=0x134) returned 1
	[0182.081] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0
	[0183.414] SetEvent (hEvent=0x168) returned 1
	[0183.414] GetExitCodeProcess (in: hProcess=0x150, lpExitCode=0x12423bdc | out: lpExitCode=0x12423bdc*=0x80) returned 1
	[0183.414] GetProcessTimes (in: hProcess=0x150, lpCreationTime=0x1251af00, lpExitTime=0x1251af08, lpKernelTime=0x1251af10, lpUserTime=0x1251af18 | out: lpCreationTime=0x1251af00, lpExitTime=0x1251af08, lpKernelTime=0x1251af10, lpUserTime=0x1251af18) returned 1
	[0183.414] CloseHandle (hObject=0x150) returned 1
	[0183.414] SetEvent (hEvent=0x124) returned 1
	[0183.415] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x4) returned 0x102
	[0183.420] SetEvent (hEvent=0x168) returned 1
	[0183.420] SetEvent (hEvent=0x124) returned 1
	[0183.420] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1250c5b0, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0183.420] GetFileAttributesExW (in: lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x1252c1e8 | out: lpFileInformation=0x1252c1e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0183.420] CreateFileW (lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0183.420] GetFileAttributesExW (in: lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), fInfoLevelId=0x0, lpFileInformation=0x1252c238 | out: lpFileInformation=0x1252c238*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0183.420] CreateFileW (lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0183.420] GetFileAttributesExW (in: lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), fInfoLevelId=0x0, lpFileInformation=0x1252c288 | out: lpFileInformation=0x1252c288*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0183.421] CreateFileW (lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0183.421] GetFileAttributesExW (in: lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), fInfoLevelId=0x0, lpFileInformation=0x1252c2d8 | out: lpFileInformation=0x1252c2d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0183.421] CreateFileW (lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0183.421] GetFileAttributesExW (in: lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x1252c328 | out: lpFileInformation=0x1252c328*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0183.421] CreateFileW (lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0183.421] GetFileAttributesExW (in: lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), fInfoLevelId=0x0, lpFileInformation=0x1252c378 | out: lpFileInformation=0x1252c378*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0183.421] CreateFileW (lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0183.421] GetFileAttributesExW (in: lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), fInfoLevelId=0x0, lpFileInformation=0x1252c3c8 | out: lpFileInformation=0x1252c3c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0183.421] CreateFileW (lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0183.421] GetFileAttributesExW (in: lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), fInfoLevelId=0x0, lpFileInformation=0x1252c418 | out: lpFileInformation=0x1252c418*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0183.421] CreateFileW (lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0183.421] GetFileAttributesExW (in: lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), fInfoLevelId=0x0, lpFileInformation=0x1252c468 | out: lpFileInformation=0x1252c468*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0183.422] CreateFileW (lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0183.422] GetFileAttributesExW (in: lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), fInfoLevelId=0x0, lpFileInformation=0x1252c4b8 | out: lpFileInformation=0x1252c4b8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0183.422] CreateFileW (lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0183.422] GetFileAttributesExW (in: lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), fInfoLevelId=0x0, lpFileInformation=0x1252c508 | out: lpFileInformation=0x1252c508*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0183.422] CreateFileW (lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0183.422] GetFileAttributesExW (in: lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), fInfoLevelId=0x0, lpFileInformation=0x1252c558 | out: lpFileInformation=0x1252c558*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0183.422] CreateFileW (lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0183.422] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0x1250c680, nSize=0x64 | out: lpBuffer="") returned 0x63
	[0183.422] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x1252c5a8 | out: lpFileInformation=0x1252c5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0183.422] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1250c750, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0183.423] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x1252c5f8 | out: lpFileInformation=0x1252c5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0183.423] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x150
	[0183.423] GetConsoleMode (in: hConsoleHandle=0x150, lpMode=0x12423aa4 | out: lpMode=0x12423aa4) returned 0
	[0183.423] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134
	[0183.423] GetConsoleMode (in: hConsoleHandle=0x134, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0183.423] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0183.423] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0183.423] GetEnvironmentStringsW () returned 0x79e0b0*
	[0183.423] FreeEnvironmentStringsW (penv=0x79e0b0) returned 1
	[0183.424] GetCurrentProcess () returned 0xffffffff
	[0183.424] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x150, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x12540230, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x12540230*=0x154) returned 1
	[0183.424] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x134, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x12540234, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x12540234*=0x130) returned 1
	[0183.424] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x138, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x12540238, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x12540238*=0x13c) returned 1
	[0183.424] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c \"taskkill /f /im sqlservr.exe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x400, lpEnvironment=0x12548000, lpCurrentDirectory=0x0, lpStartupInfo=0x12423acc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x154, hStdOutput=0x130, hStdError=0x13c), lpProcessInformation=0x12423aa8 | out: lpCommandLine="cmd.exe /c \"taskkill /f /im sqlservr.exe \"", lpProcessInformation=0x12423aa8*(hProcess=0x144, hThread=0x140, dwProcessId=0xc60, dwThreadId=0x88c)) returned 1
	[0183.529] SetEvent (hEvent=0x168) returned 1
	[0183.529] CloseHandle (hObject=0x140) returned 1
	[0183.529] CloseHandle (hObject=0x13c) returned 1
	[0183.529] CloseHandle (hObject=0x130) returned 1
	[0183.529] CloseHandle (hObject=0x154) returned 1
	[0183.529] CloseHandle (hObject=0x150) returned 1
	[0183.529] CloseHandle (hObject=0x134) returned 1
	[0183.529] CloseHandle (hObject=0x138) returned 1
	[0183.529] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0
	[0184.756] SetEvent (hEvent=0x168) returned 1
	[0184.756] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0x12423bdc | out: lpExitCode=0x12423bdc*=0x80) returned 1
	[0184.757] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0x12530700, lpExitTime=0x12530708, lpKernelTime=0x12530710, lpUserTime=0x12530718 | out: lpCreationTime=0x12530700, lpExitTime=0x12530708, lpKernelTime=0x12530710, lpUserTime=0x12530718) returned 1
	[0184.757] CloseHandle (hObject=0x144) returned 1
	[0184.757] SetEvent (hEvent=0x124) returned 1
	[0184.757] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x5) returned 0x102
	[0184.764] SetEvent (hEvent=0x124) returned 1
	[0184.764] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x124f6d00, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0184.764] GetFileAttributesExW (in: lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12508f08 | out: lpFileInformation=0x12508f08*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0184.765] CreateFileW (lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0184.765] GetFileAttributesExW (in: lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), fInfoLevelId=0x0, lpFileInformation=0x12508f58 | out: lpFileInformation=0x12508f58*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0184.765] CreateFileW (lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0184.765] GetFileAttributesExW (in: lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), fInfoLevelId=0x0, lpFileInformation=0x12508fa8 | out: lpFileInformation=0x12508fa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0184.765] CreateFileW (lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0184.765] GetFileAttributesExW (in: lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), fInfoLevelId=0x0, lpFileInformation=0x12508ff8 | out: lpFileInformation=0x12508ff8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0184.765] CreateFileW (lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0184.765] GetFileAttributesExW (in: lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x12509048 | out: lpFileInformation=0x12509048*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0184.765] CreateFileW (lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0184.765] GetFileAttributesExW (in: lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), fInfoLevelId=0x0, lpFileInformation=0x12509098 | out: lpFileInformation=0x12509098*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0184.766] CreateFileW (lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0184.766] GetFileAttributesExW (in: lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), fInfoLevelId=0x0, lpFileInformation=0x125090e8 | out: lpFileInformation=0x125090e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0184.766] CreateFileW (lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0184.766] GetFileAttributesExW (in: lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), fInfoLevelId=0x0, lpFileInformation=0x12509138 | out: lpFileInformation=0x12509138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0184.766] CreateFileW (lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0184.766] GetFileAttributesExW (in: lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), fInfoLevelId=0x0, lpFileInformation=0x12509188 | out: lpFileInformation=0x12509188*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0184.766] CreateFileW (lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0184.766] GetFileAttributesExW (in: lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), fInfoLevelId=0x0, lpFileInformation=0x125091d8 | out: lpFileInformation=0x125091d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0184.766] CreateFileW (lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0184.766] GetFileAttributesExW (in: lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), fInfoLevelId=0x0, lpFileInformation=0x12509228 | out: lpFileInformation=0x12509228*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0184.767] CreateFileW (lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0184.767] GetFileAttributesExW (in: lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), fInfoLevelId=0x0, lpFileInformation=0x12509278 | out: lpFileInformation=0x12509278*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0184.767] CreateFileW (lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0184.767] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0x124f6dd0, nSize=0x64 | out: lpBuffer="") returned 0x63
	[0184.767] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x125092c8 | out: lpFileInformation=0x125092c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0184.767] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x124f6ea0, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0184.767] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12509318 | out: lpFileInformation=0x12509318*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0184.767] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x144
	[0184.767] GetConsoleMode (in: hConsoleHandle=0x144, lpMode=0x12423aa4 | out: lpMode=0x12423aa4) returned 0
	[0184.767] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0184.767] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0184.767] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134
	[0184.768] GetConsoleMode (in: hConsoleHandle=0x134, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0184.768] GetEnvironmentStringsW () returned 0x79e0b0*
	[0184.768] FreeEnvironmentStringsW (penv=0x79e0b0) returned 1
	[0184.768] GetCurrentProcess () returned 0xffffffff
	[0184.768] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x144, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x1251cca0, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x1251cca0*=0x150) returned 1
	[0184.768] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x138, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x1251cca4, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x1251cca4*=0x154) returned 1
	[0184.768] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x134, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x1251cca8, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x1251cca8*=0x130) returned 1
	[0184.769] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c \"taskkill /f /im thebat.exe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x400, lpEnvironment=0x1252b500, lpCurrentDirectory=0x0, lpStartupInfo=0x12423acc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x150, hStdOutput=0x154, hStdError=0x130), lpProcessInformation=0x12423aa8 | out: lpCommandLine="cmd.exe /c \"taskkill /f /im thebat.exe \"", lpProcessInformation=0x12423aa8*(hProcess=0x140, hThread=0x13c, dwProcessId=0x560, dwThreadId=0x2e8)) returned 1
	[0184.875] SetEvent (hEvent=0x168) returned 1
	[0184.875] CloseHandle (hObject=0x13c) returned 1
	[0184.875] CloseHandle (hObject=0x130) returned 1
	[0184.875] CloseHandle (hObject=0x154) returned 1
	[0184.875] CloseHandle (hObject=0x150) returned 1
	[0184.876] CloseHandle (hObject=0x144) returned 1
	[0184.876] CloseHandle (hObject=0x138) returned 1
	[0184.876] CloseHandle (hObject=0x134) returned 1
	[0184.876] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0xffffffff) returned 0x0
	[0186.088] SetEvent (hEvent=0x168) returned 1
	[0186.088] GetExitCodeProcess (in: hProcess=0x140, lpExitCode=0x12423bdc | out: lpExitCode=0x12423bdc*=0x80) returned 1
	[0186.089] GetProcessTimes (in: hProcess=0x140, lpCreationTime=0x1251b560, lpExitTime=0x1251b568, lpKernelTime=0x1251b570, lpUserTime=0x1251b578 | out: lpCreationTime=0x1251b560, lpExitTime=0x1251b568, lpKernelTime=0x1251b570, lpUserTime=0x1251b578) returned 1
	[0186.089] CloseHandle (hObject=0x140) returned 1
	[0186.089] SetEvent (hEvent=0x124) returned 1
	[0186.089] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x5) returned 0x102
	[0186.095] SetEvent (hEvent=0x168) returned 1
	[0186.095] SetEvent (hEvent=0x124) returned 1
	[0186.095] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1250c820, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0186.095] GetFileAttributesExW (in: lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x1252c648 | out: lpFileInformation=0x1252c648*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0186.124] CreateFileW (lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0186.124] GetFileAttributesExW (in: lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), fInfoLevelId=0x0, lpFileInformation=0x1252c698 | out: lpFileInformation=0x1252c698*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0186.124] CreateFileW (lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0186.124] GetFileAttributesExW (in: lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), fInfoLevelId=0x0, lpFileInformation=0x1252c6e8 | out: lpFileInformation=0x1252c6e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0186.124] CreateFileW (lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0186.124] GetFileAttributesExW (in: lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), fInfoLevelId=0x0, lpFileInformation=0x1252c738 | out: lpFileInformation=0x1252c738*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0186.124] CreateFileW (lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0186.124] GetFileAttributesExW (in: lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x1252c788 | out: lpFileInformation=0x1252c788*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0186.124] CreateFileW (lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0186.124] GetFileAttributesExW (in: lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), fInfoLevelId=0x0, lpFileInformation=0x1252c7d8 | out: lpFileInformation=0x1252c7d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0186.125] CreateFileW (lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0186.125] GetFileAttributesExW (in: lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), fInfoLevelId=0x0, lpFileInformation=0x1252c828 | out: lpFileInformation=0x1252c828*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0186.125] CreateFileW (lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0186.125] GetFileAttributesExW (in: lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), fInfoLevelId=0x0, lpFileInformation=0x1252c878 | out: lpFileInformation=0x1252c878*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0186.125] CreateFileW (lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0186.125] GetFileAttributesExW (in: lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), fInfoLevelId=0x0, lpFileInformation=0x1252c8c8 | out: lpFileInformation=0x1252c8c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0186.125] CreateFileW (lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0186.125] GetFileAttributesExW (in: lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), fInfoLevelId=0x0, lpFileInformation=0x1252c918 | out: lpFileInformation=0x1252c918*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0186.125] CreateFileW (lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0186.125] GetFileAttributesExW (in: lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), fInfoLevelId=0x0, lpFileInformation=0x1252c968 | out: lpFileInformation=0x1252c968*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0186.125] CreateFileW (lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0186.126] GetFileAttributesExW (in: lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), fInfoLevelId=0x0, lpFileInformation=0x1252c9b8 | out: lpFileInformation=0x1252c9b8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0186.126] CreateFileW (lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0186.126] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0x1250c8f0, nSize=0x64 | out: lpBuffer="") returned 0x63
	[0186.126] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x1252ca08 | out: lpFileInformation=0x1252ca08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0186.126] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1250c9c0, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0186.126] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x1252ca58 | out: lpFileInformation=0x1252ca58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0186.126] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x140
	[0186.126] GetConsoleMode (in: hConsoleHandle=0x140, lpMode=0x12423aa4 | out: lpMode=0x12423aa4) returned 0
	[0186.126] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134
	[0186.126] GetConsoleMode (in: hConsoleHandle=0x134, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0186.126] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0186.127] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0186.127] GetEnvironmentStringsW () returned 0x79e0b0*
	[0186.127] FreeEnvironmentStringsW (penv=0x79e0b0) returned 1
	[0186.127] GetCurrentProcess () returned 0xffffffff
	[0186.127] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x140, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x12540650, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x12540650*=0x144) returned 1
	[0186.127] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x134, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x12540654, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x12540654*=0x150) returned 1
	[0186.127] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x138, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x12540658, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x12540658*=0x154) returned 1
	[0186.127] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c \"taskkill /f /im thebat64.exe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x400, lpEnvironment=0x12548a80, lpCurrentDirectory=0x0, lpStartupInfo=0x12423acc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x144, hStdOutput=0x150, hStdError=0x154), lpProcessInformation=0x12423aa8 | out: lpCommandLine="cmd.exe /c \"taskkill /f /im thebat64.exe \"", lpProcessInformation=0x12423aa8*(hProcess=0x13c, hThread=0x130, dwProcessId=0xf0c, dwThreadId=0xd94)) returned 1
	[0186.158] CloseHandle (hObject=0x130) returned 1
	[0186.158] CloseHandle (hObject=0x154) returned 1
	[0186.158] CloseHandle (hObject=0x150) returned 1
	[0186.158] CloseHandle (hObject=0x144) returned 1
	[0186.158] CloseHandle (hObject=0x140) returned 1
	[0186.158] CloseHandle (hObject=0x134) returned 1
	[0186.158] CloseHandle (hObject=0x138) returned 1
	[0186.158] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0xffffffff) returned 0x0
	[0187.760] SetEvent (hEvent=0x168) returned 1
	[0187.760] GetExitCodeProcess (in: hProcess=0x13c, lpExitCode=0x12423bdc | out: lpExitCode=0x12423bdc*=0x80) returned 1
	[0187.761] GetProcessTimes (in: hProcess=0x13c, lpCreationTime=0x12530d60, lpExitTime=0x12530d68, lpKernelTime=0x12530d70, lpUserTime=0x12530d78 | out: lpCreationTime=0x12530d60, lpExitTime=0x12530d68, lpKernelTime=0x12530d70, lpUserTime=0x12530d78) returned 1
	[0187.761] CloseHandle (hObject=0x13c) returned 1
	[0187.761] SetEvent (hEvent=0x124) returned 1
	[0187.761] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x5) returned 0x102
	[0187.799] SetEvent (hEvent=0x168) returned 1
	[0187.799] SetEvent (hEvent=0x124) returned 1
	[0187.799] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x124f6f70, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0187.799] GetFileAttributesExW (in: lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12509368 | out: lpFileInformation=0x12509368*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0187.799] CreateFileW (lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0187.799] GetFileAttributesExW (in: lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), fInfoLevelId=0x0, lpFileInformation=0x125093b8 | out: lpFileInformation=0x125093b8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0187.799] CreateFileW (lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0187.799] GetFileAttributesExW (in: lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), fInfoLevelId=0x0, lpFileInformation=0x12509408 | out: lpFileInformation=0x12509408*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0187.800] CreateFileW (lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0187.800] GetFileAttributesExW (in: lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), fInfoLevelId=0x0, lpFileInformation=0x12509458 | out: lpFileInformation=0x12509458*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0187.800] CreateFileW (lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0187.800] GetFileAttributesExW (in: lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x125094a8 | out: lpFileInformation=0x125094a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0187.800] CreateFileW (lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0187.800] GetFileAttributesExW (in: lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), fInfoLevelId=0x0, lpFileInformation=0x125094f8 | out: lpFileInformation=0x125094f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0187.800] CreateFileW (lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0187.800] GetFileAttributesExW (in: lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), fInfoLevelId=0x0, lpFileInformation=0x12509548 | out: lpFileInformation=0x12509548*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0187.800] CreateFileW (lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0187.800] GetFileAttributesExW (in: lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), fInfoLevelId=0x0, lpFileInformation=0x12509598 | out: lpFileInformation=0x12509598*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0187.800] CreateFileW (lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0187.801] GetFileAttributesExW (in: lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), fInfoLevelId=0x0, lpFileInformation=0x125095e8 | out: lpFileInformation=0x125095e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0187.801] CreateFileW (lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0187.801] GetFileAttributesExW (in: lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), fInfoLevelId=0x0, lpFileInformation=0x12509638 | out: lpFileInformation=0x12509638*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0187.801] CreateFileW (lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0187.801] GetFileAttributesExW (in: lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), fInfoLevelId=0x0, lpFileInformation=0x12509688 | out: lpFileInformation=0x12509688*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0187.801] CreateFileW (lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0187.801] GetFileAttributesExW (in: lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), fInfoLevelId=0x0, lpFileInformation=0x125096d8 | out: lpFileInformation=0x125096d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0187.801] CreateFileW (lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0187.801] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0x124f7040, nSize=0x64 | out: lpBuffer="") returned 0x63
	[0187.802] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12509728 | out: lpFileInformation=0x12509728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0187.802] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x124f7110, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0187.802] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12509778 | out: lpFileInformation=0x12509778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0187.802] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x13c
	[0187.802] GetConsoleMode (in: hConsoleHandle=0x13c, lpMode=0x12423aa4 | out: lpMode=0x12423aa4) returned 0
	[0187.802] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0187.802] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0187.802] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134
	[0187.802] GetConsoleMode (in: hConsoleHandle=0x134, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0187.802] GetEnvironmentStringsW () returned 0x79e0b0*
	[0187.803] FreeEnvironmentStringsW (penv=0x79e0b0) returned 1
	[0187.803] GetCurrentProcess () returned 0xffffffff
	[0187.803] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x13c, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x1251d0c0, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x1251d0c0*=0x140) returned 1
	[0187.803] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x138, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x1251d0c4, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x1251d0c4*=0x144) returned 1
	[0187.803] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x134, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x1251d0c8, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x1251d0c8*=0x150) returned 1
	[0187.804] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c \"taskkill /f /im thunderbird.exe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x400, lpEnvironment=0x1255c000, lpCurrentDirectory=0x0, lpStartupInfo=0x12423acc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x140, hStdOutput=0x144, hStdError=0x150), lpProcessInformation=0x12423aa8 | out: lpCommandLine="cmd.exe /c \"taskkill /f /im thunderbird.exe \"", lpProcessInformation=0x12423aa8*(hProcess=0x130, hThread=0x154, dwProcessId=0x868, dwThreadId=0x7f0)) returned 1
	[0187.902] CloseHandle (hObject=0x154) returned 1
	[0187.902] CloseHandle (hObject=0x150) returned 1
	[0187.902] CloseHandle (hObject=0x144) returned 1
	[0187.902] CloseHandle (hObject=0x140) returned 1
	[0187.903] CloseHandle (hObject=0x13c) returned 1
	[0187.903] CloseHandle (hObject=0x138) returned 1
	[0187.903] CloseHandle (hObject=0x134) returned 1
	[0187.903] WaitForSingleObject (hHandle=0x130, dwMilliseconds=0xffffffff) returned 0x0
	[0189.269] SetEvent (hEvent=0x168) returned 1
	[0189.269] GetExitCodeProcess (in: hProcess=0x130, lpExitCode=0x12423bdc | out: lpExitCode=0x12423bdc*=0x0) returned 1
	[0189.269] GetProcessTimes (in: hProcess=0x130, lpCreationTime=0x1251bb80, lpExitTime=0x1251bb88, lpKernelTime=0x1251bb90, lpUserTime=0x1251bb98 | out: lpCreationTime=0x1251bb80, lpExitTime=0x1251bb88, lpKernelTime=0x1251bb90, lpUserTime=0x1251bb98) returned 1
	[0189.269] CloseHandle (hObject=0x130) returned 1
	[0189.270] SetEvent (hEvent=0x124) returned 1
	[0189.270] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x5) returned 0x102
	[0189.276] SetEvent (hEvent=0x168) returned 1
	[0189.276] SetEvent (hEvent=0x124) returned 1
	[0189.276] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1250ca90, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0189.276] GetFileAttributesExW (in: lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x1252caa8 | out: lpFileInformation=0x1252caa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0189.276] CreateFileW (lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0189.276] GetFileAttributesExW (in: lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), fInfoLevelId=0x0, lpFileInformation=0x1252caf8 | out: lpFileInformation=0x1252caf8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0189.276] CreateFileW (lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0189.276] GetFileAttributesExW (in: lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), fInfoLevelId=0x0, lpFileInformation=0x1252cb48 | out: lpFileInformation=0x1252cb48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0189.277] CreateFileW (lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0189.277] GetFileAttributesExW (in: lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), fInfoLevelId=0x0, lpFileInformation=0x1252cb98 | out: lpFileInformation=0x1252cb98*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0189.277] CreateFileW (lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0189.277] GetFileAttributesExW (in: lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x1252cbe8 | out: lpFileInformation=0x1252cbe8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0189.277] CreateFileW (lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0189.277] GetFileAttributesExW (in: lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), fInfoLevelId=0x0, lpFileInformation=0x1252cc38 | out: lpFileInformation=0x1252cc38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0189.277] CreateFileW (lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0189.277] GetFileAttributesExW (in: lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), fInfoLevelId=0x0, lpFileInformation=0x1252cc88 | out: lpFileInformation=0x1252cc88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0189.277] CreateFileW (lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0189.277] GetFileAttributesExW (in: lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), fInfoLevelId=0x0, lpFileInformation=0x1252ccd8 | out: lpFileInformation=0x1252ccd8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0189.278] CreateFileW (lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0189.278] GetFileAttributesExW (in: lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), fInfoLevelId=0x0, lpFileInformation=0x1252cd28 | out: lpFileInformation=0x1252cd28*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0189.278] CreateFileW (lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0189.278] GetFileAttributesExW (in: lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), fInfoLevelId=0x0, lpFileInformation=0x1252cd78 | out: lpFileInformation=0x1252cd78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0189.278] CreateFileW (lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0189.278] GetFileAttributesExW (in: lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), fInfoLevelId=0x0, lpFileInformation=0x1252cdc8 | out: lpFileInformation=0x1252cdc8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0189.278] CreateFileW (lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0189.278] GetFileAttributesExW (in: lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), fInfoLevelId=0x0, lpFileInformation=0x1252ce18 | out: lpFileInformation=0x1252ce18*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0189.278] CreateFileW (lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0189.278] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0x1250cb60, nSize=0x64 | out: lpBuffer="") returned 0x63
	[0189.278] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x1252ce68 | out: lpFileInformation=0x1252ce68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0189.278] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1250cc30, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0189.278] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x1252ceb8 | out: lpFileInformation=0x1252ceb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0189.279] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130
	[0189.279] GetConsoleMode (in: hConsoleHandle=0x130, lpMode=0x12423aa4 | out: lpMode=0x12423aa4) returned 0
	[0189.279] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134
	[0189.279] GetConsoleMode (in: hConsoleHandle=0x134, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0189.279] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0189.279] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0189.279] GetEnvironmentStringsW () returned 0x79e0b0*
	[0189.279] FreeEnvironmentStringsW (penv=0x79e0b0) returned 1
	[0189.279] GetCurrentProcess () returned 0xffffffff
	[0189.279] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x130, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x12540a70, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x12540a70*=0x13c) returned 1
	[0189.279] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x134, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x12540a74, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x12540a74*=0x140) returned 1
	[0189.280] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x138, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x12540a78, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x12540a78*=0x144) returned 1
	[0189.280] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c \"taskkill /f /im visio.exe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x400, lpEnvironment=0x12549500, lpCurrentDirectory=0x0, lpStartupInfo=0x12423acc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x13c, hStdOutput=0x140, hStdError=0x144), lpProcessInformation=0x12423aa8 | out: lpCommandLine="cmd.exe /c \"taskkill /f /im visio.exe \"", lpProcessInformation=0x12423aa8*(hProcess=0x154, hThread=0x150, dwProcessId=0xc2c, dwThreadId=0x394)) returned 1
	[0189.332] SetEvent (hEvent=0x168) returned 1
	[0189.332] CloseHandle (hObject=0x150) returned 1
	[0189.332] CloseHandle (hObject=0x144) returned 1
	[0189.332] CloseHandle (hObject=0x140) returned 1
	[0189.332] CloseHandle (hObject=0x13c) returned 1
	[0189.333] CloseHandle (hObject=0x130) returned 1
	[0189.333] CloseHandle (hObject=0x134) returned 1
	[0189.333] CloseHandle (hObject=0x138) returned 1
	[0189.333] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0xffffffff) returned 0x0
	[0190.486] SetEvent (hEvent=0x168) returned 1
	[0190.486] GetExitCodeProcess (in: hProcess=0x154, lpExitCode=0x12423bdc | out: lpExitCode=0x12423bdc*=0x80) returned 1
	[0190.486] GetProcessTimes (in: hProcess=0x154, lpCreationTime=0x125313c0, lpExitTime=0x125313c8, lpKernelTime=0x125313d0, lpUserTime=0x125313d8 | out: lpCreationTime=0x125313c0, lpExitTime=0x125313c8, lpKernelTime=0x125313d0, lpUserTime=0x125313d8) returned 1
	[0190.487] CloseHandle (hObject=0x154) returned 1
	[0190.487] SetEvent (hEvent=0x124) returned 1
	[0190.508] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x5) returned 0x102
	[0190.518] SetEvent (hEvent=0x168) returned 1
	[0190.518] SetEvent (hEvent=0x124) returned 1
	[0190.518] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x124f71e0, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0190.518] GetFileAttributesExW (in: lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x125097c8 | out: lpFileInformation=0x125097c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0190.518] CreateFileW (lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0190.518] GetFileAttributesExW (in: lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), fInfoLevelId=0x0, lpFileInformation=0x12509818 | out: lpFileInformation=0x12509818*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0190.518] CreateFileW (lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0190.519] GetFileAttributesExW (in: lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), fInfoLevelId=0x0, lpFileInformation=0x12509868 | out: lpFileInformation=0x12509868*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0190.519] CreateFileW (lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0190.519] GetFileAttributesExW (in: lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), fInfoLevelId=0x0, lpFileInformation=0x125098b8 | out: lpFileInformation=0x125098b8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0190.519] CreateFileW (lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0190.519] GetFileAttributesExW (in: lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x12509908 | out: lpFileInformation=0x12509908*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0190.519] CreateFileW (lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0190.519] GetFileAttributesExW (in: lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), fInfoLevelId=0x0, lpFileInformation=0x12509958 | out: lpFileInformation=0x12509958*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0190.523] CreateFileW (lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0190.523] GetFileAttributesExW (in: lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), fInfoLevelId=0x0, lpFileInformation=0x125099a8 | out: lpFileInformation=0x125099a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0190.524] CreateFileW (lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0190.524] GetFileAttributesExW (in: lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), fInfoLevelId=0x0, lpFileInformation=0x125099f8 | out: lpFileInformation=0x125099f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0190.524] CreateFileW (lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0190.524] GetFileAttributesExW (in: lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), fInfoLevelId=0x0, lpFileInformation=0x12509a48 | out: lpFileInformation=0x12509a48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0190.524] CreateFileW (lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0190.524] GetFileAttributesExW (in: lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), fInfoLevelId=0x0, lpFileInformation=0x12509a98 | out: lpFileInformation=0x12509a98*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0190.524] CreateFileW (lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0190.524] GetFileAttributesExW (in: lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), fInfoLevelId=0x0, lpFileInformation=0x12509ae8 | out: lpFileInformation=0x12509ae8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0190.524] CreateFileW (lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0190.525] GetFileAttributesExW (in: lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), fInfoLevelId=0x0, lpFileInformation=0x12509b38 | out: lpFileInformation=0x12509b38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0190.525] CreateFileW (lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0190.525] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0x124f72b0, nSize=0x64 | out: lpBuffer="") returned 0x63
	[0190.525] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12509b88 | out: lpFileInformation=0x12509b88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0190.525] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x124f7380, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0190.525] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12509bd8 | out: lpFileInformation=0x12509bd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0190.525] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x154
	[0190.525] GetConsoleMode (in: hConsoleHandle=0x154, lpMode=0x12423aa4 | out: lpMode=0x12423aa4) returned 0
	[0190.525] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0190.525] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0190.525] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134
	[0190.526] GetConsoleMode (in: hConsoleHandle=0x134, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0190.526] GetEnvironmentStringsW () returned 0x79e0b0*
	[0190.526] FreeEnvironmentStringsW (penv=0x79e0b0) returned 1
	[0190.526] GetCurrentProcess () returned 0xffffffff
	[0190.526] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x154, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x1251d4e0, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x1251d4e0*=0x130) returned 1
	[0190.526] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x138, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x1251d4e4, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x1251d4e4*=0x13c) returned 1
	[0190.526] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x134, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x1251d4e8, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x1251d4e8*=0x140) returned 1
	[0190.527] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c \"taskkill /f /im winword.exe \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x400, lpEnvironment=0x1255ca80, lpCurrentDirectory=0x0, lpStartupInfo=0x12423acc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x130, hStdOutput=0x13c, hStdError=0x140), lpProcessInformation=0x12423aa8 | out: lpCommandLine="cmd.exe /c \"taskkill /f /im winword.exe \"", lpProcessInformation=0x12423aa8*(hProcess=0x150, hThread=0x144, dwProcessId=0x514, dwThreadId=0xec0)) returned 1
	[0190.623] CloseHandle (hObject=0x144) returned 1
	[0190.624] CloseHandle (hObject=0x140) returned 1
	[0190.624] CloseHandle (hObject=0x13c) returned 1
	[0190.624] CloseHandle (hObject=0x130) returned 1
	[0190.624] CloseHandle (hObject=0x154) returned 1
	[0190.624] CloseHandle (hObject=0x138) returned 1
	[0190.624] CloseHandle (hObject=0x134) returned 1
	[0190.624] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0
	[0191.765] SetEvent (hEvent=0x168) returned 1
	[0191.765] GetExitCodeProcess (in: hProcess=0x150, lpExitCode=0x12423bdc | out: lpExitCode=0x12423bdc*=0x80) returned 1
	[0191.765] GetProcessTimes (in: hProcess=0x150, lpCreationTime=0x125313e0, lpExitTime=0x125313e8, lpKernelTime=0x125313f0, lpUserTime=0x125313f8 | out: lpCreationTime=0x125313e0, lpExitTime=0x125313e8, lpKernelTime=0x125313f0, lpUserTime=0x125313f8) returned 1
	[0191.765] CloseHandle (hObject=0x150) returned 1
	[0191.765] SetEvent (hEvent=0x124) returned 1
	[0191.765] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x5) returned 0x102
	[0191.773] SetEvent (hEvent=0x168) returned 1
	[0191.773] SetEvent (hEvent=0x124) returned 1
	[0191.773] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x124f7450, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0191.773] GetFileAttributesExW (in: lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12509c28 | out: lpFileInformation=0x12509c28*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0191.773] CreateFileW (lpFileName="cmd.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0191.774] GetFileAttributesExW (in: lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), fInfoLevelId=0x0, lpFileInformation=0x12509c78 | out: lpFileInformation=0x12509c78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0191.774] CreateFileW (lpFileName="cmd.exe.com" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.com"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0191.774] GetFileAttributesExW (in: lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), fInfoLevelId=0x0, lpFileInformation=0x12509cc8 | out: lpFileInformation=0x12509cc8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0191.774] CreateFileW (lpFileName="cmd.exe.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.exe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0191.774] GetFileAttributesExW (in: lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), fInfoLevelId=0x0, lpFileInformation=0x12509d18 | out: lpFileInformation=0x12509d18*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0191.774] CreateFileW (lpFileName="cmd.exe.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.bat"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0191.774] GetFileAttributesExW (in: lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), fInfoLevelId=0x0, lpFileInformation=0x12509d68 | out: lpFileInformation=0x12509d68*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0191.774] CreateFileW (lpFileName="cmd.exe.cmd" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.cmd"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0191.774] GetFileAttributesExW (in: lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), fInfoLevelId=0x0, lpFileInformation=0x12509db8 | out: lpFileInformation=0x12509db8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0191.774] CreateFileW (lpFileName="cmd.exe.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbs"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0191.775] GetFileAttributesExW (in: lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), fInfoLevelId=0x0, lpFileInformation=0x12509e08 | out: lpFileInformation=0x12509e08*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0191.775] CreateFileW (lpFileName="cmd.exe.vbe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.vbe"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0191.775] GetFileAttributesExW (in: lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), fInfoLevelId=0x0, lpFileInformation=0x12509e58 | out: lpFileInformation=0x12509e58*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0191.775] CreateFileW (lpFileName="cmd.exe.js" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.js"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0191.775] GetFileAttributesExW (in: lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), fInfoLevelId=0x0, lpFileInformation=0x12509ea8 | out: lpFileInformation=0x12509ea8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0191.775] CreateFileW (lpFileName="cmd.exe.jse" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.jse"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0191.775] GetFileAttributesExW (in: lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), fInfoLevelId=0x0, lpFileInformation=0x12509ef8 | out: lpFileInformation=0x12509ef8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0191.775] CreateFileW (lpFileName="cmd.exe.wsf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsf"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0191.775] GetFileAttributesExW (in: lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), fInfoLevelId=0x0, lpFileInformation=0x12509f48 | out: lpFileInformation=0x12509f48*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0191.775] CreateFileW (lpFileName="cmd.exe.wsh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.wsh"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0191.776] GetFileAttributesExW (in: lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), fInfoLevelId=0x0, lpFileInformation=0x12509f98 | out: lpFileInformation=0x12509f98*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0191.776] CreateFileW (lpFileName="cmd.exe.msc" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cmd.exe.msc"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0191.776] GetEnvironmentVariableW (in: lpName="path", lpBuffer=0x124f7520, nSize=0x64 | out: lpBuffer="") returned 0x63
	[0191.776] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12562008 | out: lpFileInformation=0x12562008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0191.776] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x124f75f0, nSize=0x64 | out: lpBuffer="") returned 0x35
	[0191.776] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x12562058 | out: lpFileInformation=0x12562058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa5d0fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2aa5d0fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2aa5d0fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31600)) returned 1
	[0191.776] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x150
	[0191.776] GetConsoleMode (in: hConsoleHandle=0x150, lpMode=0x12423aa4 | out: lpMode=0x12423aa4) returned 0
	[0191.776] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x134
	[0191.776] GetConsoleMode (in: hConsoleHandle=0x134, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0191.776] CreateFileW (lpFileName="NUL" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0191.777] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12423aa8 | out: lpMode=0x12423aa8) returned 0
	[0191.777] GetEnvironmentStringsW () returned 0x79e0b0*
	[0191.777] FreeEnvironmentStringsW (penv=0x79e0b0) returned 1
	[0191.777] GetCurrentProcess () returned 0xffffffff
	[0191.777] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x150, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x1251d900, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x1251d900*=0x154) returned 1
	[0191.777] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x134, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x1251d904, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x1251d904*=0x130) returned 1
	[0191.777] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x138, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x1251d908, dwDesiredAccess=0x0, bInheritHandle=1, dwOptions=0x2 | out: lpTargetHandle=0x1251d908*=0x13c) returned 1
	[0191.777] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c \"taskkill /f /im wordpad.exe\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x400, lpEnvironment=0x1255d500, lpCurrentDirectory=0x0, lpStartupInfo=0x12423acc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x154, hStdOutput=0x130, hStdError=0x13c), lpProcessInformation=0x12423aa8 | out: lpCommandLine="cmd.exe /c \"taskkill /f /im wordpad.exe\"", lpProcessInformation=0x12423aa8*(hProcess=0x144, hThread=0x140, dwProcessId=0xe50, dwThreadId=0xd88)) returned 1
	[0191.806] CloseHandle (hObject=0x140) returned 1
	[0191.806] CloseHandle (hObject=0x13c) returned 1
	[0191.806] CloseHandle (hObject=0x130) returned 1
	[0191.806] CloseHandle (hObject=0x154) returned 1
	[0191.806] CloseHandle (hObject=0x150) returned 1
	[0191.807] CloseHandle (hObject=0x134) returned 1
	[0191.807] CloseHandle (hObject=0x138) returned 1
	[0191.807] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0
	[0193.344] SetEvent (hEvent=0x168) returned 1
	[0193.344] GetExitCodeProcess (in: hProcess=0x144, lpExitCode=0x12423bdc | out: lpExitCode=0x12423bdc*=0x80) returned 1
	[0193.344] GetProcessTimes (in: hProcess=0x144, lpCreationTime=0x12560820, lpExitTime=0x12560828, lpKernelTime=0x12560830, lpUserTime=0x12560838 | out: lpCreationTime=0x12560820, lpExitTime=0x12560828, lpKernelTime=0x12560830, lpUserTime=0x12560838) returned 1
	[0193.344] CloseHandle (hObject=0x144) returned 1
	[0193.345] SetEvent (hEvent=0x124) returned 1
	[0193.345] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x5) returned 0x102
	[0193.398] SetEvent (hEvent=0x124) returned 1
	[0193.398] GetEnvironmentVariableW (in: lpName="HOMEDRIVE", lpBuffer=0x1250cd00, nSize=0x64 | out: lpBuffer="") returned 0x2
	[0193.398] GetEnvironmentVariableW (in: lpName="HOMEPATH", lpBuffer=0x1250cdd0, nSize=0x64 | out: lpBuffer="") returned 0x13
	[0193.398] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\windows" (normalized: "c:\\users\\rdhj0cnfevzx\\windows"), fInfoLevelId=0x0, lpFileInformation=0x1252cf08 | out: lpFileInformation=0x1252cf08*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0193.399] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\windows" (normalized: "c:\\users\\rdhj0cnfevzx\\windows"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2000000, hTemplateFile=0x0) returned 0xffffffff
	[0193.400] GetProcAddress (hModule=0x75600000, lpProcName="WriteConsoleW") returned 0x75627020
	[0193.400] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x125314a0*, nNumberOfCharsToWrite=0xa, lpNumberOfCharsWritten=0x124239d4, lpReserved=0x0 | out: lpBuffer=0x125314a0*, lpNumberOfCharsWritten=0x124239d4*=0xa) returned 1
	[0193.406] LoadLibraryExW (lpLibFileName="advapi32.dll", hFile=0x0, dwFlags=0x800) returned 0x74650000
	[0193.411] GetProcAddress (hModule=0x74650000, lpProcName="CryptAcquireContextW") returned 0x74670590
	[0193.411] CryptAcquireContextW (in: phProv=0x12412070, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x12412070*=0x78dbd8) returned 1
	[0193.796] GetProcAddress (hModule=0x74650000, lpProcName="CryptGenRandom") returned 0x746710a0
	[0193.796] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.799] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.819] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.820] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.822] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.824] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.825] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.827] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.828] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.830] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.832] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.834] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.835] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.837] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.839] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.841] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.845] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.846] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.847] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.848] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.850] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.851] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.852] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.854] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.855] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.856] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.857] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.858] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.860] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.861] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.862] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.863] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.864] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.865] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.866] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.867] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.867] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.868] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.869] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.870] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.871] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.872] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.873] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.874] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.874] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.875] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.876] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.877] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.878] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.880] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.880] VirtualAlloc (lpAddress=0x125c0000, dwSize=0x100000, flAllocationType=0x1000, flProtect=0x4) returned 0x125c0000
	[0193.883] VirtualAlloc (lpAddress=0x11154000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x11154000
	[0193.885] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.886] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x1250bdc0 | out: pbBuffer=0x1250bdc0) returned 1
	[0193.908] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.909] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.909] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.910] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.911] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.912] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.925] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.926] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.927] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.928] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.929] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.930] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.931] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.932] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.933] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.934] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.935] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.935] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.937] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.938] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.939] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.939] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.940] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.941] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.942] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.943] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.944] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.944] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.945] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.946] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.947] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.948] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.949] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.950] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.950] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.951] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.952] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.953] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.954] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.955] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.956] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.957] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.957] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.958] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.959] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.960] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.961] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.962] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.963] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.963] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.964] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.965] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.966] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x40, pbBuffer=0x12553d80 | out: pbBuffer=0x12553d80) returned 1
	[0193.985] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x35, pbBuffer=0x1244f502 | out: pbBuffer=0x1244f502) returned 1
	[0193.985] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x35, pbBuffer=0x1244f802 | out: pbBuffer=0x1244f802) returned 1
	[0193.986] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x35, pbBuffer=0x1244fb02 | out: pbBuffer=0x1244fb02) returned 1
	[0193.986] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x1, pbBuffer=0x1244fb2a | out: pbBuffer=0x1244fb2a) returned 1
	[0193.987] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x35, pbBuffer=0x1244fe02 | out: pbBuffer=0x1244fe02) returned 1
	[0193.987] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0xa6, pbBuffer=0x1266a102 | out: pbBuffer=0x1266a102) returned 1
	[0193.987] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x1, pbBuffer=0x1266a13f | out: pbBuffer=0x1266a13f) returned 1
	[0193.987] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x1, pbBuffer=0x1266a15d | out: pbBuffer=0x1266a15d) returned 1
	[0193.989] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12694000*, nNumberOfCharsToWrite=0x6b6, lpNumberOfCharsWritten=0x124239d4, lpReserved=0x0 | out: lpBuffer=0x12694000*, lpNumberOfCharsWritten=0x124239d4*=0x6b6) returned 1
	[0193.999] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\windows" (normalized: "c:\\users\\rdhj0cnfevzx\\windows"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0194.000] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12423e18 | out: lpMode=0x12423e18) returned 0
	[0194.001] GetProcAddress (hModule=0x75600000, lpProcName="WriteFile") returned 0x75626ca0
	[0194.001] WriteFile (in: hFile=0x138, lpBuffer=0x1266fc00*, nNumberOfBytesToWrite=0x6ac, lpNumberOfBytesWritten=0x12423e08, lpOverlapped=0x0 | out: lpBuffer=0x1266fc00*, lpNumberOfBytesWritten=0x12423e08*=0x6ac, lpOverlapped=0x0) returned 1
	[0194.002] CloseHandle (hObject=0x138) returned 1
	[0194.246] SetEvent (hEvent=0x168) returned 1
	[0194.246] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x125f9da0*, nNumberOfCharsToWrite=0x2c, lpNumberOfCharsWritten=0x12423998, lpReserved=0x0 | out: lpBuffer=0x125f9da0*, lpNumberOfCharsWritten=0x12423998*=0x2c) returned 1
	[0194.344] GetFileAttributesExW (in: lpFileName="A:\\" (normalized: "a:"), fInfoLevelId=0x0, lpFileInformation=0x125622d8 | out: lpFileInformation=0x125622d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0194.352] GetFileAttributesExW (in: lpFileName="B:\\" (normalized: "b:"), fInfoLevelId=0x0, lpFileInformation=0x12562328 | out: lpFileInformation=0x12562328*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
	[0194.353] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x12562378 | out: lpFileInformation=0x12562378*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x31b3b9e4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xe5d39a84, ftLastAccessTime.dwHighDateTime=0x1d7e768, ftLastWriteTime.dwLowDateTime=0xe5d39a84, ftLastWriteTime.dwHighDateTime=0x1d7e768, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0194.353] CreateFileW (lpFileName="C:\\" (normalized: "c:"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0194.354] GetProcAddress (hModule=0x75600000, lpProcName="FindFirstFileW") returned 0x75626960
	[0194.354] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x12423aa8 | out: lpFindFileData=0x12423aa8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbaec25, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xbaec25, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x79fc68
	[0194.354] GetProcAddress (hModule=0x75600000, lpProcName="FindNextFileW") returned 0x756269a0
	[0194.354] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423ac8 | out: lpFindFileData=0x12423ac8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x7898476d, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b27f82, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1
	[0194.355] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423ac8 | out: lpFindFileData=0x12423ac8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x61b64, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1
	[0194.355] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423ac8 | out: lpFindFileData=0x12423ac8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTNXT", cAlternateFileName="")) returned 1
	[0194.355] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423ac8 | out: lpFindFileData=0x12423ac8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x78d17e5a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78d17e5a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78d17e5a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1
	[0194.355] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423ac8 | out: lpFindFileData=0x12423ac8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1
	[0194.355] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423ac8 | out: lpFindFileData=0x12423ac8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x551dbbfd, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x551dbbfd, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0xa8d4eb26, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1
	[0194.355] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423ac8 | out: lpFindFileData=0x12423ac8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x85890a37, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x85890a37, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xa99bf471, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x48000000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1
	[0194.355] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423ac8 | out: lpFindFileData=0x12423ac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbaec25, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xbaec25, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1
	[0194.355] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423ac8 | out: lpFindFileData=0x12423ac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x9690c3b, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x9690c3b, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1
	[0194.355] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423ac8 | out: lpFindFileData=0x12423ac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x1b83b055, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1b83b055, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1
	[0194.355] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423ac8 | out: lpFindFileData=0x12423ac8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x387f5bb4, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x387f5bb4, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1
	[0194.355] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423ac8 | out: lpFindFileData=0x12423ac8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbaa998b0, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbadba904, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbadba904, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1
	[0194.355] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423ac8 | out: lpFindFileData=0x12423ac8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x858b6c65, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x858b6c65, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xa99bf471, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x10000000, dwReserved0=0x0, dwReserved1=0x0, cFileName="swapfile.sys", cAlternateFileName="")) returned 1
	[0194.355] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423ac8 | out: lpFindFileData=0x12423ac8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x85289733, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x2dbfc137, ftLastAccessTime.dwHighDateTime=0x1d70505, ftLastWriteTime.dwLowDateTime=0x2dbfc137, ftLastWriteTime.dwHighDateTime=0x1d70505, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1
	[0194.355] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423ac8 | out: lpFindFileData=0x12423ac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1
	[0194.355] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423ac8 | out: lpFindFileData=0x12423ac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xd9a60a69, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xd9a60a69, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0194.355] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423ac8 | out: lpFindFileData=0x12423ac8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0194.356] GetProcAddress (hModule=0x75600000, lpProcName="FindClose") returned 0x756268e0
	[0194.356] FindClose (in: hFindFile=0x79fc68 | out: hFindFile=0x79fc68) returned 1
	[0194.356] CreateFileW (lpFileName="C:\\README.html" (normalized: "c:\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0194.394] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12422ec0 | out: lpMode=0x12422ec0) returned 0
	[0194.394] WriteFile (in: hFile=0x138, lpBuffer=0x12696880*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422eb0, lpOverlapped=0x0 | out: lpBuffer=0x12696880*, lpNumberOfBytesWritten=0x12422eb0*=0xc85, lpOverlapped=0x0) returned 1
	[0194.401] CloseHandle (hObject=0x138) returned 1
	[0194.402] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x125e5300*, nNumberOfCharsToWrite=0x1d, lpNumberOfCharsWritten=0x12422a40, lpReserved=0x0 | out: lpBuffer=0x125e5300*, lpNumberOfCharsWritten=0x12422a40*=0x1d) returned 1
	[0194.404] GetFileAttributesExW (in: lpFileName="C:\\$Recycle.Bin" (normalized: "c:\\$recycle.bin"), fInfoLevelId=0x0, lpFileInformation=0x12562918 | out: lpFileInformation=0x12562918*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x77b1180e, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x77b1180e, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0194.405] CreateFileW (lpFileName="C:\\$Recycle.Bin" (normalized: "c:\\$recycle.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0194.405] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x12423a44 | out: lpFindFileData=0x12423a44*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x77b1180e, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x77b1180e, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9e8
	[0194.405] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x77b1180e, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x77b1180e, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0194.406] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x77b1180e, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x77b1180e, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x77b1180e, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 1
	[0194.406] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x913b261b, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x913b261b, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x913b261b, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0194.406] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0194.406] FindClose (in: hFindFile=0x79f9e8 | out: hFindFile=0x79f9e8) returned 1
	[0194.406] GetFileAttributesExW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18" (normalized: "c:\\$recycle.bin\\s-1-5-18"), fInfoLevelId=0x0, lpFileInformation=0x12562a08 | out: lpFileInformation=0x12562a08*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x77b1180e, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x77b1180e, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x77b1180e, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0194.406] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18" (normalized: "c:\\$recycle.bin\\s-1-5-18"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0194.407] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x77b1180e, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x77b1180e, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x77b1180e, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffe8
	[0194.407] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x77b1180e, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x77b1180e, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x77b1180e, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0194.407] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x77b1180e, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x77b1180e, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x77b1180e, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0194.407] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0194.407] FindClose (in: hFindFile=0x79ffe8 | out: hFindFile=0x79ffe8) returned 1
	[0194.407] GetFileAttributesExW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x12562aa8 | out: lpFileInformation=0x12562aa8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x77b1180e, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x77b1180e, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x77b1180e, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x81)) returned 1
	[0194.408] GetFileAttributesExW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000" (normalized: "c:\\$recycle.bin\\s-1-5-21-1560258661-3990802383-1811730007-1000"), fInfoLevelId=0x0, lpFileInformation=0x12562af8 | out: lpFileInformation=0x12562af8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x913b261b, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x913b261b, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x913b261b, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0194.408] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000" (normalized: "c:\\$recycle.bin\\s-1-5-21-1560258661-3990802383-1811730007-1000"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0194.408] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x913b261b, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x913b261b, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x913b261b, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fda8
	[0194.408] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x913b261b, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x913b261b, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x913b261b, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0194.408] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x913b261b, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x913b261b, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x913b261b, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0194.408] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0194.408] FindClose (in: hFindFile=0x79fda8 | out: hFindFile=0x79fda8) returned 1
	[0194.409] GetFileAttributesExW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1560258661-3990802383-1811730007-1000\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x12562b98 | out: lpFileInformation=0x12562b98*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x913b261b, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x913b261b, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x913b261b, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x81)) returned 1
	[0194.409] GetFileAttributesExW (in: lpFileName="C:\\BOOTNXT" (normalized: "c:\\bootnxt"), fInfoLevelId=0x0, lpFileInformation=0x12562be8 | out: lpFileInformation=0x12562be8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1)) returned 1
	[0194.410] GetFileAttributesExW (in: lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), fInfoLevelId=0x0, lpFileInformation=0x12562c38 | out: lpFileInformation=0x12562c38*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x78d17e5a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78d17e5a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78d17e5a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0194.417] GetFileAttributesExW (in: lpFileName="C:\\Boot" (normalized: "c:\\boot"), fInfoLevelId=0x0, lpFileInformation=0x12562c88 | out: lpFileInformation=0x12562c88*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x7898476d, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b74525, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b74525, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0194.417] CreateFileW (lpFileName="C:\\Boot" (normalized: "c:\\boot"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0194.417] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x12423a44 | out: lpFindFileData=0x12423a44*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x7898476d, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b74525, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b74525, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffa8
	[0194.417] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x7898476d, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b74525, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b74525, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0194.422] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b74525, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x6cefb557, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0x6cefb557, ftLastWriteTime.dwHighDateTime=0x1d82a22, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1
	[0194.422] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x78b74525, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b74525, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b74525, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1
	[0194.422] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x78b74525, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b74525, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b74525, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1
	[0194.422] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x78b74525, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b74525, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b74525, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1
	[0194.422] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7898476d, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x7898476d, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x7898476d, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1
	[0194.422] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78ab5a49, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1
	[0194.422] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x17f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1
	[0194.422] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789aa98c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1
	[0194.423] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789aa98c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0194.423] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789aa98c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0194.423] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0194.423] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1
	[0194.423] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0194.423] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0194.423] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1
	[0194.423] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1
	[0194.423] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0194.423] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b27f82, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1
	[0194.423] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CA", cAlternateFileName="")) returned 1
	[0194.423] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0194.423] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1
	[0194.423] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0194.423] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1
	[0194.423] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0194.423] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0194.424] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1
	[0194.424] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1
	[0194.424] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc2960, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1
	[0194.424] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1
	[0194.424] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0194.424] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0194.424] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0194.424] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0194.424] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qps-ploc", cAlternateFileName="")) returned 1
	[0194.424] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78b27f82, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b27f82, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1
	[0194.424] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1
	[0194.424] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1
	[0194.424] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1
	[0194.424] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1
	[0194.424] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1
	[0194.424] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1
	[0194.424] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1
	[0194.424] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1
	[0194.427] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1
	[0194.427] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a8f7b9, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a8f7b9, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1
	[0194.427] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a8f7b9, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78ab5a49, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1
	[0194.427] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78ab5a49, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1
	[0194.427] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0194.427] FindClose (in: hFindFile=0x79ffa8 | out: hFindFile=0x79ffa8) returned 1
	[0194.427] GetFileAttributesExW (in: lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), fInfoLevelId=0x0, lpFileInformation=0x12563b88 | out: lpFileInformation=0x12563b88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b74525, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x6cefb557, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0x6cefb557, ftLastWriteTime.dwHighDateTime=0x1d82a22, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1
	[0194.427] GetFileAttributesExW (in: lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), fInfoLevelId=0x0, lpFileInformation=0x12563bd8 | out: lpFileInformation=0x12563bd8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x78b74525, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b74525, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b74525, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x8000)) returned 1
	[0194.428] GetFileAttributesExW (in: lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), fInfoLevelId=0x0, lpFileInformation=0x12563c28 | out: lpFileInformation=0x12563c28*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x78b74525, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b74525, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b74525, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0194.428] GetFileAttributesExW (in: lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), fInfoLevelId=0x0, lpFileInformation=0x12563c78 | out: lpFileInformation=0x12563c78*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x78b74525, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b74525, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b74525, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0194.428] GetFileAttributesExW (in: lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), fInfoLevelId=0x0, lpFileInformation=0x12563cc8 | out: lpFileInformation=0x12563cc8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78ab5a49, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1
	[0194.430] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts" (normalized: "c:\\boot\\fonts"), fInfoLevelId=0x0, lpFileInformation=0x12563d18 | out: lpFileInformation=0x12563d18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b27f82, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0194.460] SetEvent (hEvent=0x168) returned 1
	[0194.460] CreateFileW (lpFileName="C:\\Boot\\Fonts" (normalized: "c:\\boot\\fonts"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0194.460] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b27f82, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffa8
	[0194.466] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b27f82, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0194.466] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x211a0897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1
	[0194.466] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78adba97, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78adba97, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x211ecd4c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1
	[0194.466] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78adba97, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78adba97, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1
	[0194.466] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78adba97, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78adba97, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1
	[0194.466] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b01e78, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b01e78, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x28784, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgunn_boot.ttf", cAlternateFileName="MALGUN~1.TTF")) returned 1
	[0194.466] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b01e78, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b01e78, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x29114, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgun_boot.ttf", cAlternateFileName="MALGUN~2.TTF")) returned 1
	[0194.466] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b01e78, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b01e78, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x20718, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryon_boot.ttf", cAlternateFileName="MEIRYO~1.TTF")) returned 1
	[0194.466] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b01e78, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b01e78, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x20d6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryo_boot.ttf", cAlternateFileName="MEIRYO~2.TTF")) returned 1
	[0194.466] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b01e78, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b01e78, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x211ecd4c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2553c, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjhn_boot.ttf", cAlternateFileName="MSJHN_~1.TTF")) returned 1
	[0194.466] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b01e78, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b01e78, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x211ecd4c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x25d10, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjh_boot.ttf", cAlternateFileName="MSJH_B~1.TTF")) returned 1
	[0194.466] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b01e78, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b01e78, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x211a0897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x22b2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyhn_boot.ttf", cAlternateFileName="MSYHN_~1.TTF")) returned 1
	[0194.466] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b01e78, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b01e78, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x211a0897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x23b34, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyh_boot.ttf", cAlternateFileName="MSYH_B~1.TTF")) returned 1
	[0194.467] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b27f82, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x1ae3c95a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8cb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="segmono_boot.ttf", cAlternateFileName="SEGMON~1.TTF")) returned 1
	[0194.467] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b27f82, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x1ae3c95a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d20, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoen_slboot.ttf", cAlternateFileName="SEGOEN~1.TTF")) returned 1
	[0194.467] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b27f82, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x1ae62bb5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12e5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoe_slboot.ttf", cAlternateFileName="SEGOE_~1.TTF")) returned 1
	[0194.467] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b27f82, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x1ae3c95a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1
	[0194.467] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0194.467] FindClose (in: hFindFile=0x79ffa8 | out: hFindFile=0x79ffa8) returned 1
	[0194.468] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x126ae288 | out: lpFileInformation=0x126ae288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x211a0897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x385e00)) returned 1
	[0194.527] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x126ae2d8 | out: lpFileInformation=0x126ae2d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78adba97, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78adba97, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x211ecd4c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4)) returned 1
	[0194.574] SetEvent (hEvent=0x168) returned 1
	[0194.574] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x126ae328 | out: lpFileInformation=0x126ae328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78adba97, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78adba97, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4)) returned 1
	[0194.627] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x1252cf58 | out: lpFileInformation=0x1252cf58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78adba97, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78adba97, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x242f20)) returned 1
	[0194.755] SetEvent (hEvent=0x168) returned 1
	[0194.755] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x1252cfa8 | out: lpFileInformation=0x1252cfa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b01e78, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b01e78, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x29114)) returned 1
	[0194.759] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x1252cff8 | out: lpFileInformation=0x1252cff8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b01e78, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b01e78, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x28784)) returned 1
	[0194.763] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x1252d048 | out: lpFileInformation=0x1252d048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b01e78, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b01e78, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x20d6c)) returned 1
	[0195.005] SetEvent (hEvent=0x168) returned 1
	[0195.006] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x1252d098 | out: lpFileInformation=0x1252d098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b01e78, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b01e78, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x20718)) returned 1
	[0195.010] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x1252d0e8 | out: lpFileInformation=0x1252d0e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b01e78, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b01e78, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x211ecd4c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x25d10)) returned 1
	[0195.118] SetEvent (hEvent=0x168) returned 1
	[0195.118] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x1252d138 | out: lpFileInformation=0x1252d138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b01e78, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b01e78, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x211ecd4c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2553c)) returned 1
	[0195.125] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x1252d188 | out: lpFileInformation=0x1252d188*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b01e78, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b01e78, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x211a0897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x23b34)) returned 1
	[0195.147] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x126ae378 | out: lpFileInformation=0x126ae378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b01e78, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b01e78, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x211a0897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x22b2c)) returned 1
	[0195.217] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x1252d1d8 | out: lpFileInformation=0x1252d1d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b27f82, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x1ae3c95a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8cb4)) returned 1
	[0195.227] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x1252d228 | out: lpFileInformation=0x1252d228*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b27f82, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x1ae62bb5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12e5c)) returned 1
	[0195.227] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x1252d278 | out: lpFileInformation=0x1252d278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b27f82, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x1ae3c95a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d20)) returned 1
	[0195.228] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x1252d2c8 | out: lpFileInformation=0x1252d2c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b27f82, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x1ae3c95a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb95c)) returned 1
	[0195.230] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Resources" (normalized: "c:\\boot\\resources"), fInfoLevelId=0x0, lpFileInformation=0x1252d318 | out: lpFileInformation=0x1252d318*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78b27f82, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b27f82, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.232] CreateFileW (lpFileName="C:\\Boot\\Resources" (normalized: "c:\\boot\\resources"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.232] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78b27f82, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b27f82, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0068
	[0195.233] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78b27f82, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b27f82, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.233] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b27f82, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootres.dll", cAlternateFileName="")) returned 1
	[0195.233] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78b27f82, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b27f82, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0195.233] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.233] FindClose (in: hFindFile=0x7a0068 | out: hFindFile=0x7a0068) returned 1
	[0195.233] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll"), fInfoLevelId=0x0, lpFileInformation=0x1252d408 | out: lpFileInformation=0x1252d408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b27f82, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4b60)) returned 1
	[0195.234] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Resources\\en-US" (normalized: "c:\\boot\\resources\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x1252d458 | out: lpFileInformation=0x1252d458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78b27f82, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b27f82, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.234] CreateFileW (lpFileName="C:\\Boot\\Resources\\en-US" (normalized: "c:\\boot\\resources\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.234] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\en-US\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78b27f82, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b27f82, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fd68
	[0195.234] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78b27f82, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b27f82, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.235] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b27f82, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x9ea99bcf, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x3160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 1
	[0195.235] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.235] FindClose (in: hFindFile=0x79fd68 | out: hFindFile=0x79fd68) returned 1
	[0195.235] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1252d4f8 | out: lpFileInformation=0x1252d4f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b27f82, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x9ea99bcf, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x3160)) returned 1
	[0195.235] GetFileAttributesExW (in: lpFileName="C:\\Boot\\bg-BG" (normalized: "c:\\boot\\bg-bg"), fInfoLevelId=0x0, lpFileInformation=0x1252d548 | out: lpFileInformation=0x1252d548*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7898476d, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x7898476d, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x7898476d, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.235] CreateFileW (lpFileName="C:\\Boot\\bg-BG" (normalized: "c:\\boot\\bg-bg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.235] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7898476d, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x7898476d, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x7898476d, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fa28
	[0195.236] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7898476d, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x7898476d, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x7898476d, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.236] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7898476d, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x7898476d, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0195.236] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.236] FindClose (in: hFindFile=0x79fa28 | out: hFindFile=0x79fa28) returned 1
	[0195.236] GetFileAttributesExW (in: lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1252d5e8 | out: lpFileInformation=0x1252d5e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7898476d, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x7898476d, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60)) returned 1
	[0195.237] GetFileAttributesExW (in: lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), fInfoLevelId=0x0, lpFileInformation=0x1252d638 | out: lpFileInformation=0x1252d638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x17f60)) returned 1
	[0195.237] GetFileAttributesExW (in: lpFileName="C:\\Boot\\cs-CZ" (normalized: "c:\\boot\\cs-cz"), fInfoLevelId=0x0, lpFileInformation=0x1252d688 | out: lpFileInformation=0x1252d688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789aa98c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.237] CreateFileW (lpFileName="C:\\Boot\\cs-CZ" (normalized: "c:\\boot\\cs-cz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.237] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789aa98c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ff68
	[0195.237] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789aa98c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.237] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0195.237] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb160, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0195.238] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.238] FindClose (in: hFindFile=0x79ff68 | out: hFindFile=0x79ff68) returned 1
	[0195.238] GetFileAttributesExW (in: lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1252d778 | out: lpFileInformation=0x1252d778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58)) returned 1
	[0195.241] GetFileAttributesExW (in: lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1252d7c8 | out: lpFileInformation=0x1252d7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb160)) returned 1
	[0195.241] GetFileAttributesExW (in: lpFileName="C:\\Boot\\da-DK" (normalized: "c:\\boot\\da-dk"), fInfoLevelId=0x0, lpFileInformation=0x1252d818 | out: lpFileInformation=0x1252d818*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789aa98c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.242] CreateFileW (lpFileName="C:\\Boot\\da-DK" (normalized: "c:\\boot\\da-dk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.242] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789aa98c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ff28
	[0195.242] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789aa98c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.242] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0195.242] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb160, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0195.242] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.242] FindClose (in: hFindFile=0x79ff28 | out: hFindFile=0x79ff28) returned 1
	[0195.243] GetFileAttributesExW (in: lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1252d908 | out: lpFileInformation=0x1252d908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760)) returned 1
	[0195.243] GetFileAttributesExW (in: lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1252d958 | out: lpFileInformation=0x1252d958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb160)) returned 1
	[0195.245] GetFileAttributesExW (in: lpFileName="C:\\Boot\\de-DE" (normalized: "c:\\boot\\de-de"), fInfoLevelId=0x0, lpFileInformation=0x1252d9a8 | out: lpFileInformation=0x1252d9a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789aa98c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.246] CreateFileW (lpFileName="C:\\Boot\\de-DE" (normalized: "c:\\boot\\de-de"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.246] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789aa98c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f968
	[0195.246] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789aa98c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.246] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0195.246] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb358, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0195.246] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.247] FindClose (in: hFindFile=0x79f968 | out: hFindFile=0x79f968) returned 1
	[0195.247] GetFileAttributesExW (in: lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1252da98 | out: lpFileInformation=0x1252da98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560)) returned 1
	[0195.247] GetFileAttributesExW (in: lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1252dae8 | out: lpFileInformation=0x1252dae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb358)) returned 1
	[0195.247] GetFileAttributesExW (in: lpFileName="C:\\Boot\\el-GR" (normalized: "c:\\boot\\el-gr"), fInfoLevelId=0x0, lpFileInformation=0x1252db38 | out: lpFileInformation=0x1252db38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.248] CreateFileW (lpFileName="C:\\Boot\\el-GR" (normalized: "c:\\boot\\el-gr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.248] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fee8
	[0195.248] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.248] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0195.248] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb560, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0195.249] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.249] FindClose (in: hFindFile=0x79fee8 | out: hFindFile=0x79fee8) returned 1
	[0195.249] GetFileAttributesExW (in: lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1252dc28 | out: lpFileInformation=0x1252dc28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960)) returned 1
	[0195.249] GetFileAttributesExW (in: lpFileName="C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1252dc78 | out: lpFileInformation=0x1252dc78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb560)) returned 1
	[0195.249] GetFileAttributesExW (in: lpFileName="C:\\Boot\\en-GB" (normalized: "c:\\boot\\en-gb"), fInfoLevelId=0x0, lpFileInformation=0x1252dcc8 | out: lpFileInformation=0x1252dcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.253] CreateFileW (lpFileName="C:\\Boot\\en-GB" (normalized: "c:\\boot\\en-gb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.253] FindFirstFileW (in: lpFileName="C:\\Boot\\en-GB\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffe8
	[0195.253] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.254] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0195.254] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.254] FindClose (in: hFindFile=0x79ffe8 | out: hFindFile=0x79ffe8) returned 1
	[0195.254] GetFileAttributesExW (in: lpFileName="C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1252dd68 | out: lpFileInformation=0x1252dd68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158)) returned 1
	[0195.273] GetFileAttributesExW (in: lpFileName="C:\\Boot\\en-US" (normalized: "c:\\boot\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x1252ddb8 | out: lpFileInformation=0x1252ddb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.273] CreateFileW (lpFileName="C:\\Boot\\en-US" (normalized: "c:\\boot\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.273] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f928
	[0195.273] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.273] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0195.273] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0195.273] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.273] FindClose (in: hFindFile=0x79f928 | out: hFindFile=0x79f928) returned 1
	[0195.274] GetFileAttributesExW (in: lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1252dea8 | out: lpFileInformation=0x1252dea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12160)) returned 1
	[0195.274] GetFileAttributesExW (in: lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1252def8 | out: lpFileInformation=0x1252def8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaf58)) returned 1
	[0195.274] GetFileAttributesExW (in: lpFileName="C:\\Boot\\es-ES" (normalized: "c:\\boot\\es-es"), fInfoLevelId=0x0, lpFileInformation=0x1252df48 | out: lpFileInformation=0x1252df48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.278] CreateFileW (lpFileName="C:\\Boot\\es-ES" (normalized: "c:\\boot\\es-es"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.279] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79faa8
	[0195.279] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.279] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0195.279] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb358, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0195.279] VirtualAlloc (lpAddress=0x126c0000, dwSize=0x100000, flAllocationType=0x1000, flProtect=0x4) returned 0x126c0000
	[0195.283] VirtualAlloc (lpAddress=0x11144000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x11144000
	[0195.283] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.284] FindClose (in: hFindFile=0x79faa8 | out: hFindFile=0x79faa8) returned 1
	[0195.284] GetFileAttributesExW (in: lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126c0058 | out: lpFileInformation=0x126c0058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60)) returned 1
	[0195.284] GetFileAttributesExW (in: lpFileName="C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126c00a8 | out: lpFileInformation=0x126c00a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb358)) returned 1
	[0195.286] GetFileAttributesExW (in: lpFileName="C:\\Boot\\es-MX" (normalized: "c:\\boot\\es-mx"), fInfoLevelId=0x0, lpFileInformation=0x126c00f8 | out: lpFileInformation=0x126c00f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.286] CreateFileW (lpFileName="C:\\Boot\\es-MX" (normalized: "c:\\boot\\es-mx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.286] FindFirstFileW (in: lpFileName="C:\\Boot\\es-MX\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0068
	[0195.286] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.286] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0195.286] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.287] FindClose (in: hFindFile=0x7a0068 | out: hFindFile=0x7a0068) returned 1
	[0195.287] GetFileAttributesExW (in: lpFileName="C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126c0198 | out: lpFileInformation=0x126c0198*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60)) returned 1
	[0195.291] GetFileAttributesExW (in: lpFileName="C:\\Boot\\et-EE" (normalized: "c:\\boot\\et-ee"), fInfoLevelId=0x0, lpFileInformation=0x126c01e8 | out: lpFileInformation=0x126c01e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.291] CreateFileW (lpFileName="C:\\Boot\\et-EE" (normalized: "c:\\boot\\et-ee"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.291] FindFirstFileW (in: lpFileName="C:\\Boot\\et-EE\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffa8
	[0195.291] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.291] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0195.291] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.291] FindClose (in: hFindFile=0x79ffa8 | out: hFindFile=0x79ffa8) returned 1
	[0195.291] GetFileAttributesExW (in: lpFileName="C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126c0288 | out: lpFileInformation=0x126c0288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560)) returned 1
	[0195.292] GetFileAttributesExW (in: lpFileName="C:\\Boot\\fi-FI" (normalized: "c:\\boot\\fi-fi"), fInfoLevelId=0x0, lpFileInformation=0x126c02d8 | out: lpFileInformation=0x126c02d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.292] CreateFileW (lpFileName="C:\\Boot\\fi-FI" (normalized: "c:\\boot\\fi-fi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.292] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fd68
	[0195.292] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.292] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0195.293] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb158, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0195.293] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.293] FindClose (in: hFindFile=0x79fd68 | out: hFindFile=0x79fd68) returned 1
	[0195.293] GetFileAttributesExW (in: lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126c03c8 | out: lpFileInformation=0x126c03c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60)) returned 1
	[0195.295] GetFileAttributesExW (in: lpFileName="C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126c0418 | out: lpFileInformation=0x126c0418*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb158)) returned 1
	[0195.295] GetFileAttributesExW (in: lpFileName="C:\\Boot\\fr-CA" (normalized: "c:\\boot\\fr-ca"), fInfoLevelId=0x0, lpFileInformation=0x126c0468 | out: lpFileInformation=0x126c0468*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.295] CreateFileW (lpFileName="C:\\Boot\\fr-CA" (normalized: "c:\\boot\\fr-ca"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.296] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-CA\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fa68
	[0195.296] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.296] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0195.296] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.296] FindClose (in: hFindFile=0x79fa68 | out: hFindFile=0x79fa68) returned 1
	[0195.296] GetFileAttributesExW (in: lpFileName="C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126c0508 | out: lpFileInformation=0x126c0508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560)) returned 1
	[0195.297] GetFileAttributesExW (in: lpFileName="C:\\Boot\\fr-FR" (normalized: "c:\\boot\\fr-fr"), fInfoLevelId=0x0, lpFileInformation=0x126c0558 | out: lpFileInformation=0x126c0558*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.299] CreateFileW (lpFileName="C:\\Boot\\fr-FR" (normalized: "c:\\boot\\fr-fr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.299] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fee8
	[0195.299] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.299] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0195.299] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0195.299] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.300] FindClose (in: hFindFile=0x79fee8 | out: hFindFile=0x79fee8) returned 1
	[0195.300] GetFileAttributesExW (in: lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126c0648 | out: lpFileInformation=0x126c0648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13558)) returned 1
	[0195.300] GetFileAttributesExW (in: lpFileName="C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126c0698 | out: lpFileInformation=0x126c0698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb360)) returned 1
	[0195.300] GetFileAttributesExW (in: lpFileName="C:\\Boot\\hr-HR" (normalized: "c:\\boot\\hr-hr"), fInfoLevelId=0x0, lpFileInformation=0x126c06e8 | out: lpFileInformation=0x126c06e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.300] CreateFileW (lpFileName="C:\\Boot\\hr-HR" (normalized: "c:\\boot\\hr-hr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.300] FindFirstFileW (in: lpFileName="C:\\Boot\\hr-HR\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9a8
	[0195.301] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.301] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0195.301] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.301] FindClose (in: hFindFile=0x79f9a8 | out: hFindFile=0x79f9a8) returned 1
	[0195.301] GetFileAttributesExW (in: lpFileName="C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126c0788 | out: lpFileInformation=0x126c0788*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60)) returned 1
	[0195.305] GetFileAttributesExW (in: lpFileName="C:\\Boot\\hu-HU" (normalized: "c:\\boot\\hu-hu"), fInfoLevelId=0x0, lpFileInformation=0x126c07d8 | out: lpFileInformation=0x126c07d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.306] CreateFileW (lpFileName="C:\\Boot\\hu-HU" (normalized: "c:\\boot\\hu-hu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.306] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0028
	[0195.306] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.306] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13360, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0195.306] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0195.306] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.307] FindClose (in: hFindFile=0x7a0028 | out: hFindFile=0x7a0028) returned 1
	[0195.307] GetFileAttributesExW (in: lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126c08c8 | out: lpFileInformation=0x126c08c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13360)) returned 1
	[0195.307] GetFileAttributesExW (in: lpFileName="C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126c0918 | out: lpFileInformation=0x126c0918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb360)) returned 1
	[0195.307] GetFileAttributesExW (in: lpFileName="C:\\Boot\\it-IT" (normalized: "c:\\boot\\it-it"), fInfoLevelId=0x0, lpFileInformation=0x126c0968 | out: lpFileInformation=0x126c0968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.310] CreateFileW (lpFileName="C:\\Boot\\it-IT" (normalized: "c:\\boot\\it-it"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.310] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fc28
	[0195.310] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.310] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0195.310] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb158, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0195.310] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.311] FindClose (in: hFindFile=0x79fc28 | out: hFindFile=0x79fc28) returned 1
	[0195.311] GetFileAttributesExW (in: lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126c0a58 | out: lpFileInformation=0x126c0a58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58)) returned 1
	[0195.311] GetFileAttributesExW (in: lpFileName="C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126c0aa8 | out: lpFileInformation=0x126c0aa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb158)) returned 1
	[0195.311] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ja-JP" (normalized: "c:\\boot\\ja-jp"), fInfoLevelId=0x0, lpFileInformation=0x126c0af8 | out: lpFileInformation=0x126c0af8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.311] CreateFileW (lpFileName="C:\\Boot\\ja-JP" (normalized: "c:\\boot\\ja-jp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.311] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ff28
	[0195.312] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.312] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0195.312] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa760, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0195.312] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.312] FindClose (in: hFindFile=0x79ff28 | out: hFindFile=0x79ff28) returned 1
	[0195.312] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126c0be8 | out: lpFileInformation=0x126c0be8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10760)) returned 1
	[0195.314] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126c0c38 | out: lpFileInformation=0x126c0c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa760)) returned 1
	[0195.314] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ko-KR" (normalized: "c:\\boot\\ko-kr"), fInfoLevelId=0x0, lpFileInformation=0x126c0c88 | out: lpFileInformation=0x126c0c88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.315] CreateFileW (lpFileName="C:\\Boot\\ko-KR" (normalized: "c:\\boot\\ko-kr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.315] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fde8
	[0195.315] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.315] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x211c6af1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0195.315] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa760, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0195.315] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.316] FindClose (in: hFindFile=0x79fde8 | out: hFindFile=0x79fde8) returned 1
	[0195.316] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126c0d78 | out: lpFileInformation=0x126c0d78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x211c6af1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10560)) returned 1
	[0195.316] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126c0dc8 | out: lpFileInformation=0x126c0dc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa760)) returned 1
	[0195.318] GetFileAttributesExW (in: lpFileName="C:\\Boot\\lt-LT" (normalized: "c:\\boot\\lt-lt"), fInfoLevelId=0x0, lpFileInformation=0x126c0e18 | out: lpFileInformation=0x126c0e18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.318] CreateFileW (lpFileName="C:\\Boot\\lt-LT" (normalized: "c:\\boot\\lt-lt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.318] FindFirstFileW (in: lpFileName="C:\\Boot\\lt-LT\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ff68
	[0195.319] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.319] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0195.319] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.319] FindClose (in: hFindFile=0x79ff68 | out: hFindFile=0x79ff68) returned 1
	[0195.319] GetFileAttributesExW (in: lpFileName="C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126c0eb8 | out: lpFileInformation=0x126c0eb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760)) returned 1
	[0195.319] GetFileAttributesExW (in: lpFileName="C:\\Boot\\lv-LV" (normalized: "c:\\boot\\lv-lv"), fInfoLevelId=0x0, lpFileInformation=0x126c0f08 | out: lpFileInformation=0x126c0f08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.319] CreateFileW (lpFileName="C:\\Boot\\lv-LV" (normalized: "c:\\boot\\lv-lv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.319] FindFirstFileW (in: lpFileName="C:\\Boot\\lv-LV\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f928
	[0195.320] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.320] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0195.320] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.320] FindClose (in: hFindFile=0x79f928 | out: hFindFile=0x79f928) returned 1
	[0195.320] GetFileAttributesExW (in: lpFileName="C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126c0fa8 | out: lpFileInformation=0x126c0fa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758)) returned 1
	[0195.322] GetFileAttributesExW (in: lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), fInfoLevelId=0x0, lpFileInformation=0x126c0ff8 | out: lpFileInformation=0x126c0ff8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc2960)) returned 1
	[0195.322] GetFileAttributesExW (in: lpFileName="C:\\Boot\\nb-NO" (normalized: "c:\\boot\\nb-no"), fInfoLevelId=0x0, lpFileInformation=0x126c1048 | out: lpFileInformation=0x126c1048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.322] CreateFileW (lpFileName="C:\\Boot\\nb-NO" (normalized: "c:\\boot\\nb-no"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.322] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9e8
	[0195.323] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.323] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0195.323] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb160, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0195.323] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.323] FindClose (in: hFindFile=0x79f9e8 | out: hFindFile=0x79f9e8) returned 1
	[0195.323] GetFileAttributesExW (in: lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126c1138 | out: lpFileInformation=0x126c1138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760)) returned 1
	[0195.323] GetFileAttributesExW (in: lpFileName="C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126c1188 | out: lpFileInformation=0x126c1188*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb160)) returned 1
	[0195.325] GetFileAttributesExW (in: lpFileName="C:\\Boot\\nl-NL" (normalized: "c:\\boot\\nl-nl"), fInfoLevelId=0x0, lpFileInformation=0x126c11d8 | out: lpFileInformation=0x126c11d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.325] CreateFileW (lpFileName="C:\\Boot\\nl-NL" (normalized: "c:\\boot\\nl-nl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.325] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fe28
	[0195.326] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.326] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0195.326] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb158, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0195.326] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.326] FindClose (in: hFindFile=0x79fe28 | out: hFindFile=0x79fe28) returned 1
	[0195.326] GetFileAttributesExW (in: lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126c12c8 | out: lpFileInformation=0x126c12c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13160)) returned 1
	[0195.327] GetFileAttributesExW (in: lpFileName="C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126c1318 | out: lpFileInformation=0x126c1318*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb158)) returned 1
	[0195.327] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pl-PL" (normalized: "c:\\boot\\pl-pl"), fInfoLevelId=0x0, lpFileInformation=0x126c1368 | out: lpFileInformation=0x126c1368*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.328] CreateFileW (lpFileName="C:\\Boot\\pl-PL" (normalized: "c:\\boot\\pl-pl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.328] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fde8
	[0195.329] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.329] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0195.329] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0195.329] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.329] FindClose (in: hFindFile=0x79fde8 | out: hFindFile=0x79fde8) returned 1
	[0195.329] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126c1458 | out: lpFileInformation=0x126c1458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f58)) returned 1
	[0195.329] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126c14a8 | out: lpFileInformation=0x126c14a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb360)) returned 1
	[0195.330] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pt-BR" (normalized: "c:\\boot\\pt-br"), fInfoLevelId=0x0, lpFileInformation=0x126c14f8 | out: lpFileInformation=0x126c14f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.330] CreateFileW (lpFileName="C:\\Boot\\pt-BR" (normalized: "c:\\boot\\pt-br"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.330] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fb28
	[0195.330] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.330] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0195.330] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb160, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0195.330] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.330] FindClose (in: hFindFile=0x79fb28 | out: hFindFile=0x79fb28) returned 1
	[0195.330] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126c15e8 | out: lpFileInformation=0x126c15e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60)) returned 1
	[0195.333] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126c1638 | out: lpFileInformation=0x126c1638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb160)) returned 1
	[0195.334] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pt-PT" (normalized: "c:\\boot\\pt-pt"), fInfoLevelId=0x0, lpFileInformation=0x126c1688 | out: lpFileInformation=0x126c1688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.334] CreateFileW (lpFileName="C:\\Boot\\pt-PT" (normalized: "c:\\boot\\pt-pt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.334] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffa8
	[0195.334] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.334] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0195.335] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb358, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0195.335] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.335] FindClose (in: hFindFile=0x79ffa8 | out: hFindFile=0x79ffa8) returned 1
	[0195.335] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126c1778 | out: lpFileInformation=0x126c1778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60)) returned 1
	[0195.335] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126c17c8 | out: lpFileInformation=0x126c17c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb358)) returned 1
	[0195.339] GetFileAttributesExW (in: lpFileName="C:\\Boot\\qps-ploc" (normalized: "c:\\boot\\qps-ploc"), fInfoLevelId=0x0, lpFileInformation=0x126c1818 | out: lpFileInformation=0x126c1818*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.339] CreateFileW (lpFileName="C:\\Boot\\qps-ploc" (normalized: "c:\\boot\\qps-ploc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.339] FindFirstFileW (in: lpFileName="C:\\Boot\\qps-ploc\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fce8
	[0195.340] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.340] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0195.340] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaf60, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0195.340] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.340] FindClose (in: hFindFile=0x79fce8 | out: hFindFile=0x79fce8) returned 1
	[0195.340] GetFileAttributesExW (in: lpFileName="C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126c1908 | out: lpFileInformation=0x126c1908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12160)) returned 1
	[0195.340] GetFileAttributesExW (in: lpFileName="C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126c1958 | out: lpFileInformation=0x126c1958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaf60)) returned 1
	[0195.341] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ro-RO" (normalized: "c:\\boot\\ro-ro"), fInfoLevelId=0x0, lpFileInformation=0x126c19a8 | out: lpFileInformation=0x126c19a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.348] CreateFileW (lpFileName="C:\\Boot\\ro-RO" (normalized: "c:\\boot\\ro-ro"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.348] FindFirstFileW (in: lpFileName="C:\\Boot\\ro-RO\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fd68
	[0195.348] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.348] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0195.348] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.349] FindClose (in: hFindFile=0x79fd68 | out: hFindFile=0x79fd68) returned 1
	[0195.349] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126c1a48 | out: lpFileInformation=0x126c1a48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960)) returned 1
	[0195.349] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ru-RU" (normalized: "c:\\boot\\ru-ru"), fInfoLevelId=0x0, lpFileInformation=0x126c1a98 | out: lpFileInformation=0x126c1a98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.349] CreateFileW (lpFileName="C:\\Boot\\ru-RU" (normalized: "c:\\boot\\ru-ru"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.349] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fb28
	[0195.349] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.349] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0195.349] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x211a0897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaf60, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0195.350] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.350] FindClose (in: hFindFile=0x79fb28 | out: hFindFile=0x79fb28) returned 1
	[0195.350] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126c1b88 | out: lpFileInformation=0x126c1b88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60)) returned 1
	[0195.350] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126c1bd8 | out: lpFileInformation=0x126c1bd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x211a0897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaf60)) returned 1
	[0195.352] GetFileAttributesExW (in: lpFileName="C:\\Boot\\sk-SK" (normalized: "c:\\boot\\sk-sk"), fInfoLevelId=0x0, lpFileInformation=0x126c1c28 | out: lpFileInformation=0x126c1c28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.352] CreateFileW (lpFileName="C:\\Boot\\sk-SK" (normalized: "c:\\boot\\sk-sk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.352] FindFirstFileW (in: lpFileName="C:\\Boot\\sk-SK\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fce8
	[0195.353] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.353] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0195.353] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.353] FindClose (in: hFindFile=0x79fce8 | out: hFindFile=0x79fce8) returned 1
	[0195.353] GetFileAttributesExW (in: lpFileName="C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126c1cc8 | out: lpFileInformation=0x126c1cc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58)) returned 1
	[0195.353] GetFileAttributesExW (in: lpFileName="C:\\Boot\\sl-SI" (normalized: "c:\\boot\\sl-si"), fInfoLevelId=0x0, lpFileInformation=0x126c1d18 | out: lpFileInformation=0x126c1d18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.354] CreateFileW (lpFileName="C:\\Boot\\sl-SI" (normalized: "c:\\boot\\sl-si"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.354] FindFirstFileW (in: lpFileName="C:\\Boot\\sl-SI\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f8e8
	[0195.354] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.354] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0195.354] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.354] FindClose (in: hFindFile=0x79f8e8 | out: hFindFile=0x79f8e8) returned 1
	[0195.354] GetFileAttributesExW (in: lpFileName="C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126c1db8 | out: lpFileInformation=0x126c1db8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60)) returned 1
	[0195.357] GetFileAttributesExW (in: lpFileName="C:\\Boot\\sr-Latn-CS" (normalized: "c:\\boot\\sr-latn-cs"), fInfoLevelId=0x0, lpFileInformation=0x126c1e08 | out: lpFileInformation=0x126c1e08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.357] CreateFileW (lpFileName="C:\\Boot\\sr-Latn-CS" (normalized: "c:\\boot\\sr-latn-cs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.357] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-CS\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fd28
	[0195.358] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.358] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0195.358] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0195.358] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.358] FindClose (in: hFindFile=0x79fd28 | out: hFindFile=0x79fd28) returned 1
	[0195.358] GetFileAttributesExW (in: lpFileName="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126c1ef8 | out: lpFileInformation=0x126c1ef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60)) returned 1
	[0195.359] GetFileAttributesExW (in: lpFileName="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126c1f48 | out: lpFileInformation=0x126c1f48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaf58)) returned 1
	[0195.359] GetFileAttributesExW (in: lpFileName="C:\\Boot\\sr-Latn-RS" (normalized: "c:\\boot\\sr-latn-rs"), fInfoLevelId=0x0, lpFileInformation=0x126c1f98 | out: lpFileInformation=0x126c1f98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.360] CreateFileW (lpFileName="C:\\Boot\\sr-Latn-RS" (normalized: "c:\\boot\\sr-latn-rs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.360] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-RS\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fda8
	[0195.361] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.361] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0195.361] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.361] FindClose (in: hFindFile=0x79fda8 | out: hFindFile=0x79fda8) returned 1
	[0195.361] GetFileAttributesExW (in: lpFileName="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126d4058 | out: lpFileInformation=0x126d4058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60)) returned 1
	[0195.361] GetFileAttributesExW (in: lpFileName="C:\\Boot\\sv-SE" (normalized: "c:\\boot\\sv-se"), fInfoLevelId=0x0, lpFileInformation=0x126d40a8 | out: lpFileInformation=0x126d40a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.361] CreateFileW (lpFileName="C:\\Boot\\sv-SE" (normalized: "c:\\boot\\sv-se"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.362] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f968
	[0195.362] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.362] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0195.362] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0195.362] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.362] FindClose (in: hFindFile=0x79f968 | out: hFindFile=0x79f968) returned 1
	[0195.362] GetFileAttributesExW (in: lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126d4198 | out: lpFileInformation=0x126d4198*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960)) returned 1
	[0195.362] GetFileAttributesExW (in: lpFileName="C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126d41e8 | out: lpFileInformation=0x126d41e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaf58)) returned 1
	[0195.364] GetFileAttributesExW (in: lpFileName="C:\\Boot\\tr-TR" (normalized: "c:\\boot\\tr-tr"), fInfoLevelId=0x0, lpFileInformation=0x126d4238 | out: lpFileInformation=0x126d4238*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.364] CreateFileW (lpFileName="C:\\Boot\\tr-TR" (normalized: "c:\\boot\\tr-tr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.364] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fde8
	[0195.365] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.365] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0195.365] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb160, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0195.365] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.365] FindClose (in: hFindFile=0x79fde8 | out: hFindFile=0x79fde8) returned 1
	[0195.365] GetFileAttributesExW (in: lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126d4328 | out: lpFileInformation=0x126d4328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12558)) returned 1
	[0195.365] GetFileAttributesExW (in: lpFileName="C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126d4378 | out: lpFileInformation=0x126d4378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb160)) returned 1
	[0195.366] GetFileAttributesExW (in: lpFileName="C:\\Boot\\uk-UA" (normalized: "c:\\boot\\uk-ua"), fInfoLevelId=0x0, lpFileInformation=0x126d43c8 | out: lpFileInformation=0x126d43c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.367] CreateFileW (lpFileName="C:\\Boot\\uk-UA" (normalized: "c:\\boot\\uk-ua"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.367] FindFirstFileW (in: lpFileName="C:\\Boot\\uk-UA\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f968
	[0195.368] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.368] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0195.368] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.368] FindClose (in: hFindFile=0x79f968 | out: hFindFile=0x79f968) returned 1
	[0195.368] GetFileAttributesExW (in: lpFileName="C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126d4468 | out: lpFileInformation=0x126d4468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60)) returned 1
	[0195.369] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-CN" (normalized: "c:\\boot\\zh-cn"), fInfoLevelId=0x0, lpFileInformation=0x126d44b8 | out: lpFileInformation=0x126d44b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a8f7b9, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a8f7b9, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.369] CreateFileW (lpFileName="C:\\Boot\\zh-CN" (normalized: "c:\\boot\\zh-cn"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.369] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a8f7b9, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a8f7b9, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fe68
	[0195.370] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a8f7b9, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a8f7b9, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.370] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a8f7b9, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a8f7b9, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0195.370] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a8f7b9, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a8f7b9, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa560, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0195.370] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.370] FindClose (in: hFindFile=0x79fe68 | out: hFindFile=0x79fe68) returned 1
	[0195.371] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126d45a8 | out: lpFileInformation=0x126d45a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a8f7b9, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a8f7b9, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960)) returned 1
	[0195.371] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126d45f8 | out: lpFileInformation=0x126d45f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a8f7b9, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a8f7b9, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa560)) returned 1
	[0195.372] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-HK" (normalized: "c:\\boot\\zh-hk"), fInfoLevelId=0x0, lpFileInformation=0x126d4648 | out: lpFileInformation=0x126d4648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a8f7b9, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78ab5a49, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.372] CreateFileW (lpFileName="C:\\Boot\\zh-HK" (normalized: "c:\\boot\\zh-hk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.373] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a8f7b9, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78ab5a49, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fba8
	[0195.373] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a8f7b9, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78ab5a49, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.373] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a8f7b9, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a8f7b9, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf958, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0195.373] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa558, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0195.373] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.373] FindClose (in: hFindFile=0x79fba8 | out: hFindFile=0x79fba8) returned 1
	[0195.373] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126d4738 | out: lpFileInformation=0x126d4738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a8f7b9, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a8f7b9, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf958)) returned 1
	[0195.374] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126d4788 | out: lpFileInformation=0x126d4788*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa558)) returned 1
	[0195.374] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-TW" (normalized: "c:\\boot\\zh-tw"), fInfoLevelId=0x0, lpFileInformation=0x126d47d8 | out: lpFileInformation=0x126d47d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78ab5a49, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.374] CreateFileW (lpFileName="C:\\Boot\\zh-TW" (normalized: "c:\\boot\\zh-tw"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.374] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78ab5a49, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ff28
	[0195.374] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78ab5a49, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.374] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0195.375] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa560, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0195.375] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.375] FindClose (in: hFindFile=0x79ff28 | out: hFindFile=0x79ff28) returned 1
	[0195.375] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126d48c8 | out: lpFileInformation=0x126d48c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960)) returned 1
	[0195.375] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126d4918 | out: lpFileInformation=0x126d4918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa560)) returned 1
	[0195.376] GetFileAttributesExW (in: lpFileName="C:\\Documents and Settings" (normalized: "c:\\documents and settings"), fInfoLevelId=0x0, lpFileInformation=0x126d4968 | out: lpFileInformation=0x126d4968*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.376] GetFileAttributesExW (in: lpFileName="C:\\PerfLogs" (normalized: "c:\\perflogs"), fInfoLevelId=0x0, lpFileInformation=0x126d49b8 | out: lpFileInformation=0x126d49b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbaec25, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xbaec25, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.376] CreateFileW (lpFileName="C:\\PerfLogs" (normalized: "c:\\perflogs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.377] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*", lpFindFileData=0x12423a44 | out: lpFindFileData=0x12423a44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbaec25, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xbaec25, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ff28
	[0195.377] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbaec25, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xbaec25, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.377] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.377] FindClose (in: hFindFile=0x79ff28 | out: hFindFile=0x79ff28) returned 1
	[0195.377] CreateFileW (lpFileName="C:\\PerfLogs\\README.html" (normalized: "c:\\perflogs\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x138
	[0195.502] GetConsoleMode (in: hConsoleHandle=0x138, lpMode=0x12422e5c | out: lpMode=0x12422e5c) returned 0
	[0195.503] WriteFile (in: hFile=0x138, lpBuffer=0x126e2000*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422e4c, lpOverlapped=0x0 | out: lpBuffer=0x126e2000*, lpNumberOfBytesWritten=0x12422e4c*=0xc85, lpOverlapped=0x0) returned 1
	[0195.504] CloseHandle (hObject=0x138) returned 1
	[0195.506] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12520b90*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x124229dc, lpReserved=0x0 | out: lpBuffer=0x12520b90*, lpNumberOfCharsWritten=0x124229dc*=0x26) returned 1
	[0195.518] GetFileAttributesExW (in: lpFileName="C:\\Program Files" (normalized: "c:\\program files"), fInfoLevelId=0x0, lpFileInformation=0x126d4a08 | out: lpFileInformation=0x126d4a08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x9690c3b, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x9690c3b, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0195.518] CreateFileW (lpFileName="C:\\Program Files" (normalized: "c:\\program files"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.519] FindFirstFileW (in: lpFileName="C:\\Program Files\\*", lpFindFileData=0x12423a44 | out: lpFindFileData=0x12423a44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x9690c3b, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x9690c3b, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f8e8
	[0195.519] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x9690c3b, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x9690c3b, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.519] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xf854500b, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf854500b, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1
	[0195.519] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2f72013, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x9701bb02, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x9701bb02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0195.519] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf8dce802, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf8dce802, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1
	[0195.519] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b3095dc, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0xf8548aad, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf8548aad, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office 15", cAlternateFileName="MICROS~1")) returned 1
	[0195.519] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xf984abce, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf984abce, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1
	[0195.520] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde5c2433, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde5c2433, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1
	[0195.520] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf22b9950, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xf22b9950, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xf22b9950, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1
	[0195.520] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf8f5a609, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf8f5a609, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1
	[0195.520] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ebef3a1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xf7dbc21f, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf7dbc21f, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal", cAlternateFileName="WIA843~1")) returned 1
	[0195.520] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf6dbd7c8, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf6dbd7c8, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~2")) returned 1
	[0195.520] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf83d59e8, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf83d59e8, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player", cAlternateFileName="WINDOW~3")) returned 1
	[0195.520] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf83df5bb, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf83df5bb, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Multimedia Platform", cAlternateFileName="WINDOW~4")) returned 1
	[0195.520] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf8f545e7, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf8f545e7, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WI67CB~1")) returned 1
	[0195.520] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd254645, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd254645, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="WI8A19~1")) returned 1
	[0195.520] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf7d6578b, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf7d6578b, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1
	[0195.520] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf7870e46, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf7870e46, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1
	[0195.520] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2224dfa5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2224dfa5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsApps", cAlternateFileName="WI7DB9~1")) returned 1
	[0195.520] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf83f68cd, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf83f68cd, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 1
	[0195.520] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.520] FindClose (in: hFindFile=0x79f8e8 | out: hFindFile=0x79f8e8) returned 1
	[0195.521] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files" (normalized: "c:\\program files\\common files"), fInfoLevelId=0x0, lpFileInformation=0x126d4ff8 | out: lpFileInformation=0x126d4ff8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xf854500b, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf854500b, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0195.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files" (normalized: "c:\\program files\\common files"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.521] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xf854500b, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf854500b, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f8e8
	[0195.521] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xf854500b, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf854500b, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.522] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cc510d0, ftCreationTime.dwHighDateTime=0x1d7c167, ftLastAccessTime.dwLowDateTime=0x4ecd1b70, ftLastAccessTime.dwHighDateTime=0x1d7e071, ftLastWriteTime.dwLowDateTime=0x4ecd1b70, ftLastWriteTime.dwHighDateTime=0x1d7e071, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="aldelo.exe", cAlternateFileName="")) returned 1
	[0195.522] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf02f470, ftCreationTime.dwHighDateTime=0x1d7e754, ftLastAccessTime.dwLowDateTime=0x63899bf0, ftLastAccessTime.dwHighDateTime=0x1d7e905, ftLastWriteTime.dwLowDateTime=0x63899bf0, ftLastWriteTime.dwHighDateTime=0x1d7e905, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="coreftp.exe", cAlternateFileName="")) returned 1
	[0195.522] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x476b93c0, ftCreationTime.dwHighDateTime=0x1d7eedb, ftLastAccessTime.dwLowDateTime=0x4d6f2660, ftLastAccessTime.dwHighDateTime=0x1d7f1ba, ftLastWriteTime.dwLowDateTime=0x4d6f2660, ftLastWriteTime.dwHighDateTime=0x1d7f1ba, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="filezilla.exe", cAlternateFileName="FILEZI~1.EXE")) returned 1
	[0195.522] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x1a092147, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1a092147, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft shared", cAlternateFileName="MICROS~1")) returned 1
	[0195.522] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65fa21b0, ftCreationTime.dwHighDateTime=0x1d7fd88, ftLastAccessTime.dwLowDateTime=0xe0af11a0, ftLastAccessTime.dwHighDateTime=0x1d8277b, ftLastWriteTime.dwLowDateTime=0xe0af11a0, ftLastWriteTime.dwHighDateTime=0x1d8277b, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ncftp.exe", cAlternateFileName="")) returned 1
	[0195.522] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a6076a0, ftCreationTime.dwHighDateTime=0x1d81b51, ftLastAccessTime.dwLowDateTime=0xa855bc50, ftLastAccessTime.dwHighDateTime=0x1d81c1d, ftLastWriteTime.dwLowDateTime=0xa855bc50, ftLastWriteTime.dwHighDateTime=0x1d81c1d, nFileSizeHigh=0x0, nFileSizeLow=0x12533, dwReserved0=0x0, dwReserved1=0x0, cFileName="nPEVimA.jpg", cAlternateFileName="")) returned 1
	[0195.522] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b48540, ftCreationTime.dwHighDateTime=0x1d81ae2, ftLastAccessTime.dwLowDateTime=0xcb46c6f0, ftLastAccessTime.dwHighDateTime=0x1d8213b, ftLastWriteTime.dwLowDateTime=0xcb46c6f0, ftLastWriteTime.dwHighDateTime=0x1d8213b, nFileSizeHigh=0x0, nFileSizeLow=0x18187, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rq-fz_x.png", cAlternateFileName="")) returned 1
	[0195.522] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3056e22, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3056e22, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1
	[0195.522] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1
	[0195.522] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c289c80, ftCreationTime.dwHighDateTime=0x1d7d310, ftLastAccessTime.dwLowDateTime=0x568bef70, ftLastAccessTime.dwHighDateTime=0x1d8057a, ftLastWriteTime.dwLowDateTime=0x568bef70, ftLastWriteTime.dwHighDateTime=0x1d8057a, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="winscp.exe", cAlternateFileName="")) returned 1
	[0195.522] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61e205c0, ftCreationTime.dwHighDateTime=0x1d81fd4, ftLastAccessTime.dwLowDateTime=0xbbbe2ce0, ftLastAccessTime.dwHighDateTime=0x1d826d2, ftLastWriteTime.dwLowDateTime=0xbbbe2ce0, ftLastWriteTime.dwHighDateTime=0x1d826d2, nFileSizeHigh=0x0, nFileSizeLow=0x8c0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="xSQvcZI.bmp", cAlternateFileName="")) returned 1
	[0195.522] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.522] FindClose (in: hFindFile=0x79f8e8 | out: hFindFile=0x79f8e8) returned 1
	[0195.522] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Rq-fz_x.png" (normalized: "c:\\program files\\common files\\rq-fz_x.png"), fInfoLevelId=0x0, lpFileInformation=0x126d53b8 | out: lpFileInformation=0x126d53b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b48540, ftCreationTime.dwHighDateTime=0x1d81ae2, ftLastAccessTime.dwLowDateTime=0xcb46c6f0, ftLastAccessTime.dwHighDateTime=0x1d8213b, ftLastWriteTime.dwLowDateTime=0xcb46c6f0, ftLastWriteTime.dwHighDateTime=0x1d8213b, nFileSizeHigh=0x0, nFileSizeLow=0x18187)) returned 1
	[0195.523] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Services" (normalized: "c:\\program files\\common files\\services"), fInfoLevelId=0x0, lpFileInformation=0x126d5408 | out: lpFileInformation=0x126d5408*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3056e22, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3056e22, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services" (normalized: "c:\\program files\\common files\\services"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.527] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3056e22, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3056e22, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0028
	[0195.527] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3056e22, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3056e22, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.527] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1944f082, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1944f082, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1944f082, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 1
	[0195.527] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.527] FindClose (in: hFindFile=0x7a0028 | out: hFindFile=0x7a0028) returned 1
	[0195.528] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), fInfoLevelId=0x0, lpFileInformation=0x126d54a8 | out: lpFileInformation=0x126d54a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1944f082, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1944f082, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1944f082, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa8e)) returned 1
	[0195.548] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System" (normalized: "c:\\program files\\common files\\system"), fInfoLevelId=0x0, lpFileInformation=0x126ae3c8 | out: lpFileInformation=0x126ae3c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0195.549] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System" (normalized: "c:\\program files\\common files\\system"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.549] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0068
	[0195.550] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.550] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ado", cAlternateFileName="")) returned 1
	[0195.551] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3154ed, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f3154ed, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f3154ed, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1
	[0195.551] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0195.551] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadc", cAlternateFileName="")) returned 1
	[0195.551] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1
	[0195.551] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1950dc42, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1950dc42, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1950dc42, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd7a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32.dll", cAlternateFileName="")) returned 1
	[0195.551] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x194e79e8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x194e79e8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x194e79e8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xeb800, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 1
	[0195.551] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.551] FindClose (in: hFindFile=0x7a0068 | out: hFindFile=0x7a0068) returned 1
	[0195.551] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\DirectDB.dll" (normalized: "c:\\program files\\common files\\system\\directdb.dll"), fInfoLevelId=0x0, lpFileInformation=0x126ae648 | out: lpFileInformation=0x126ae648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3154ed, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f3154ed, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f3154ed, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8000)) returned 1
	[0195.552] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB" (normalized: "c:\\program files\\common files\\system\\ole db"), fInfoLevelId=0x0, lpFileInformation=0x126ae698 | out: lpFileInformation=0x126ae698*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0195.552] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB" (normalized: "c:\\program files\\common files\\system\\ole db"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.552] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fea8
	[0195.561] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.561] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd2081c9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd2081c9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0195.561] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x188d5ba1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x188d5ba1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x188fbdf3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1a800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1
	[0195.561] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x188d5ba1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x188d5ba1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x188d5ba1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x61e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaps.dll", cAlternateFileName="")) returned 1
	[0195.561] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19285454, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19285454, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19285454, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb0800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasql.dll", cAlternateFileName="")) returned 1
	[0195.561] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19285454, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19285454, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19285454, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll", cAlternateFileName="")) returned 1
	[0195.561] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19285454, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19285454, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19285454, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdatl3.dll", cAlternateFileName="")) returned 1
	[0195.561] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19285454, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19285454, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19285454, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msxactps.dll", cAlternateFileName="")) returned 1
	[0195.561] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1925f1f5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1925f1f5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1925f1f5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xe9400, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32.dll", cAlternateFileName="")) returned 1
	[0195.561] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1925f1f5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1925f1f5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1925f1f5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32r.dll", cAlternateFileName="")) returned 1
	[0195.561] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1925f1f5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1925f1f5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1925f1f5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x264c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbjvs.inc", cAlternateFileName="")) returned 1
	[0195.562] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19238f9f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19238f9f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19238f9f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x26f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbvbs.inc", cAlternateFileName="")) returned 1
	[0195.562] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1883d233, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1883d233, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1883d233, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.dll", cAlternateFileName="")) returned 1
	[0195.562] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1883d233, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1883d233, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1883d233, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll", cAlternateFileName="")) returned 1
	[0195.562] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1870bf67, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1870bf67, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1870bf67, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x54000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.dll", cAlternateFileName="")) returned 1
	[0195.562] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1870bf67, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1870bf67, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1870bf67, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 1
	[0195.562] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.562] FindClose (in: hFindFile=0x79fea8 | out: hFindFile=0x79fea8) returned 1
	[0195.563] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x126aeb98 | out: lpFileInformation=0x126aeb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd2081c9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd2081c9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.565] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.565] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd2081c9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd2081c9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9e8
	[0195.565] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd2081c9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd2081c9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.565] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d43f81a, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9d43f81a, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9d43f81a, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll.mui", cAlternateFileName="")) returned 1
	[0195.565] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d465a6f, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9d465a6f, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9d465a6f, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xbe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32r.dll.mui", cAlternateFileName="")) returned 1
	[0195.565] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d43f81a, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9d43f81a, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9d43f81a, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xae00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll.mui", cAlternateFileName="")) returned 1
	[0195.565] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d465a6f, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9d465a6f, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9d465a6f, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 1
	[0195.565] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.565] FindClose (in: hFindFile=0x79f9e8 | out: hFindFile=0x79f9e8) returned 1
	[0195.566] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x126aed28 | out: lpFileInformation=0x126aed28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d43f81a, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9d43f81a, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9d43f81a, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a00)) returned 1
	[0195.591] SetEvent (hEvent=0x168) returned 1
	[0195.591] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x126aed78 | out: lpFileInformation=0x126aed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d465a6f, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9d465a6f, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9d465a6f, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xbe00)) returned 1
	[0195.595] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), fInfoLevelId=0x0, lpFileInformation=0x126aedc8 | out: lpFileInformation=0x126aedc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d43f81a, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9d43f81a, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9d43f81a, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xae00)) returned 1
	[0195.597] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), fInfoLevelId=0x0, lpFileInformation=0x126aee18 | out: lpFileInformation=0x126aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d465a6f, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9d465a6f, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9d465a6f, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x4a00)) returned 1
	[0195.597] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll"), fInfoLevelId=0x0, lpFileInformation=0x126aee68 | out: lpFileInformation=0x126aee68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x188d5ba1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x188d5ba1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x188fbdf3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1a800)) returned 1
	[0195.598] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll"), fInfoLevelId=0x0, lpFileInformation=0x126aeeb8 | out: lpFileInformation=0x126aeeb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x188d5ba1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x188d5ba1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x188d5ba1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x61e00)) returned 1
	[0195.598] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll"), fInfoLevelId=0x0, lpFileInformation=0x126aef08 | out: lpFileInformation=0x126aef08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19285454, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19285454, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19285454, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb0800)) returned 1
	[0195.599] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll"), fInfoLevelId=0x0, lpFileInformation=0x126aef58 | out: lpFileInformation=0x126aef58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19285454, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19285454, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19285454, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd800)) returned 1
	[0195.603] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll"), fInfoLevelId=0x0, lpFileInformation=0x126aefa8 | out: lpFileInformation=0x126aefa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19285454, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19285454, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19285454, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d600)) returned 1
	[0195.603] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll"), fInfoLevelId=0x0, lpFileInformation=0x126aeff8 | out: lpFileInformation=0x126aeff8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19285454, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19285454, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19285454, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3e00)) returned 1
	[0195.604] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll"), fInfoLevelId=0x0, lpFileInformation=0x126af048 | out: lpFileInformation=0x126af048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1925f1f5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1925f1f5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1925f1f5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xe9400)) returned 1
	[0195.604] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll"), fInfoLevelId=0x0, lpFileInformation=0x126af098 | out: lpFileInformation=0x126af098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1925f1f5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1925f1f5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1925f1f5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13200)) returned 1
	[0195.610] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), fInfoLevelId=0x0, lpFileInformation=0x126af0e8 | out: lpFileInformation=0x126af0e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1925f1f5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1925f1f5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1925f1f5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x264c)) returned 1
	[0195.613] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), fInfoLevelId=0x0, lpFileInformation=0x126af138 | out: lpFileInformation=0x126af138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19238f9f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19238f9f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19238f9f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x26f7)) returned 1
	[0195.614] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll"), fInfoLevelId=0x0, lpFileInformation=0x126af188 | out: lpFileInformation=0x126af188*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1883d233, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1883d233, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1883d233, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd4600)) returned 1
	[0195.614] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), fInfoLevelId=0x0, lpFileInformation=0x126af1d8 | out: lpFileInformation=0x126af1d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1883d233, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1883d233, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1883d233, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1400)) returned 1
	[0195.614] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll"), fInfoLevelId=0x0, lpFileInformation=0x126af228 | out: lpFileInformation=0x126af228*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1870bf67, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1870bf67, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1870bf67, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x54000)) returned 1
	[0195.625] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), fInfoLevelId=0x0, lpFileInformation=0x126af278 | out: lpFileInformation=0x126af278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1870bf67, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1870bf67, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1870bf67, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc00)) returned 1
	[0195.626] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado" (normalized: "c:\\program files\\common files\\system\\ado"), fInfoLevelId=0x0, lpFileInformation=0x126af2c8 | out: lpFileInformation=0x126af2c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado" (normalized: "c:\\program files\\common files\\system\\ado"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.626] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fca8
	[0195.672] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.672] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1870bf67, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1870bf67, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1870bf67, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3a08, dwReserved0=0x0, dwReserved1=0x0, cFileName="adojavas.inc", cAlternateFileName="")) returned 1
	[0195.672] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1870bf67, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1870bf67, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1870bf67, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3b5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="adovbs.inc", cAlternateFileName="")) returned 1
	[0195.672] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0195.672] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1870bf67, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1870bf67, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1870bf67, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1
	[0195.672] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x187321c1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x187321c1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x187321c1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x133400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado15.dll", cAlternateFileName="")) returned 1
	[0195.672] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19238f9f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19238f9f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19238f9f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado20.tlb", cAlternateFileName="")) returned 1
	[0195.672] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19238f9f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19238f9f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19238f9f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado21.tlb", cAlternateFileName="")) returned 1
	[0195.672] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19238f9f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19238f9f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19238f9f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x11200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado25.tlb", cAlternateFileName="")) returned 1
	[0195.672] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19238f9f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19238f9f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19238f9f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado26.tlb", cAlternateFileName="")) returned 1
	[0195.672] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19238f9f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19238f9f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19238f9f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x11800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado27.tlb", cAlternateFileName="")) returned 1
	[0195.672] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19238f9f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19238f9f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19238f9f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado28.tlb", cAlternateFileName="")) returned 1
	[0195.672] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19212d44, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19212d44, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19212d44, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado60.tlb", cAlternateFileName="")) returned 1
	[0195.672] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x188896e8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x188896e8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x188896e8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x5d200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd.dll", cAlternateFileName="")) returned 1
	[0195.672] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x193b671c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x193b671c, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x193b671c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd28.tlb", cAlternateFileName="")) returned 1
	[0195.672] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1931ddb6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1931ddb6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1931ddb6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msador15.dll", cAlternateFileName="")) returned 1
	[0195.672] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x187321c1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x187321c1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x187321c1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msador28.tlb", cAlternateFileName="")) returned 1
	[0195.672] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1931ddb6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1931ddb6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1931ddb6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x68800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox.dll", cAlternateFileName="")) returned 1
	[0195.672] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18816fd8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x18816fd8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x18816fd8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x6200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox28.tlb", cAlternateFileName="")) returned 1
	[0195.672] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x193b671c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x193b671c, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x193b671c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 1
	[0195.672] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.673] FindClose (in: hFindFile=0x79fca8 | out: hFindFile=0x79fca8) returned 1
	[0195.674] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), fInfoLevelId=0x0, lpFileInformation=0x126af908 | out: lpFileInformation=0x126af908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1870bf67, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1870bf67, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1870bf67, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3a08)) returned 1
	[0195.701] SetEvent (hEvent=0x168) returned 1
	[0195.701] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), fInfoLevelId=0x0, lpFileInformation=0x126af958 | out: lpFileInformation=0x126af958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1870bf67, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1870bf67, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1870bf67, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3b5b)) returned 1
	[0195.701] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US" (normalized: "c:\\program files\\common files\\system\\ado\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x126af9a8 | out: lpFileInformation=0x126af9a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US" (normalized: "c:\\program files\\common files\\system\\ado\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.702] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffe8
	[0195.702] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.702] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d4195a2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9d4195a2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9d4195a2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1
	[0195.702] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.702] FindClose (in: hFindFile=0x79ffe8 | out: hFindFile=0x79ffe8) returned 1
	[0195.702] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x126afa48 | out: lpFileInformation=0x126afa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d4195a2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9d4195a2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9d4195a2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x4800)) returned 1
	[0195.706] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), fInfoLevelId=0x0, lpFileInformation=0x126afa98 | out: lpFileInformation=0x126afa98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1870bf67, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1870bf67, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1870bf67, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc00)) returned 1
	[0195.706] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), fInfoLevelId=0x0, lpFileInformation=0x126afae8 | out: lpFileInformation=0x126afae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x187321c1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x187321c1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x187321c1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x133400)) returned 1
	[0195.707] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), fInfoLevelId=0x0, lpFileInformation=0x126afb38 | out: lpFileInformation=0x126afb38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19238f9f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19238f9f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19238f9f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xca00)) returned 1
	[0195.707] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), fInfoLevelId=0x0, lpFileInformation=0x126afb88 | out: lpFileInformation=0x126afb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19238f9f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19238f9f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19238f9f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd400)) returned 1
	[0195.712] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), fInfoLevelId=0x0, lpFileInformation=0x126afbd8 | out: lpFileInformation=0x126afbd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19238f9f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19238f9f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19238f9f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x11200)) returned 1
	[0195.712] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), fInfoLevelId=0x0, lpFileInformation=0x126afc28 | out: lpFileInformation=0x126afc28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19238f9f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19238f9f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19238f9f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x11600)) returned 1
	[0195.713] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), fInfoLevelId=0x0, lpFileInformation=0x126afc78 | out: lpFileInformation=0x126afc78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19238f9f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19238f9f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19238f9f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x11800)) returned 1
	[0195.715] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), fInfoLevelId=0x0, lpFileInformation=0x126afcc8 | out: lpFileInformation=0x126afcc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19238f9f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19238f9f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19238f9f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x11600)) returned 1
	[0195.715] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb"), fInfoLevelId=0x0, lpFileInformation=0x126afd18 | out: lpFileInformation=0x126afd18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19212d44, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19212d44, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19212d44, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x11600)) returned 1
	[0195.715] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll"), fInfoLevelId=0x0, lpFileInformation=0x126afd68 | out: lpFileInformation=0x126afd68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x188896e8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x188896e8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x188896e8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x5d200)) returned 1
	[0195.719] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), fInfoLevelId=0x0, lpFileInformation=0x126afdb8 | out: lpFileInformation=0x126afdb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x193b671c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x193b671c, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x193b671c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3800)) returned 1
	[0195.720] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll"), fInfoLevelId=0x0, lpFileInformation=0x126afe08 | out: lpFileInformation=0x126afe08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1931ddb6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1931ddb6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1931ddb6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb200)) returned 1
	[0195.722] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb"), fInfoLevelId=0x0, lpFileInformation=0x126afe58 | out: lpFileInformation=0x126afe58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x187321c1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x187321c1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x187321c1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8e00)) returned 1
	[0195.722] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll"), fInfoLevelId=0x0, lpFileInformation=0x126afea8 | out: lpFileInformation=0x126afea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1931ddb6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1931ddb6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1931ddb6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x68800)) returned 1
	[0195.788] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), fInfoLevelId=0x0, lpFileInformation=0x126afef8 | out: lpFileInformation=0x126afef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18816fd8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x18816fd8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x18816fd8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x6200)) returned 1
	[0195.788] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll"), fInfoLevelId=0x0, lpFileInformation=0x126aff48 | out: lpFileInformation=0x126aff48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x193b671c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x193b671c, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x193b671c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13000)) returned 1
	[0195.793] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US" (normalized: "c:\\program files\\common files\\system\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x126aff98 | out: lpFileInformation=0x126aff98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.793] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\en-US" (normalized: "c:\\program files\\common files\\system\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.793] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fca8
	[0195.793] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.793] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dbb2e90, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9dbb2e90, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9dbb2e90, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1
	[0195.793] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.794] FindClose (in: hFindFile=0x79fca8 | out: hFindFile=0x79fca8) returned 1
	[0195.794] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x126fa058 | out: lpFileInformation=0x126fa058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dbb2e90, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9dbb2e90, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9dbb2e90, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x17200)) returned 1
	[0195.794] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc" (normalized: "c:\\program files\\common files\\system\\msadc"), fInfoLevelId=0x0, lpFileInformation=0x126fa0a8 | out: lpFileInformation=0x126fa0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.794] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc" (normalized: "c:\\program files\\common files\\system\\msadc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.794] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fc28
	[0195.978] SetEvent (hEvent=0x168) returned 1
	[0195.978] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.978] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19344010, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19344010, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19344010, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1
	[0195.978] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19344010, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19344010, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19344010, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcvbs.inc", cAlternateFileName="")) returned 1
	[0195.978] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0195.978] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19344010, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19344010, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19344010, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9b600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1
	[0195.978] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19344010, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19344010, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19344010, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll", cAlternateFileName="")) returned 1
	[0195.978] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1931ddb6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1931ddb6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1931ddb6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x40c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadco.dll", cAlternateFileName="")) returned 1
	[0195.978] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1931ddb6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1931ddb6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1931ddb6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll", cAlternateFileName="")) returned 1
	[0195.978] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x188d5ba1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x188d5ba1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x188d5ba1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x47400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadds.dll", cAlternateFileName="")) returned 1
	[0195.978] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x188d5ba1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x188d5ba1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x188d5ba1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll", cAlternateFileName="")) returned 1
	[0195.978] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x192f7b5f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x192f7b5f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x192f7b5f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll", cAlternateFileName="")) returned 1
	[0195.978] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x192f7b5f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x192f7b5f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x192f7b5f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x58e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprst.dll", cAlternateFileName="")) returned 1
	[0195.978] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x188896e8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x188896e8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x188896e8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x39400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdarem.dll", cAlternateFileName="")) returned 1
	[0195.979] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x188896e8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x188896e8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x188896e8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll", cAlternateFileName="")) returned 1
	[0195.979] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x188d5ba1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x188d5ba1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x188d5ba1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 1
	[0195.979] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.979] FindClose (in: hFindFile=0x79fc28 | out: hFindFile=0x79fc28) returned 1
	[0195.980] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), fInfoLevelId=0x0, lpFileInformation=0x126fa558 | out: lpFileInformation=0x126fa558*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19344010, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19344010, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19344010, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x276)) returned 1
	[0195.981] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), fInfoLevelId=0x0, lpFileInformation=0x126fa5a8 | out: lpFileInformation=0x126fa5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19344010, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19344010, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19344010, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x26f)) returned 1
	[0195.981] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x126fa5f8 | out: lpFileInformation=0x126fa5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0195.981] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.981] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffe8
	[0195.981] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.981] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d465a6f, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9d465a6f, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9d465a6f, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll.mui", cAlternateFileName="")) returned 1
	[0195.981] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d465a6f, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9d465a6f, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9d465a6f, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll.mui", cAlternateFileName="")) returned 1
	[0195.981] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d465a6f, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9d465a6f, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9d465a6f, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x3a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll.mui", cAlternateFileName="")) returned 1
	[0195.981] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d43f81a, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9d43f81a, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9d43f81a, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll.mui", cAlternateFileName="")) returned 1
	[0195.981] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d465a6f, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9d465a6f, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9d465a6f, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 1
	[0195.982] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.982] FindClose (in: hFindFile=0x79ffe8 | out: hFindFile=0x79ffe8) returned 1
	[0195.982] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x126fa7d8 | out: lpFileInformation=0x126fa7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d465a6f, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9d465a6f, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9d465a6f, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x2a00)) returned 1
	[0195.982] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x126fa828 | out: lpFileInformation=0x126fa828*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d465a6f, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9d465a6f, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9d465a6f, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a00)) returned 1
	[0195.985] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x126fa878 | out: lpFileInformation=0x126fa878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d465a6f, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9d465a6f, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9d465a6f, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x3a00)) returned 1
	[0195.986] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x126fa8c8 | out: lpFileInformation=0x126fa8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d43f81a, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9d43f81a, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9d43f81a, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0195.986] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x126fa918 | out: lpFileInformation=0x126fa918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d465a6f, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9d465a6f, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9d465a6f, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a00)) returned 1
	[0195.986] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll"), fInfoLevelId=0x0, lpFileInformation=0x126fa968 | out: lpFileInformation=0x126fa968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19344010, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19344010, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19344010, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9b600)) returned 1
	[0195.986] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll"), fInfoLevelId=0x0, lpFileInformation=0x126fa9b8 | out: lpFileInformation=0x126fa9b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19344010, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x19344010, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x19344010, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc00)) returned 1
	[0195.986] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll"), fInfoLevelId=0x0, lpFileInformation=0x126faa08 | out: lpFileInformation=0x126faa08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1931ddb6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1931ddb6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1931ddb6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x40c00)) returned 1
	[0195.987] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll"), fInfoLevelId=0x0, lpFileInformation=0x126faa58 | out: lpFileInformation=0x126faa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1931ddb6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1931ddb6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1931ddb6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc00)) returned 1
	[0195.987] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll"), fInfoLevelId=0x0, lpFileInformation=0x126faaa8 | out: lpFileInformation=0x126faaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x188d5ba1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x188d5ba1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x188d5ba1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x47400)) returned 1
	[0195.987] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll"), fInfoLevelId=0x0, lpFileInformation=0x126faaf8 | out: lpFileInformation=0x126faaf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x188d5ba1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x188d5ba1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x188d5ba1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc00)) returned 1
	[0195.987] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll"), fInfoLevelId=0x0, lpFileInformation=0x126fab48 | out: lpFileInformation=0x126fab48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x192f7b5f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x192f7b5f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x192f7b5f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc00)) returned 1
	[0195.987] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll"), fInfoLevelId=0x0, lpFileInformation=0x126fab98 | out: lpFileInformation=0x126fab98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x192f7b5f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x192f7b5f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x192f7b5f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x58e00)) returned 1
	[0195.988] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll"), fInfoLevelId=0x0, lpFileInformation=0x126fabe8 | out: lpFileInformation=0x126fabe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x188896e8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x188896e8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x188896e8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x39400)) returned 1
	[0195.988] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll"), fInfoLevelId=0x0, lpFileInformation=0x126fac38 | out: lpFileInformation=0x126fac38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x188896e8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x188896e8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x188896e8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc00)) returned 1
	[0195.988] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll"), fInfoLevelId=0x0, lpFileInformation=0x126fac88 | out: lpFileInformation=0x126fac88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x188d5ba1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x188d5ba1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x188d5ba1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8000)) returned 1
	[0195.988] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll"), fInfoLevelId=0x0, lpFileInformation=0x126facd8 | out: lpFileInformation=0x126facd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1950dc42, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1950dc42, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1950dc42, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd7a00)) returned 1
	[0195.994] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll"), fInfoLevelId=0x0, lpFileInformation=0x126fad28 | out: lpFileInformation=0x126fad28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x194e79e8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x194e79e8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x194e79e8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xeb800)) returned 1
	[0195.994] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\aldelo.exe" (normalized: "c:\\program files\\common files\\aldelo.exe"), fInfoLevelId=0x0, lpFileInformation=0x126fad78 | out: lpFileInformation=0x126fad78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cc510d0, ftCreationTime.dwHighDateTime=0x1d7c167, ftLastAccessTime.dwLowDateTime=0x4ecd1b70, ftLastAccessTime.dwHighDateTime=0x1d7e071, ftLastWriteTime.dwLowDateTime=0x4ecd1b70, ftLastWriteTime.dwHighDateTime=0x1d7e071, nFileSizeHigh=0x0, nFileSizeLow=0x13a00)) returned 1
	[0195.994] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\coreftp.exe" (normalized: "c:\\program files\\common files\\coreftp.exe"), fInfoLevelId=0x0, lpFileInformation=0x126fadc8 | out: lpFileInformation=0x126fadc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf02f470, ftCreationTime.dwHighDateTime=0x1d7e754, ftLastAccessTime.dwLowDateTime=0x63899bf0, ftLastAccessTime.dwHighDateTime=0x1d7e905, ftLastWriteTime.dwLowDateTime=0x63899bf0, ftLastWriteTime.dwHighDateTime=0x1d7e905, nFileSizeHigh=0x0, nFileSizeLow=0x13a00)) returned 1
	[0195.995] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\filezilla.exe" (normalized: "c:\\program files\\common files\\filezilla.exe"), fInfoLevelId=0x0, lpFileInformation=0x126fae18 | out: lpFileInformation=0x126fae18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x476b93c0, ftCreationTime.dwHighDateTime=0x1d7eedb, ftLastAccessTime.dwLowDateTime=0x4d6f2660, ftLastAccessTime.dwHighDateTime=0x1d7f1ba, ftLastWriteTime.dwLowDateTime=0x4d6f2660, ftLastWriteTime.dwHighDateTime=0x1d7f1ba, nFileSizeHigh=0x0, nFileSizeLow=0x13a00)) returned 1
	[0195.995] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared" (normalized: "c:\\program files\\common files\\microsoft shared"), fInfoLevelId=0x0, lpFileInformation=0x126fae68 | out: lpFileInformation=0x126fae68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x1a092147, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1a092147, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0195.995] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared" (normalized: "c:\\program files\\common files\\microsoft shared"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.995] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x1a092147, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1a092147, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fce8
	[0195.995] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x1a092147, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1a092147, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0195.995] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1978a8ad, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1a092147, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1a092147, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClickToRun", cAlternateFileName="CLICKT~1")) returned 1
	[0195.995] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6eba2ec1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1
	[0195.995] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSInfo", cAlternateFileName="")) returned 1
	[0195.996] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6ebef3a1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ebef3a1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1
	[0195.996] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TextConv", cAlternateFileName="")) returned 1
	[0195.996] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Triedit", cAlternateFileName="")) returned 1
	[0195.996] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x21f31071, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0x8ff5df0d, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x8ff5df0d, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC", cAlternateFileName="")) returned 1
	[0195.996] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3056e22, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3056e22, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX", cAlternateFileName="")) returned 1
	[0195.996] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0195.996] FindClose (in: hFindFile=0x79fce8 | out: hFindFile=0x79fce8) returned 1
	[0195.996] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun"), fInfoLevelId=0x0, lpFileInformation=0x126fb138 | out: lpFileInformation=0x126fb138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1978a8ad, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1a092147, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1a092147, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x7000)) returned 1
	[0195.996] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0195.996] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1978a8ad, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1a092147, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1a092147, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fc28
	[0195.999] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1978a8ad, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1a092147, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1a092147, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.000] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a5ac4f, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a5ac4f, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="API-MS~1.DLL")) returned 1
	[0196.000] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a5c162, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a5c162, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="API-MS~2.DLL")) returned 1
	[0196.000] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a5e849, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a5e849, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x52c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="API-MS~3.DLL")) returned 1
	[0196.000] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a5e849, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a5e849, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="API-MS~4.DLL")) returned 1
	[0196.000] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a60f1f, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a60f1f, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="APF10C~1.DLL")) returned 1
	[0196.000] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a62331, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a62331, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="AP7902~1.DLL")) returned 1
	[0196.000] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a648ba, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a648ba, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l2-1-0.dll", cAlternateFileName="APA632~1.DLL")) returned 1
	[0196.000] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a648ba, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a648ba, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-conio-l1-1-0.dll", cAlternateFileName="AP5C76~1.DLL")) returned 1
	[0196.000] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a65c50, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a65c50, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x58c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-convert-l1-1-0.dll", cAlternateFileName="APFD9C~1.DLL")) returned 1
	[0196.000] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a66fb5, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a66fb5, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-environment-l1-1-0.dll", cAlternateFileName="APC00F~1.DLL")) returned 1
	[0196.000] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a6bdf4, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a6bdf4, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x50c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-filesystem-l1-1-0.dll", cAlternateFileName="AP0479~1.DLL")) returned 1
	[0196.000] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a6d16b, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a6d16b, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-heap-l1-1-0.dll", cAlternateFileName="AP23C9~1.DLL")) returned 1
	[0196.000] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a6d16b, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a6d16b, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-locale-l1-1-0.dll", cAlternateFileName="APCB40~1.DLL")) returned 1
	[0196.000] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a6f8fa, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a6f8fa, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-math-l1-1-0.dll", cAlternateFileName="APAE51~1.DLL")) returned 1
	[0196.000] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a70c7b, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a70c7b, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x68c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-multibyte-l1-1-0.dll", cAlternateFileName="AP972F~1.DLL")) returned 1
	[0196.000] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a734f6, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a734f6, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x114c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-private-l1-1-0.dll", cAlternateFileName="AP7D9E~1.DLL")) returned 1
	[0196.000] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a794fc, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a794fc, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-process-l1-1-0.dll", cAlternateFileName="APFCAD~1.DLL")) returned 1
	[0196.000] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a7a850, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a7a850, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x5ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-runtime-l1-1-0.dll", cAlternateFileName="AP8F34~1.DLL")) returned 1
	[0196.000] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a7bc27, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a7bc27, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x60c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-stdio-l1-1-0.dll", cAlternateFileName="APD1B7~1.DLL")) returned 1
	[0196.000] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a7e2f5, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a7e2f5, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x60c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-string-l1-1-0.dll", cAlternateFileName="APBF0F~1.DLL")) returned 1
	[0196.000] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a809e5, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a809e5, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x52c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-time-l1-1-0.dll", cAlternateFileName="AP5E4C~1.DLL")) returned 1
	[0196.000] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a81d5c, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a81d5c, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-utility-l1-1-0.dll", cAlternateFileName="AP80F4~1.DLL")) returned 1
	[0196.001] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a844a0, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a844a0, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1b3e5f00, ftLastWriteTime.dwHighDateTime=0x1d0d7b1, nFileSizeHigh=0x0, nFileSizeLow=0x27c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApiClient.dll", cAlternateFileName="APICLI~1.DLL")) returned 1
	[0196.001] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a8b9db, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a8b9db, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0xfd847a00, ftLastWriteTime.dwHighDateTime=0x1d0b369, nFileSizeHigh=0x0, nFileSizeLow=0xa02d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVCatalog.dll", cAlternateFileName="APPVCA~1.DLL")) returned 1
	[0196.001] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a9a42a, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a9a42a, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0xfeb5a700, ftLastWriteTime.dwHighDateTime=0x1d0b369, nFileSizeHigh=0x0, nFileSizeLow=0x1f5ad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="appvcleaner.exe", cAlternateFileName="APPVCL~1.EXE")) returned 1
	[0196.001] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19ac9e48, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19ac9e48, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0xfeb5a700, ftLastWriteTime.dwHighDateTime=0x1d0b369, nFileSizeHigh=0x0, nFileSizeLow=0x4b0d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVFileSystemMetadata.dll", cAlternateFileName="APPVFI~1.DLL")) returned 1
	[0196.001] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19acffa3, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19acffa3, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0xfeb5a700, ftLastWriteTime.dwHighDateTime=0x1d0b369, nFileSizeHigh=0x0, nFileSizeLow=0x2052d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIntegration.dll", cAlternateFileName="APPVIN~1.DLL")) returned 1
	[0196.001] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19b08232, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19b08232, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0xfeb5a700, ftLastWriteTime.dwHighDateTime=0x1d0b369, nFileSizeHigh=0x0, nFileSizeLow=0x726d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvApi.dll", cAlternateFileName="APPVIS~1.DLL")) returned 1
	[0196.001] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19b158ed, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19b158ed, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x6fdfdb00, ftLastWriteTime.dwHighDateTime=0x1d0d7ad, nFileSizeHigh=0x0, nFileSizeLow=0x60ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvStream32.dll", cAlternateFileName="APPVIS~2.DLL")) returned 1
	[0196.001] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19b1f549, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19b1f549, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x17aad800, ftLastWriteTime.dwHighDateTime=0x1d0d7b1, nFileSizeHigh=0x0, nFileSizeLow=0x73aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvStream64.dll", cAlternateFileName="APPVIS~3.DLL")) returned 1
	[0196.001] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19b2b91a, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19b2b91a, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0xfeb5a700, ftLastWriteTime.dwHighDateTime=0x1d0b369, nFileSizeHigh=0x0, nFileSizeLow=0x336d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvStreamingManager.dll", cAlternateFileName="APPVIS~4.DLL")) returned 1
	[0196.001] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19b30673, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19b30673, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0xfeb5a700, ftLastWriteTime.dwHighDateTime=0x1d0b369, nFileSizeHigh=0x0, nFileSizeLow=0x1566d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvSubsystemController.dll", cAlternateFileName="AP213A~1.DLL")) returned 1
	[0196.001] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19b56423, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19b56423, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x7a9a7000, ftLastWriteTime.dwHighDateTime=0x1d0d7ad, nFileSizeHigh=0x0, nFileSizeLow=0x1ae0a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvSubsystems32.dll", cAlternateFileName="AP3342~1.DLL")) returned 1
	[0196.001] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19ba59a8, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19ba59a8, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1da0b900, ftLastWriteTime.dwHighDateTime=0x1d0d7b1, nFileSizeHigh=0x0, nFileSizeLow=0x22e0a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvSubsystems64.dll", cAlternateFileName="AP4400~1.DLL")) returned 1
	[0196.001] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19be0428, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19be0428, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0xfeb5a700, ftLastWriteTime.dwHighDateTime=0x1d0b369, nFileSizeHigh=0x0, nFileSizeLow=0x8a8d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvVirtualization.dll", cAlternateFileName="AP485B~1.DLL")) returned 1
	[0196.001] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19beed59, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19beed59, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0xfeb5a700, ftLastWriteTime.dwHighDateTime=0x1d0b369, nFileSizeHigh=0x0, nFileSizeLow=0x12cad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVManifest.dll", cAlternateFileName="APPVMA~1.DLL")) returned 1
	[0196.001] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19c09c32, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19c09c32, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0xfeb5a700, ftLastWriteTime.dwHighDateTime=0x1d0b369, nFileSizeHigh=0x0, nFileSizeLow=0xe76d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVOrchestration.dll", cAlternateFileName="APPVOR~1.DLL")) returned 1
	[0196.001] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19c1d355, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19c1d355, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0xfeb5a700, ftLastWriteTime.dwHighDateTime=0x1d0b369, nFileSizeHigh=0x0, nFileSizeLow=0x13c4d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVPolicy.dll", cAlternateFileName="APPVPO~1.DLL")) returned 1
	[0196.001] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19c394bc, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19c394bc, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0xffe6d400, ftLastWriteTime.dwHighDateTime=0x1d0b369, nFileSizeHigh=0x0, nFileSizeLow=0x7d0d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVScripting.dll", cAlternateFileName="APPVSC~1.DLL")) returned 1
	[0196.001] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19c49271, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19c49271, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0xffe6d400, ftLastWriteTime.dwHighDateTime=0x1d0b369, nFileSizeHigh=0x0, nFileSizeLow=0x406d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVShNotify.exe", cAlternateFileName="APPVSH~1.EXE")) returned 1
	[0196.002] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19c50910, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19c50910, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x75d5bc00, ftLastWriteTime.dwHighDateTime=0x1d0d7ad, nFileSizeHigh=0x0, nFileSizeLow=0xc84c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2R32.dll", cAlternateFileName="")) returned 1
	[0196.002] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19c6555f, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19c6555f, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1679ab00, ftLastWriteTime.dwHighDateTime=0x1d0d7b1, nFileSizeHigh=0x0, nFileSizeLow=0x127260, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2R64.dll", cAlternateFileName="")) returned 1
	[0196.002] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19c816e2, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19c816e2, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0xf0a4b700, ftLastWriteTime.dwHighDateTime=0x1d0d687, nFileSizeHigh=0x0, nFileSizeLow=0x1028, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RHeartbeatConfig.xml", cAlternateFileName="C2RHEA~1.XML")) returned 1
	[0196.002] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1978bdaa, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1978bdaa, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x15487e00, ftLastWriteTime.dwHighDateTime=0x1d0d7b1, nFileSizeHigh=0x0, nFileSizeLow=0xdc4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RUI.en-us.dll", cAlternateFileName="C2RUIE~1.DLL")) returned 1
	[0196.002] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19c83c6f, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19c83c6f, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x514a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="concrt140.dll", cAlternateFileName="CONCRT~1.DLL")) returned 1
	[0196.002] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19c8edc1, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19c8edc1, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1f3ca200, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="i640.hash", cAlternateFileName="I640~1.HAS")) returned 1
	[0196.002] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1979a7e9, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1979a7e9, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1e0b7500, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="i641033.hash", cAlternateFileName="I64103~1.HAS")) returned 1
	[0196.002] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19c90080, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19c90080, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x20031300, ftLastWriteTime.dwHighDateTime=0x1d0d7b1, nFileSizeHigh=0x0, nFileSizeLow=0x10ae80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IntegratedOffice.exe", cAlternateFileName="INTEGR~1.EXE")) returned 1
	[0196.002] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19ca605c, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19ca605c, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x4ab8800, ftLastWriteTime.dwHighDateTime=0x1d0b36a, nFileSizeHigh=0x0, nFileSizeLow=0x578d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MavInject32.exe", cAlternateFileName="MAVINJ~1.EXE")) returned 1
	[0196.002] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19cb0fca, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19cb0fca, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x6a38c400, ftLastWriteTime.dwHighDateTime=0x1d0d7b2, nFileSizeHigh=0x0, nFileSizeLow=0x2ffa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso20win32client.dll", cAlternateFileName="MSO20W~1.DLL")) returned 1
	[0196.002] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19cff0e1, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19cff0e1, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x6c9b1e00, ftLastWriteTime.dwHighDateTime=0x1d0d7b2, nFileSizeHigh=0x0, nFileSizeLow=0x475e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso30win32client.dll", cAlternateFileName="MSO30W~1.DLL")) returned 1
	[0196.002] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19d7453b, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19d7453b, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x18dc0500, ftLastWriteTime.dwHighDateTime=0x1d0d7b1, nFileSizeHigh=0x0, nFileSizeLow=0x307ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso40uires.dll", cAlternateFileName="MSO40U~1.DLL")) returned 1
	[0196.002] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19da3f85, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19da3f85, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x7290ff00, ftLastWriteTime.dwHighDateTime=0x1d0d7b2, nFileSizeHigh=0x0, nFileSizeLow=0x8e6060, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso40uiwin32client.dll", cAlternateFileName="MSO40U~2.DLL")) returned 1
	[0196.002] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1979bb4f, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1979bb4f, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x73c22c00, ftLastWriteTime.dwHighDateTime=0x1d0d7b2, nFileSizeHigh=0x0, nFileSizeLow=0xee60, dwReserved0=0x0, dwReserved1=0x0, cFileName="msointl30.en-us.dll", cAlternateFileName="MSOINT~1.DLL")) returned 1
	[0196.002] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19e67619, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19e67619, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x7ace5200, ftLastWriteTime.dwHighDateTime=0x1d098c7, nFileSizeHigh=0x0, nFileSizeLow=0xa12a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp120.dll", cAlternateFileName="")) returned 1
	[0196.002] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19e75ccb, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19e75ccb, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x9b0a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp140.dll", cAlternateFileName="")) returned 1
	[0196.002] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19e838f9, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19e838f9, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x7d30ac00, ftLastWriteTime.dwHighDateTime=0x1d098c7, nFileSizeHigh=0x0, nFileSizeLow=0xeb2a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr120.dll", cAlternateFileName="")) returned 1
	[0196.002] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19e9a811, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19e9a811, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x18dc0500, ftLastWriteTime.dwHighDateTime=0x1d0d7b1, nFileSizeHigh=0x0, nFileSizeLow=0x5b1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeC2RClient.exe", cAlternateFileName="OFFICE~1.EXE")) returned 1
	[0196.002] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19edd8e1, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19edd8e1, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x18dc0500, ftLastWriteTime.dwHighDateTime=0x1d0d7b1, nFileSizeHigh=0x0, nFileSizeLow=0xf34d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeC2RCom.dll", cAlternateFileName="OFFICE~1.DLL")) returned 1
	[0196.002] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19ef7454, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19ef7454, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1ed1e600, ftLastWriteTime.dwHighDateTime=0x1d0d7b1, nFileSizeHigh=0x0, nFileSizeLow=0x2a5e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeClickToRun.exe", cAlternateFileName="OFFICE~2.EXE")) returned 1
	[0196.002] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19f2ba87, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19f2ba87, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0xa6d8c183, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x12ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeUpdateSchedule.xml", cAlternateFileName="OFFICE~1.XML")) returned 1
	[0196.002] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19f331c5, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19f331c5, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0xa80ba793, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x1162, dwReserved0=0x0, dwReserved1=0x0, cFileName="ServiceWatcherSchedule.xml", cAlternateFileName="SERVIC~1.XML")) returned 1
	[0196.003] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19f344fd, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19f344fd, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x20031300, ftLastWriteTime.dwHighDateTime=0x1d0d7b1, nFileSizeHigh=0x0, nFileSizeLow=0x101458, dwReserved0=0x0, dwReserved1=0x0, cFileName="StreamServer.dll", cAlternateFileName="STREAM~1.DLL")) returned 1
	[0196.003] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19f48fa0, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19f48fa0, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0xefec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ucrtbase.dll", cAlternateFileName="")) returned 1
	[0196.003] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19f5ef49, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19f5ef49, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x5f4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vccorlib140.dll", cAlternateFileName="VCCORL~1.DLL")) returned 1
	[0196.003] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19f678d7, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19f678d7, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x15ab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 1
	[0196.003] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.003] FindClose (in: hFindFile=0x79fc28 | out: hFindFile=0x79fc28) returned 1
	[0196.003] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), fInfoLevelId=0x0, lpFileInformation=0x12708648 | out: lpFileInformation=0x12708648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a844a0, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a844a0, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1b3e5f00, ftLastWriteTime.dwHighDateTime=0x1d0d7b1, nFileSizeHigh=0x0, nFileSizeLow=0x27c40)) returned 1
	[0196.003] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), fInfoLevelId=0x0, lpFileInformation=0x12708698 | out: lpFileInformation=0x12708698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a8b9db, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a8b9db, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0xfd847a00, ftLastWriteTime.dwHighDateTime=0x1d0b369, nFileSizeHigh=0x0, nFileSizeLow=0xa02d8)) returned 1
	[0196.003] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), fInfoLevelId=0x0, lpFileInformation=0x127086e8 | out: lpFileInformation=0x127086e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19ac9e48, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19ac9e48, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0xfeb5a700, ftLastWriteTime.dwHighDateTime=0x1d0b369, nFileSizeHigh=0x0, nFileSizeLow=0x4b0d8)) returned 1
	[0196.003] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), fInfoLevelId=0x0, lpFileInformation=0x12708738 | out: lpFileInformation=0x12708738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19acffa3, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19acffa3, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0xfeb5a700, ftLastWriteTime.dwHighDateTime=0x1d0b369, nFileSizeHigh=0x0, nFileSizeLow=0x2052d8)) returned 1
	[0196.004] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), fInfoLevelId=0x0, lpFileInformation=0x12708788 | out: lpFileInformation=0x12708788*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19b08232, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19b08232, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0xfeb5a700, ftLastWriteTime.dwHighDateTime=0x1d0b369, nFileSizeHigh=0x0, nFileSizeLow=0x726d8)) returned 1
	[0196.004] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), fInfoLevelId=0x0, lpFileInformation=0x127087d8 | out: lpFileInformation=0x127087d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19b2b91a, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19b2b91a, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0xfeb5a700, ftLastWriteTime.dwHighDateTime=0x1d0b369, nFileSizeHigh=0x0, nFileSizeLow=0x336d8)) returned 1
	[0196.004] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), fInfoLevelId=0x0, lpFileInformation=0x12708828 | out: lpFileInformation=0x12708828*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19b30673, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19b30673, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0xfeb5a700, ftLastWriteTime.dwHighDateTime=0x1d0b369, nFileSizeHigh=0x0, nFileSizeLow=0x1566d8)) returned 1
	[0196.004] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), fInfoLevelId=0x0, lpFileInformation=0x12708878 | out: lpFileInformation=0x12708878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19be0428, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19be0428, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0xfeb5a700, ftLastWriteTime.dwHighDateTime=0x1d0b369, nFileSizeHigh=0x0, nFileSizeLow=0x8a8d8)) returned 1
	[0196.004] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll"), fInfoLevelId=0x0, lpFileInformation=0x127088c8 | out: lpFileInformation=0x127088c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19beed59, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19beed59, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0xfeb5a700, ftLastWriteTime.dwHighDateTime=0x1d0b369, nFileSizeHigh=0x0, nFileSizeLow=0x12cad8)) returned 1
	[0196.004] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll"), fInfoLevelId=0x0, lpFileInformation=0x12708918 | out: lpFileInformation=0x12708918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19c09c32, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19c09c32, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0xfeb5a700, ftLastWriteTime.dwHighDateTime=0x1d0b369, nFileSizeHigh=0x0, nFileSizeLow=0xe76d8)) returned 1
	[0196.005] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll"), fInfoLevelId=0x0, lpFileInformation=0x12708968 | out: lpFileInformation=0x12708968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19c1d355, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19c1d355, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0xfeb5a700, ftLastWriteTime.dwHighDateTime=0x1d0b369, nFileSizeHigh=0x0, nFileSizeLow=0x13c4d8)) returned 1
	[0196.005] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll"), fInfoLevelId=0x0, lpFileInformation=0x127089b8 | out: lpFileInformation=0x127089b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19c394bc, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19c394bc, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0xffe6d400, ftLastWriteTime.dwHighDateTime=0x1d0b369, nFileSizeHigh=0x0, nFileSizeLow=0x7d0d8)) returned 1
	[0196.009] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe"), fInfoLevelId=0x0, lpFileInformation=0x12708a08 | out: lpFileInformation=0x12708a08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19c49271, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19c49271, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0xffe6d400, ftLastWriteTime.dwHighDateTime=0x1d0b369, nFileSizeHigh=0x0, nFileSizeLow=0x406d8)) returned 1
	[0196.009] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll"), fInfoLevelId=0x0, lpFileInformation=0x12708a58 | out: lpFileInformation=0x12708a58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19b158ed, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19b158ed, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x6fdfdb00, ftLastWriteTime.dwHighDateTime=0x1d0d7ad, nFileSizeHigh=0x0, nFileSizeLow=0x60ea0)) returned 1
	[0196.009] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), fInfoLevelId=0x0, lpFileInformation=0x12708aa8 | out: lpFileInformation=0x12708aa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19b1f549, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19b1f549, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x17aad800, ftLastWriteTime.dwHighDateTime=0x1d0d7b1, nFileSizeHigh=0x0, nFileSizeLow=0x73aa0)) returned 1
	[0196.009] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll"), fInfoLevelId=0x0, lpFileInformation=0x12708af8 | out: lpFileInformation=0x12708af8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19b56423, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19b56423, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x7a9a7000, ftLastWriteTime.dwHighDateTime=0x1d0d7ad, nFileSizeHigh=0x0, nFileSizeLow=0x1ae0a8)) returned 1
	[0196.009] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), fInfoLevelId=0x0, lpFileInformation=0x12708b48 | out: lpFileInformation=0x12708b48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19ba59a8, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19ba59a8, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1da0b900, ftLastWriteTime.dwHighDateTime=0x1d0d7b1, nFileSizeHigh=0x0, nFileSizeLow=0x22e0a8)) returned 1
	[0196.010] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll"), fInfoLevelId=0x0, lpFileInformation=0x12708b98 | out: lpFileInformation=0x12708b98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19c50910, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19c50910, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x75d5bc00, ftLastWriteTime.dwHighDateTime=0x1d0d7ad, nFileSizeHigh=0x0, nFileSizeLow=0xc84c0)) returned 1
	[0196.010] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll"), fInfoLevelId=0x0, lpFileInformation=0x12708be8 | out: lpFileInformation=0x12708be8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19c6555f, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19c6555f, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1679ab00, ftLastWriteTime.dwHighDateTime=0x1d0d7b1, nFileSizeHigh=0x0, nFileSizeLow=0x127260)) returned 1
	[0196.010] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), fInfoLevelId=0x0, lpFileInformation=0x12708c38 | out: lpFileInformation=0x12708c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19c816e2, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19c816e2, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0xf0a4b700, ftLastWriteTime.dwHighDateTime=0x1d0d687, nFileSizeHigh=0x0, nFileSizeLow=0x1028)) returned 1
	[0196.011] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll"), fInfoLevelId=0x0, lpFileInformation=0x12708c88 | out: lpFileInformation=0x12708c88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1978bdaa, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1978bdaa, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x15487e00, ftLastWriteTime.dwHighDateTime=0x1d0d7b1, nFileSizeHigh=0x0, nFileSizeLow=0xdc4b8)) returned 1
	[0196.011] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe"), fInfoLevelId=0x0, lpFileInformation=0x12708cd8 | out: lpFileInformation=0x12708cd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19c90080, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19c90080, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x20031300, ftLastWriteTime.dwHighDateTime=0x1d0d7b1, nFileSizeHigh=0x0, nFileSizeLow=0x10ae80)) returned 1
	[0196.013] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe"), fInfoLevelId=0x0, lpFileInformation=0x12708d28 | out: lpFileInformation=0x12708d28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19ca605c, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19ca605c, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x4ab8800, ftLastWriteTime.dwHighDateTime=0x1d0b36a, nFileSizeHigh=0x0, nFileSizeLow=0x578d8)) returned 1
	[0196.014] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), fInfoLevelId=0x0, lpFileInformation=0x12708d78 | out: lpFileInformation=0x12708d78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19e9a811, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19e9a811, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x18dc0500, ftLastWriteTime.dwHighDateTime=0x1d0d7b1, nFileSizeHigh=0x0, nFileSizeLow=0x5b1068)) returned 1
	[0196.014] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll"), fInfoLevelId=0x0, lpFileInformation=0x12708dc8 | out: lpFileInformation=0x12708dc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19edd8e1, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19edd8e1, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x18dc0500, ftLastWriteTime.dwHighDateTime=0x1d0d7b1, nFileSizeHigh=0x0, nFileSizeLow=0xf34d8)) returned 1
	[0196.015] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), fInfoLevelId=0x0, lpFileInformation=0x12708e18 | out: lpFileInformation=0x12708e18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19ef7454, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19ef7454, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1ed1e600, ftLastWriteTime.dwHighDateTime=0x1d0d7b1, nFileSizeHigh=0x0, nFileSizeLow=0x2a5e58)) returned 1
	[0196.015] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), fInfoLevelId=0x0, lpFileInformation=0x12708e68 | out: lpFileInformation=0x12708e68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19f2ba87, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19f2ba87, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0xa6d8c183, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x12ae)) returned 1
	[0196.018] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), fInfoLevelId=0x0, lpFileInformation=0x12708eb8 | out: lpFileInformation=0x12708eb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19f331c5, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19f331c5, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0xa80ba793, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x1162)) returned 1
	[0196.032] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll"), fInfoLevelId=0x0, lpFileInformation=0x12708f08 | out: lpFileInformation=0x12708f08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19f344fd, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19f344fd, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x20031300, ftLastWriteTime.dwHighDateTime=0x1d0d7b1, nFileSizeHigh=0x0, nFileSizeLow=0x101458)) returned 1
	[0196.032] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll"), fInfoLevelId=0x0, lpFileInformation=0x12708f58 | out: lpFileInformation=0x12708f58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a5ac4f, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a5ac4f, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x48c0)) returned 1
	[0196.032] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), fInfoLevelId=0x0, lpFileInformation=0x12708fa8 | out: lpFileInformation=0x12708fa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a5c162, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a5c162, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x48c0)) returned 1
	[0196.032] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), fInfoLevelId=0x0, lpFileInformation=0x12708ff8 | out: lpFileInformation=0x12708ff8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a5e849, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a5e849, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x52c0)) returned 1
	[0196.032] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), fInfoLevelId=0x0, lpFileInformation=0x12709048 | out: lpFileInformation=0x12709048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a5e849, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a5e849, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0)) returned 1
	[0196.035] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll"), fInfoLevelId=0x0, lpFileInformation=0x12709098 | out: lpFileInformation=0x12709098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a60f1f, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a60f1f, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0)) returned 1
	[0196.035] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), fInfoLevelId=0x0, lpFileInformation=0x127090e8 | out: lpFileInformation=0x127090e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a62331, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a62331, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x48c0)) returned 1
	[0196.035] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), fInfoLevelId=0x0, lpFileInformation=0x12709138 | out: lpFileInformation=0x12709138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a648ba, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a648ba, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x2d60)) returned 1
	[0196.036] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll"), fInfoLevelId=0x0, lpFileInformation=0x12709188 | out: lpFileInformation=0x12709188*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a648ba, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a648ba, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0)) returned 1
	[0196.037] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll"), fInfoLevelId=0x0, lpFileInformation=0x127091d8 | out: lpFileInformation=0x127091d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a65c50, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a65c50, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x58c0)) returned 1
	[0196.037] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll"), fInfoLevelId=0x0, lpFileInformation=0x12709228 | out: lpFileInformation=0x12709228*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a66fb5, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a66fb5, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0)) returned 1
	[0196.038] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll"), fInfoLevelId=0x0, lpFileInformation=0x12709278 | out: lpFileInformation=0x12709278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a6bdf4, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a6bdf4, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x50c0)) returned 1
	[0196.039] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll"), fInfoLevelId=0x0, lpFileInformation=0x127092c8 | out: lpFileInformation=0x127092c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a6d16b, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a6d16b, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0)) returned 1
	[0196.039] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll"), fInfoLevelId=0x0, lpFileInformation=0x12709318 | out: lpFileInformation=0x12709318*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a6d16b, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a6d16b, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0)) returned 1
	[0196.039] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll"), fInfoLevelId=0x0, lpFileInformation=0x12709368 | out: lpFileInformation=0x12709368*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a6f8fa, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a6f8fa, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0)) returned 1
	[0196.039] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll"), fInfoLevelId=0x0, lpFileInformation=0x127093b8 | out: lpFileInformation=0x127093b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a70c7b, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a70c7b, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x68c0)) returned 1
	[0196.041] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll"), fInfoLevelId=0x0, lpFileInformation=0x12709408 | out: lpFileInformation=0x12709408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a734f6, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a734f6, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x114c0)) returned 1
	[0196.042] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll"), fInfoLevelId=0x0, lpFileInformation=0x12709458 | out: lpFileInformation=0x12709458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a794fc, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a794fc, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0)) returned 1
	[0196.042] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll"), fInfoLevelId=0x0, lpFileInformation=0x127094a8 | out: lpFileInformation=0x127094a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a7a850, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a7a850, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x5ac0)) returned 1
	[0196.042] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll"), fInfoLevelId=0x0, lpFileInformation=0x127094f8 | out: lpFileInformation=0x127094f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a7bc27, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a7bc27, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x60c0)) returned 1
	[0196.042] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll"), fInfoLevelId=0x0, lpFileInformation=0x12709548 | out: lpFileInformation=0x12709548*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a7e2f5, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a7e2f5, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x60c0)) returned 1
	[0196.043] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll"), fInfoLevelId=0x0, lpFileInformation=0x12709598 | out: lpFileInformation=0x12709598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a809e5, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a809e5, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x52c0)) returned 1
	[0196.044] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll"), fInfoLevelId=0x0, lpFileInformation=0x127095e8 | out: lpFileInformation=0x127095e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a81d5c, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a81d5c, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0)) returned 1
	[0196.045] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), fInfoLevelId=0x0, lpFileInformation=0x12709638 | out: lpFileInformation=0x12709638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a9a42a, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19a9a42a, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0xfeb5a700, ftLastWriteTime.dwHighDateTime=0x1d0b369, nFileSizeHigh=0x0, nFileSizeLow=0x1f5ad8)) returned 1
	[0196.045] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll"), fInfoLevelId=0x0, lpFileInformation=0x12709688 | out: lpFileInformation=0x12709688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19c83c6f, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19c83c6f, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x514a8)) returned 1
	[0196.045] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), fInfoLevelId=0x0, lpFileInformation=0x127096d8 | out: lpFileInformation=0x127096d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19c8edc1, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19c8edc1, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1f3ca200, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x66)) returned 1
	[0196.046] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash"), fInfoLevelId=0x0, lpFileInformation=0x12709728 | out: lpFileInformation=0x12709728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1979a7e9, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1979a7e9, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1e0b7500, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x66)) returned 1
	[0196.046] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), fInfoLevelId=0x0, lpFileInformation=0x12709778 | out: lpFileInformation=0x12709778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19cb0fca, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19cb0fca, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x6a38c400, ftLastWriteTime.dwHighDateTime=0x1d0d7b2, nFileSizeHigh=0x0, nFileSizeLow=0x2ffa60)) returned 1
	[0196.046] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), fInfoLevelId=0x0, lpFileInformation=0x127097c8 | out: lpFileInformation=0x127097c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19cff0e1, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19cff0e1, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x6c9b1e00, ftLastWriteTime.dwHighDateTime=0x1d0d7b2, nFileSizeHigh=0x0, nFileSizeLow=0x475e60)) returned 1
	[0196.046] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), fInfoLevelId=0x0, lpFileInformation=0x12709818 | out: lpFileInformation=0x12709818*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19d7453b, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19d7453b, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x18dc0500, ftLastWriteTime.dwHighDateTime=0x1d0d7b1, nFileSizeHigh=0x0, nFileSizeLow=0x307ac0)) returned 1
	[0196.046] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), fInfoLevelId=0x0, lpFileInformation=0x12709868 | out: lpFileInformation=0x12709868*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19da3f85, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19da3f85, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x7290ff00, ftLastWriteTime.dwHighDateTime=0x1d0d7b2, nFileSizeHigh=0x0, nFileSizeLow=0x8e6060)) returned 1
	[0196.046] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll"), fInfoLevelId=0x0, lpFileInformation=0x127098b8 | out: lpFileInformation=0x127098b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1979bb4f, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1979bb4f, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x73c22c00, ftLastWriteTime.dwHighDateTime=0x1d0d7b2, nFileSizeHigh=0x0, nFileSizeLow=0xee60)) returned 1
	[0196.047] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll"), fInfoLevelId=0x0, lpFileInformation=0x12709908 | out: lpFileInformation=0x12709908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19e67619, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19e67619, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x7ace5200, ftLastWriteTime.dwHighDateTime=0x1d098c7, nFileSizeHigh=0x0, nFileSizeLow=0xa12a8)) returned 1
	[0196.047] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll"), fInfoLevelId=0x0, lpFileInformation=0x12709958 | out: lpFileInformation=0x12709958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19e75ccb, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19e75ccb, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x9b0a0)) returned 1
	[0196.047] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll"), fInfoLevelId=0x0, lpFileInformation=0x127099a8 | out: lpFileInformation=0x127099a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19e838f9, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19e838f9, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x7d30ac00, ftLastWriteTime.dwHighDateTime=0x1d098c7, nFileSizeHigh=0x0, nFileSizeLow=0xeb2a8)) returned 1
	[0196.047] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll"), fInfoLevelId=0x0, lpFileInformation=0x127099f8 | out: lpFileInformation=0x127099f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19f48fa0, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19f48fa0, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0xefec0)) returned 1
	[0196.050] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll"), fInfoLevelId=0x0, lpFileInformation=0x12709a48 | out: lpFileInformation=0x12709a48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19f5ef49, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19f5ef49, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x5f4b0)) returned 1
	[0196.050] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll"), fInfoLevelId=0x0, lpFileInformation=0x12709a98 | out: lpFileInformation=0x12709a98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19f678d7, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x19f678d7, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x588a4500, ftLastWriteTime.dwHighDateTime=0x1d0c595, nFileSizeHigh=0x0, nFileSizeLow=0x15ab0)) returned 1
	[0196.050] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo"), fInfoLevelId=0x0, lpFileInformation=0x12709ae8 | out: lpFileInformation=0x12709ae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.052] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.052] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79faa8
	[0196.052] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.052] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0196.052] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14f772ff, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x14f772ff, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x14f772ff, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x5bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1
	[0196.053] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.053] FindClose (in: hFindFile=0x79faa8 | out: hFindFile=0x79faa8) returned 1
	[0196.053] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x12709bd8 | out: lpFileInformation=0x12709bd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.056] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fe28
	[0196.056] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.056] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9baea5b3, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9baea5b3, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9baea5b3, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x7600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1
	[0196.056] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.057] FindClose (in: hFindFile=0x79fe28 | out: hFindFile=0x79fe28) returned 1
	[0196.057] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x12709c78 | out: lpFileInformation=0x12709c78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9baea5b3, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9baea5b3, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9baea5b3, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x7600)) returned 1
	[0196.176] SetEvent (hEvent=0x168) returned 1
	[0196.176] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), fInfoLevelId=0x0, lpFileInformation=0x12709cc8 | out: lpFileInformation=0x12709cc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14f772ff, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x14f772ff, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x14f772ff, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x5bc00)) returned 1
	[0196.267] SetEvent (hEvent=0x168) returned 1
	[0196.268] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery"), fInfoLevelId=0x0, lpFileInformation=0x12709d18 | out: lpFileInformation=0x12709d18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6ebef3a1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ebef3a1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.268] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.268] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6ebef3a1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ebef3a1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9e8
	[0196.273] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6ebef3a1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ebef3a1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.274] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3154ed, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f3154ed, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f33b748, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1
	[0196.274] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f33b748, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f33b748, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f33b748, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1
	[0196.274] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585b5cfd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x585b5cfd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x585b5cfd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Blue_Gradient.jpg", cAlternateFileName="")) returned 1
	[0196.274] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5858faa2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5858faa2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x585b5cfd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x11eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cave_Drawings.gif", cAlternateFileName="")) returned 1
	[0196.274] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5856984c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5856984c, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5856984c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x90f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connectivity.gif", cAlternateFileName="")) returned 1
	[0196.274] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3030bc4, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97067fbb, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97067fbb, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0196.274] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585b5cfd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x585b5cfd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x585b5cfd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dotted_Lines.emf", cAlternateFileName="")) returned 1
	[0196.274] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f33b748, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f33b748, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f33b748, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.htm", cAlternateFileName="")) returned 1
	[0196.274] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f33b748, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f33b748, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f33b748, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 1
	[0196.274] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5858faa2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6746c149, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6746c149, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1594, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_1.emf", cAlternateFileName="")) returned 1
	[0196.274] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5858faa2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x67445fa7, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x67445fa7, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2864, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_2.emf", cAlternateFileName="")) returned 1
	[0196.275] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5858faa2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x675c36e7, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x675c36e7, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1c7f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Graph.emf", cAlternateFileName="")) returned 1
	[0196.275] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f33b748, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f33b748, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f33b748, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Green Bubbles.htm", cAlternateFileName="")) returned 1
	[0196.275] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3619a2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f3619a2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f3619a2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x0, cFileName="GreenBubbles.jpg", cAlternateFileName="")) returned 1
	[0196.275] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x585dbf53, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x585dbf53, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="grid_(cm).wmf", cAlternateFileName="")) returned 1
	[0196.275] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5856984c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x673f9afd, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x673f9afd, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1d4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="grid_(inch).wmf", cAlternateFileName="")) returned 1
	[0196.275] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f33b748, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f33b748, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f33b748, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hand Prints.htm", cAlternateFileName="")) returned 1
	[0196.275] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f33b748, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f33b748, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f33b748, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HandPrints.jpg", cAlternateFileName="")) returned 1
	[0196.275] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x677670bc, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6778d31e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x252ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memo.emf", cAlternateFileName="")) returned 1
	[0196.275] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x585dbf53, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x585dbf53, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Monet.jpg", cAlternateFileName="")) returned 1
	[0196.275] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6771ac06, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6771ac06, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1060, dwReserved0=0x0, dwReserved1=0x0, cFileName="Month_Calendar.emf", cAlternateFileName="")) returned 1
	[0196.275] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5856984c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x673f9afd, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x673f9afd, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x65b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music.emf", cAlternateFileName="")) returned 1
	[0196.275] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5858faa2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5858faa2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5858faa2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notebook.jpg", cAlternateFileName="")) returned 1
	[0196.275] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3619a2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f3619a2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f3619a2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Orange Circles.htm", cAlternateFileName="")) returned 1
	[0196.275] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3154ed, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f3154ed, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f3154ed, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrangeCircles.jpg", cAlternateFileName="")) returned 1
	[0196.275] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3619a2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f3619a2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f3619a2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.htm", cAlternateFileName="")) returned 1
	[0196.275] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3619a2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f3619a2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f3619a2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1
	[0196.275] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5858faa2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5858faa2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5858faa2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pine_Lumber.jpg", cAlternateFileName="")) returned 1
	[0196.275] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x585dbf53, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x585dbf53, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pretty_Peacock.jpg", cAlternateFileName="")) returned 1
	[0196.275] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5856984c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5856984c, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5856984c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x36e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Psychedelic.jpg", cAlternateFileName="")) returned 1
	[0196.275] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3619a2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f3619a2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f3619a2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.htm", cAlternateFileName="")) returned 1
	[0196.276] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3619a2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f3619a2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f3619a2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.jpg", cAlternateFileName="")) returned 1
	[0196.276] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x585dbf53, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x585dbf53, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sand_Paper.jpg", cAlternateFileName="")) returned 1
	[0196.276] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585b5cfd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x675e9965, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x675e9965, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x91c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Seyes.emf", cAlternateFileName="")) returned 1
	[0196.276] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3619a2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f3619a2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f3619a2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shades of Blue.htm", cAlternateFileName="")) returned 1
	[0196.276] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f33b748, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f33b748, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f33b748, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="")) returned 1
	[0196.276] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5858faa2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x674923a8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x674923a8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x13d8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shorthand.emf", cAlternateFileName="")) returned 1
	[0196.276] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585b5cfd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x585b5cfd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x585b5cfd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Small_News.jpg", cAlternateFileName="")) returned 1
	[0196.276] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3154ed, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f3154ed, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f3154ed, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Soft Blue.htm", cAlternateFileName="")) returned 1
	[0196.276] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f33b748, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f33b748, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f33b748, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1
	[0196.276] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f33b748, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f33b748, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f33b748, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.htm", cAlternateFileName="")) returned 1
	[0196.276] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f33b748, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f33b748, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f33b748, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 1
	[0196.276] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585b5cfd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x585b5cfd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x585b5cfd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x748, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stucco.gif", cAlternateFileName="")) returned 1
	[0196.276] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5856984c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5856984c, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5856984c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xe42, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tanspecks.jpg", cAlternateFileName="")) returned 1
	[0196.276] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585b5cfd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x585b5cfd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x585b5cfd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x121e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tiki.gif", cAlternateFileName="")) returned 1
	[0196.276] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585b5cfd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x675c36e7, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x675c36e7, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x6860, dwReserved0=0x0, dwReserved1=0x0, cFileName="To_Do_List.emf", cAlternateFileName="")) returned 1
	[0196.276] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5856984c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5856984c, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5856984c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc60, dwReserved0=0x0, dwReserved1=0x0, cFileName="White_Chocolate.jpg", cAlternateFileName="")) returned 1
	[0196.276] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x585dbf53, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x585dbf53, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 1
	[0196.276] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.276] FindClose (in: hFindFile=0x79f9e8 | out: hFindFile=0x79f9e8) returned 1
	[0196.277] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), fInfoLevelId=0x0, lpFileInformation=0x12726c88 | out: lpFileInformation=0x12726c88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3154ed, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f3154ed, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f33b748, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xff)) returned 1
	[0196.280] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), fInfoLevelId=0x0, lpFileInformation=0x12726cd8 | out: lpFileInformation=0x12726cd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f33b748, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f33b748, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f33b748, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x432)) returned 1
	[0196.289] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), fInfoLevelId=0x0, lpFileInformation=0x12726d28 | out: lpFileInformation=0x12726d28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585b5cfd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x585b5cfd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x585b5cfd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa0f)) returned 1
	[0196.289] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), fInfoLevelId=0x0, lpFileInformation=0x12726d78 | out: lpFileInformation=0x12726d78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5858faa2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5858faa2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x585b5cfd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x11eb)) returned 1
	[0196.294] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), fInfoLevelId=0x0, lpFileInformation=0x12726dc8 | out: lpFileInformation=0x12726dc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5856984c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5856984c, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5856984c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x90f)) returned 1
	[0196.294] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x12726e18 | out: lpFileInformation=0x12726e18*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3030bc4, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97067fbb, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97067fbb, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x285)) returned 1
	[0196.297] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), fInfoLevelId=0x0, lpFileInformation=0x12726e68 | out: lpFileInformation=0x12726e68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585b5cfd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x585b5cfd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x585b5cfd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xed0)) returned 1
	[0196.297] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), fInfoLevelId=0x0, lpFileInformation=0x12726eb8 | out: lpFileInformation=0x12726eb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f33b748, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f33b748, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f33b748, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xe7)) returned 1
	[0196.298] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), fInfoLevelId=0x0, lpFileInformation=0x12726f08 | out: lpFileInformation=0x12726f08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f33b748, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f33b748, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f33b748, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f)) returned 1
	[0196.310] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), fInfoLevelId=0x0, lpFileInformation=0x12726f58 | out: lpFileInformation=0x12726f58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5858faa2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6746c149, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6746c149, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1594)) returned 1
	[0196.310] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), fInfoLevelId=0x0, lpFileInformation=0x12726fa8 | out: lpFileInformation=0x12726fa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5858faa2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x67445fa7, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x67445fa7, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2864)) returned 1
	[0196.310] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), fInfoLevelId=0x0, lpFileInformation=0x12726ff8 | out: lpFileInformation=0x12726ff8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5858faa2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x675c36e7, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x675c36e7, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1c7f4)) returned 1
	[0196.312] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), fInfoLevelId=0x0, lpFileInformation=0x12727048 | out: lpFileInformation=0x12727048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f33b748, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f33b748, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f33b748, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xed)) returned 1
	[0196.315] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), fInfoLevelId=0x0, lpFileInformation=0x12727098 | out: lpFileInformation=0x12727098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3619a2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f3619a2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f3619a2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1906)) returned 1
	[0196.339] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), fInfoLevelId=0x0, lpFileInformation=0x127270e8 | out: lpFileInformation=0x127270e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f33b748, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f33b748, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f33b748, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xeb)) returned 1
	[0196.339] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), fInfoLevelId=0x0, lpFileInformation=0x12727138 | out: lpFileInformation=0x12727138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f33b748, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f33b748, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f33b748, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x107e)) returned 1
	[0196.342] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), fInfoLevelId=0x0, lpFileInformation=0x12727188 | out: lpFileInformation=0x12727188*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x677670bc, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6778d31e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x252ec)) returned 1
	[0196.344] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg"), fInfoLevelId=0x0, lpFileInformation=0x127271d8 | out: lpFileInformation=0x127271d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x585dbf53, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x585dbf53, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8a1)) returned 1
	[0196.344] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf"), fInfoLevelId=0x0, lpFileInformation=0x12727228 | out: lpFileInformation=0x12727228*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6771ac06, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6771ac06, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1060)) returned 1
	[0196.344] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf"), fInfoLevelId=0x0, lpFileInformation=0x12727278 | out: lpFileInformation=0x12727278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5856984c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x673f9afd, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x673f9afd, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x65b4)) returned 1
	[0196.346] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), fInfoLevelId=0x0, lpFileInformation=0x127272c8 | out: lpFileInformation=0x127272c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5858faa2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5858faa2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5858faa2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb86)) returned 1
	[0196.346] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), fInfoLevelId=0x0, lpFileInformation=0x12727318 | out: lpFileInformation=0x12727318*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3619a2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f3619a2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f3619a2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xed)) returned 1
	[0196.346] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), fInfoLevelId=0x0, lpFileInformation=0x12727368 | out: lpFileInformation=0x12727368*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3154ed, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f3154ed, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f3154ed, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x18ed)) returned 1
	[0196.351] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), fInfoLevelId=0x0, lpFileInformation=0x127273b8 | out: lpFileInformation=0x127273b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3619a2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f3619a2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f3619a2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xe8)) returned 1
	[0196.351] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), fInfoLevelId=0x0, lpFileInformation=0x12727408 | out: lpFileInformation=0x12727408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3619a2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f3619a2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f3619a2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13fb)) returned 1
	[0196.351] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), fInfoLevelId=0x0, lpFileInformation=0x12727458 | out: lpFileInformation=0x12727458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5858faa2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5858faa2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5858faa2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf8d)) returned 1
	[0196.352] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), fInfoLevelId=0x0, lpFileInformation=0x127274a8 | out: lpFileInformation=0x127274a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x585dbf53, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x585dbf53, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13fb)) returned 1
	[0196.353] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), fInfoLevelId=0x0, lpFileInformation=0x127274f8 | out: lpFileInformation=0x127274f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5856984c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5856984c, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5856984c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x36e1)) returned 1
	[0196.353] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), fInfoLevelId=0x0, lpFileInformation=0x12727548 | out: lpFileInformation=0x12727548*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3619a2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f3619a2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f3619a2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xe9)) returned 1
	[0196.353] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), fInfoLevelId=0x0, lpFileInformation=0x12727598 | out: lpFileInformation=0x12727598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3619a2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f3619a2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f3619a2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x780)) returned 1
	[0196.353] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg"), fInfoLevelId=0x0, lpFileInformation=0x127275e8 | out: lpFileInformation=0x127275e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x585dbf53, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x585dbf53, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3da0)) returned 1
	[0196.353] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf"), fInfoLevelId=0x0, lpFileInformation=0x12727638 | out: lpFileInformation=0x12727638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585b5cfd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x675e9965, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x675e9965, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x91c4)) returned 1
	[0196.355] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), fInfoLevelId=0x0, lpFileInformation=0x12727688 | out: lpFileInformation=0x12727688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3619a2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f3619a2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f3619a2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xed)) returned 1
	[0196.356] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), fInfoLevelId=0x0, lpFileInformation=0x127276d8 | out: lpFileInformation=0x127276d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f33b748, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f33b748, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f33b748, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x127e)) returned 1
	[0196.358] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf"), fInfoLevelId=0x0, lpFileInformation=0x12727728 | out: lpFileInformation=0x12727728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5858faa2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x674923a8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x674923a8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x13d8c)) returned 1
	[0196.360] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), fInfoLevelId=0x0, lpFileInformation=0x12727778 | out: lpFileInformation=0x12727778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585b5cfd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x585b5cfd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x585b5cfd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x7c6)) returned 1
	[0196.361] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), fInfoLevelId=0x0, lpFileInformation=0x127277c8 | out: lpFileInformation=0x127277c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3154ed, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f3154ed, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f3154ed, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xe8)) returned 1
	[0196.361] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), fInfoLevelId=0x0, lpFileInformation=0x12727818 | out: lpFileInformation=0x12727818*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f33b748, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f33b748, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f33b748, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2949)) returned 1
	[0196.363] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), fInfoLevelId=0x0, lpFileInformation=0x12727868 | out: lpFileInformation=0x12727868*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f33b748, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f33b748, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f33b748, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xe6)) returned 1
	[0196.363] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), fInfoLevelId=0x0, lpFileInformation=0x127278b8 | out: lpFileInformation=0x127278b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f33b748, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f33b748, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f33b748, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d51)) returned 1
	[0196.363] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif"), fInfoLevelId=0x0, lpFileInformation=0x12727908 | out: lpFileInformation=0x12727908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585b5cfd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x585b5cfd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x585b5cfd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x748)) returned 1
	[0196.363] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg"), fInfoLevelId=0x0, lpFileInformation=0x12727958 | out: lpFileInformation=0x12727958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5856984c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5856984c, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5856984c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xe42)) returned 1
	[0196.363] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif"), fInfoLevelId=0x0, lpFileInformation=0x127279a8 | out: lpFileInformation=0x127279a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585b5cfd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x585b5cfd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x585b5cfd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x121e)) returned 1
	[0196.364] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf"), fInfoLevelId=0x0, lpFileInformation=0x127279f8 | out: lpFileInformation=0x127279f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585b5cfd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x675c36e7, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x675c36e7, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x6860)) returned 1
	[0196.364] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg"), fInfoLevelId=0x0, lpFileInformation=0x12727a48 | out: lpFileInformation=0x12727a48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5856984c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5856984c, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5856984c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc60)) returned 1
	[0196.364] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), fInfoLevelId=0x0, lpFileInformation=0x12727a98 | out: lpFileInformation=0x12727a98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x585dbf53, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x585dbf53, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7)) returned 1
	[0196.364] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), fInfoLevelId=0x0, lpFileInformation=0x12727ae8 | out: lpFileInformation=0x12727ae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x585dbf53, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x585dbf53, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb68)) returned 1
	[0196.364] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), fInfoLevelId=0x0, lpFileInformation=0x12727b38 | out: lpFileInformation=0x12727b38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5856984c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x673f9afd, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x673f9afd, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1d4a)) returned 1
	[0196.365] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\TextConv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv"), fInfoLevelId=0x0, lpFileInformation=0x12727b88 | out: lpFileInformation=0x12727b88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\TextConv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.365] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fb28
	[0196.365] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.365] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0196.365] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.365] FindClose (in: hFindFile=0x79fb28 | out: hFindFile=0x79fb28) returned 1
	[0196.366] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\en-US" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x12727c28 | out: lpFileInformation=0x12727c28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.366] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\en-US" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.366] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\en-US\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9a8
	[0196.366] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.366] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.366] FindClose (in: hFindFile=0x79f9a8 | out: hFindFile=0x79f9a8) returned 1
	[0196.366] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Triedit" (normalized: "c:\\program files\\common files\\microsoft shared\\triedit"), fInfoLevelId=0x0, lpFileInformation=0x12727c78 | out: lpFileInformation=0x12727c78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Triedit" (normalized: "c:\\program files\\common files\\microsoft shared\\triedit"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.368] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0028
	[0196.368] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.368] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0196.368] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.368] FindClose (in: hFindFile=0x7a0028 | out: hFindFile=0x7a0028) returned 1
	[0196.368] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\en-US" (normalized: "c:\\program files\\common files\\microsoft shared\\triedit\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x12727d18 | out: lpFileInformation=0x12727d18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\en-US" (normalized: "c:\\program files\\common files\\microsoft shared\\triedit\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.368] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\en-US\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fd28
	[0196.369] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1e1d1c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd1e1d1c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd1e1d1c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.369] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.369] FindClose (in: hFindFile=0x79fd28 | out: hFindFile=0x79fd28) returned 1
	[0196.369] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC" (normalized: "c:\\program files\\common files\\microsoft shared\\vc"), fInfoLevelId=0x0, lpFileInformation=0x12727d68 | out: lpFileInformation=0x12727d68*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x21f31071, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0x8ff5df0d, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x8ff5df0d, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.372] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC" (normalized: "c:\\program files\\common files\\microsoft shared\\vc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.372] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x21f31071, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0x8ff5df0d, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x8ff5df0d, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79faa8
	[0196.372] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x21f31071, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0x8ff5df0d, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x8ff5df0d, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.372] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39d6e600, ftCreationTime.dwHighDateTime=0x1cbd07f, ftLastAccessTime.dwLowDateTime=0x32a39c72, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x39d6e600, ftLastWriteTime.dwHighDateTime=0x1cbd07f, nFileSizeHigh=0x0, nFileSizeLow=0xf1b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia100.dll", cAlternateFileName="")) returned 1
	[0196.372] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31ace400, ftCreationTime.dwHighDateTime=0x1cbfe3f, ftLastAccessTime.dwLowDateTime=0x8ff72c46, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x31ace400, ftLastWriteTime.dwHighDateTime=0x1cbfe3f, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 1
	[0196.372] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.372] FindClose (in: hFindFile=0x79faa8 | out: hFindFile=0x79faa8) returned 1
	[0196.372] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), fInfoLevelId=0x0, lpFileInformation=0x12727e58 | out: lpFileInformation=0x12727e58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39d6e600, ftCreationTime.dwHighDateTime=0x1cbd07f, ftLastAccessTime.dwLowDateTime=0x32a39c72, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x39d6e600, ftLastWriteTime.dwHighDateTime=0x1cbd07f, nFileSizeHigh=0x0, nFileSizeLow=0xf1b50)) returned 1
	[0196.375] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), fInfoLevelId=0x0, lpFileInformation=0x12727ea8 | out: lpFileInformation=0x12727ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31ace400, ftCreationTime.dwHighDateTime=0x1cbfe3f, ftLastAccessTime.dwLowDateTime=0x8ff72c46, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x31ace400, ftLastWriteTime.dwHighDateTime=0x1cbfe3f, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50)) returned 1
	[0196.377] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VGX" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx"), fInfoLevelId=0x0, lpFileInformation=0x12727ef8 | out: lpFileInformation=0x12727ef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3056e22, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3056e22, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VGX" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.377] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3056e22, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3056e22, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ff68
	[0196.378] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3056e22, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3056e22, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.378] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3425ad8f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x3425ad8f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x3425ad8f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 1
	[0196.378] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.378] FindClose (in: hFindFile=0x79ff68 | out: hFindFile=0x79ff68) returned 1
	[0196.378] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll"), fInfoLevelId=0x0, lpFileInformation=0x12727f98 | out: lpFileInformation=0x12727f98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3425ad8f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x3425ad8f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x3425ad8f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf7200)) returned 1
	[0196.378] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink" (normalized: "c:\\program files\\common files\\microsoft shared\\ink"), fInfoLevelId=0x0, lpFileInformation=0x12744008 | out: lpFileInformation=0x12744008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6eba2ec1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1
	[0196.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink" (normalized: "c:\\program files\\common files\\microsoft shared\\ink"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.378] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6eba2ec1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fca8
	[0196.381] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6eba2ec1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.381] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x691089ac, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6912ebfc, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xc137d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1
	[0196.381] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1
	[0196.381] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1
	[0196.381] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x691c76a3, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x691c76a3, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1
	[0196.381] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1
	[0196.381] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0196.381] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0196.381] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0196.381] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1
	[0196.381] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6eba2ec1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0196.381] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0196.381] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1
	[0196.381] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1
	[0196.381] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0196.381] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37da94b9, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5ab195d5, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5abb1fd7, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1
	[0196.382] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37da94b9, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5abd7ff0, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5ac24455, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xc5400, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1
	[0196.382] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CA", cAlternateFileName="")) returned 1
	[0196.382] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0196.382] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1
	[0196.382] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1
	[0196.382] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1
	[0196.382] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0196.382] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37dcf714, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x67f00a1f, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x67f00a1f, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1
	[0196.382] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6eba2ec1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1
	[0196.382] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f3614fe, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xd31b567d, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xd31db8ce, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x77fd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1
	[0196.382] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37dcf714, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x67f26c7e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x67fbf5f5, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x10cb30, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1
	[0196.382] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f4200b7, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xd3417c6c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xd3548f4a, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x2646a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1
	[0196.382] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f3f9e60, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xd3227d93, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xd33cb79b, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x35ce20, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1
	[0196.382] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f256931, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f256931, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f256931, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x5bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1
	[0196.382] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f256931, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f256931, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f256931, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1fda00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll", cAlternateFileName="")) returned 1
	[0196.382] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e68076, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x691ed82a, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x69213a47, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x5c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1
	[0196.382] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x972, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsar.xml", cAlternateFileName="")) returned 1
	[0196.382] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscat.xml", cAlternateFileName="")) returned 1
	[0196.382] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipschs.xml", cAlternateFileName="")) returned 1
	[0196.382] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscht.xml", cAlternateFileName="")) returned 1
	[0196.382] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1
	[0196.382] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1
	[0196.382] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdeu.xml", cAlternateFileName="")) returned 1
	[0196.383] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsel.xml", cAlternateFileName="")) returned 1
	[0196.383] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsen.xml", cAlternateFileName="")) returned 1
	[0196.383] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsesp.xml", cAlternateFileName="")) returned 1
	[0196.383] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e68076, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll", cAlternateFileName="")) returned 1
	[0196.383] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfin.xml", cAlternateFileName="")) returned 1
	[0196.383] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfra.xml", cAlternateFileName="")) returned 1
	[0196.383] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshe.xml", cAlternateFileName="")) returned 1
	[0196.383] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshi.xml", cAlternateFileName="")) returned 1
	[0196.383] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshrv.xml", cAlternateFileName="")) returned 1
	[0196.383] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e68076, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e68076, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e68076, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsid.xml", cAlternateFileName="")) returned 1
	[0196.383] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsita.xml", cAlternateFileName="")) returned 1
	[0196.383] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsjpn.xml", cAlternateFileName="")) returned 1
	[0196.383] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipskor.xml", cAlternateFileName="")) returned 1
	[0196.383] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6917b208, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6917b208, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll", cAlternateFileName="")) returned 1
	[0196.383] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnld.xml", cAlternateFileName="")) returned 1
	[0196.383] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnor.xml", cAlternateFileName="")) returned 1
	[0196.383] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsplk.xml", cAlternateFileName="")) returned 1
	[0196.383] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x691c76a3, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x691c76a3, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1dc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsPlugin.dll", cAlternateFileName="")) returned 1
	[0196.383] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptb.xml", cAlternateFileName="")) returned 1
	[0196.383] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptg.xml", cAlternateFileName="")) returned 1
	[0196.383] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrom.xml", cAlternateFileName="")) returned 1
	[0196.384] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrus.xml", cAlternateFileName="")) returned 1
	[0196.384] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrb.xml", cAlternateFileName="")) returned 1
	[0196.384] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrl.xml", cAlternateFileName="")) returned 1
	[0196.384] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssve.xml", cAlternateFileName="")) returned 1
	[0196.384] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipstr.xml", cAlternateFileName="")) returned 1
	[0196.384] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1
	[0196.384] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0196.384] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f2306d6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f2306d6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f2306d6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x136a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="journal.dll", cAlternateFileName="")) returned 1
	[0196.384] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0196.384] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LanguageModel", cAlternateFileName="LANGUA~1")) returned 1
	[0196.384] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1
	[0196.384] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1
	[0196.384] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x584f7138, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b8f5213, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b98dcaf, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1a9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1
	[0196.384] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fad53c8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5fad53c8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5fad53c8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1
	[0196.384] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5851d393, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5daeeef5, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5db87a6d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x183e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe", cAlternateFileName="")) returned 1
	[0196.384] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x584f7138, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x63fd1a26, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x641c177d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x618000, dwReserved0=0x0, dwReserved1=0x0, cFileName="mraut.dll", cAlternateFileName="")) returned 1
	[0196.384] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166dc3e1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166dc3e1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166dc3e1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xcc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1
	[0196.384] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37dcf714, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x67e68025, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x67eda783, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x10b400, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1
	[0196.384] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1
	[0196.384] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0196.384] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0196.384] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0196.384] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0196.385] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1
	[0196.385] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f2306d6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f2306d6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f2306d6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2ea00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1
	[0196.385] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1
	[0196.385] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6917b208, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x691c76a3, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xb9400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1
	[0196.385] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1
	[0196.385] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1
	[0196.385] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1
	[0196.385] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1
	[0196.385] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1
	[0196.385] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e68076, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x69239cf3, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x69239cf3, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1
	[0196.385] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3a2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll", cAlternateFileName="")) returned 1
	[0196.385] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b4306ec, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b456971, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x5e540, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.exe", cAlternateFileName="")) returned 1
	[0196.385] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th-TH", cAlternateFileName="")) returned 1
	[0196.385] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b4a2e36, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b4c9095, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x10ce00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll", cAlternateFileName="")) returned 1
	[0196.385] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1674eaf4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1674eaf4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1674eaf4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll", cAlternateFileName="")) returned 1
	[0196.385] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b4ef2e1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b5619f1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x105400, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipskins.dll", cAlternateFileName="")) returned 1
	[0196.385] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6276149f, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x627876df, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tiptsf.dll", cAlternateFileName="")) returned 1
	[0196.385] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5faaf16e, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5faaf16e, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5fad53c8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x17a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tpcps.dll", cAlternateFileName="")) returned 1
	[0196.385] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1
	[0196.386] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1
	[0196.386] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1
	[0196.386] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1
	[0196.386] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1
	[0196.386] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.386] FindClose (in: hFindFile=0x79fca8 | out: hFindFile=0x79fca8) returned 1
	[0196.386] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), fInfoLevelId=0x0, lpFileInformation=0x1274c148 | out: lpFileInformation=0x1274c148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x691089ac, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6912ebfc, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xc137d)) returned 1
	[0196.391] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), fInfoLevelId=0x0, lpFileInformation=0x1274c198 | out: lpFileInformation=0x1274c198*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x691c76a3, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x691c76a3, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x69a5)) returned 1
	[0196.391] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), fInfoLevelId=0x0, lpFileInformation=0x1274c1e8 | out: lpFileInformation=0x1274c1e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37da94b9, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5ab195d5, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5abb1fd7, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x186b84)) returned 1
	[0196.397] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe"), fInfoLevelId=0x0, lpFileInformation=0x1274c238 | out: lpFileInformation=0x1274c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37da94b9, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5abd7ff0, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5ac24455, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xc5400)) returned 1
	[0196.399] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HWRCustomization" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization"), fInfoLevelId=0x0, lpFileInformation=0x1274c288 | out: lpFileInformation=0x1274c288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6eba2ec1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.401] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HWRCustomization" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.401] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HWRCustomization\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6eba2ec1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fea8
	[0196.401] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6eba2ec1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.401] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.401] FindClose (in: hFindFile=0x79fea8 | out: hFindFile=0x79fea8) returned 1
	[0196.401] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll"), fInfoLevelId=0x0, lpFileInformation=0x1274c2d8 | out: lpFileInformation=0x1274c2d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e68076, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc00)) returned 1
	[0196.406] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll"), fInfoLevelId=0x0, lpFileInformation=0x1274c328 | out: lpFileInformation=0x1274c328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f256931, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f256931, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f256931, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x5bc00)) returned 1
	[0196.407] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), fInfoLevelId=0x0, lpFileInformation=0x1274c378 | out: lpFileInformation=0x1274c378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f256931, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f256931, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f256931, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1fda00)) returned 1
	[0196.407] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe"), fInfoLevelId=0x0, lpFileInformation=0x1274c3c8 | out: lpFileInformation=0x1274c3c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e68076, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x691ed82a, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x69213a47, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x5c000)) returned 1
	[0196.451] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll"), fInfoLevelId=0x0, lpFileInformation=0x1274c418 | out: lpFileInformation=0x1274c418*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6917b208, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6917b208, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa800)) returned 1
	[0196.454] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll"), fInfoLevelId=0x0, lpFileInformation=0x1274c468 | out: lpFileInformation=0x1274c468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x691c76a3, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x691c76a3, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1dc00)) returned 1
	[0196.454] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel"), fInfoLevelId=0x0, lpFileInformation=0x1274c4b8 | out: lpFileInformation=0x1274c4b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.456] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.456] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fd28
	[0196.456] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.456] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="chstic.dgml", cAlternateFileName="")) returned 1
	[0196.456] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.456] FindClose (in: hFindFile=0x79fd28 | out: hFindFile=0x79fd28) returned 1
	[0196.456] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml"), fInfoLevelId=0x0, lpFileInformation=0x1274c558 | out: lpFileInformation=0x1274c558*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2fb)) returned 1
	[0196.533] SetEvent (hEvent=0x168) returned 1
	[0196.533] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll"), fInfoLevelId=0x0, lpFileInformation=0x1274c5a8 | out: lpFileInformation=0x1274c5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fad53c8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5fad53c8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5fad53c8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x7c000)) returned 1
	[0196.533] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), fInfoLevelId=0x0, lpFileInformation=0x1274c5f8 | out: lpFileInformation=0x1274c5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6917b208, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x691c76a3, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xb9400)) returned 1
	[0196.535] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll"), fInfoLevelId=0x0, lpFileInformation=0x1274c648 | out: lpFileInformation=0x1274c648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e68076, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x69239cf3, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x69239cf3, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa200)) returned 1
	[0196.535] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe"), fInfoLevelId=0x0, lpFileInformation=0x1274c698 | out: lpFileInformation=0x1274c698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b4306ec, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b456971, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x5e540)) returned 1
	[0196.535] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll"), fInfoLevelId=0x0, lpFileInformation=0x1274c6e8 | out: lpFileInformation=0x1274c6e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b4a2e36, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b4c9095, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x10ce00)) returned 1
	[0196.552] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa"), fInfoLevelId=0x0, lpFileInformation=0x1274c738 | out: lpFileInformation=0x1274c738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.552] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.552] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0028
	[0196.552] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.552] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167c11f8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167c11f8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167c11f8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0196.552] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.552] FindClose (in: hFindFile=0x7a0028 | out: hFindFile=0x7a0028) returned 1
	[0196.552] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1274c7d8 | out: lpFileInformation=0x1274c7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167c11f8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167c11f8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167c11f8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00)) returned 1
	[0196.555] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg"), fInfoLevelId=0x0, lpFileInformation=0x1274c828 | out: lpFileInformation=0x1274c828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.556] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.556] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fe28
	[0196.556] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.556] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1679af9e, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1679af9e, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1679af9e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0196.556] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.556] FindClose (in: hFindFile=0x79fe28 | out: hFindFile=0x79fe28) returned 1
	[0196.556] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1274c8c8 | out: lpFileInformation=0x1274c8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1679af9e, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1679af9e, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1679af9e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00)) returned 1
	[0196.556] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz"), fInfoLevelId=0x0, lpFileInformation=0x1274c918 | out: lpFileInformation=0x1274c918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.557] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.557] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0068
	[0196.558] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.558] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16774d47, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16774d47, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16774d47, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0196.558] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.558] FindClose (in: hFindFile=0x7a0068 | out: hFindFile=0x7a0068) returned 1
	[0196.558] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1274c9b8 | out: lpFileInformation=0x1274c9b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16774d47, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16774d47, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16774d47, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2800)) returned 1
	[0196.558] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk"), fInfoLevelId=0x0, lpFileInformation=0x1274ca08 | out: lpFileInformation=0x1274ca08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.558] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.559] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0028
	[0196.559] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.559] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16774d47, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16774d47, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16774d47, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0196.559] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.559] FindClose (in: hFindFile=0x7a0028 | out: hFindFile=0x7a0028) returned 1
	[0196.559] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1274caa8 | out: lpFileInformation=0x1274caa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16774d47, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16774d47, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16774d47, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2800)) returned 1
	[0196.559] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de"), fInfoLevelId=0x0, lpFileInformation=0x1274caf8 | out: lpFileInformation=0x1274caf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.560] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fda8
	[0196.560] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f72013, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f72013, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.560] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16774d47, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16774d47, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16774d47, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0196.560] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.560] FindClose (in: hFindFile=0x79fda8 | out: hFindFile=0x79fda8) returned 1
	[0196.560] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1274cb98 | out: lpFileInformation=0x1274cb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16774d47, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16774d47, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16774d47, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00)) returned 1
	[0196.561] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr"), fInfoLevelId=0x0, lpFileInformation=0x1274cbe8 | out: lpFileInformation=0x1274cbe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.561] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.562] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fd28
	[0196.562] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.562] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1674eaf4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1674eaf4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1674eaf4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0196.562] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.562] FindClose (in: hFindFile=0x79fd28 | out: hFindFile=0x79fd28) returned 1
	[0196.562] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1274cc88 | out: lpFileInformation=0x1274cc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1674eaf4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1674eaf4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1674eaf4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00)) returned 1
	[0196.562] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb"), fInfoLevelId=0x0, lpFileInformation=0x1274ccd8 | out: lpFileInformation=0x1274ccd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.565] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fe68
	[0196.565] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.565] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1674eaf4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1674eaf4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1674eaf4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0196.565] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.565] FindClose (in: hFindFile=0x79fe68 | out: hFindFile=0x79fe68) returned 1
	[0196.565] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1274cd78 | out: lpFileInformation=0x1274cd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1674eaf4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1674eaf4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1674eaf4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2800)) returned 1
	[0196.565] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x1274cdc8 | out: lpFileInformation=0x1274cdc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6eba2ec1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.566] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.566] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6eba2ec1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffa8
	[0196.698] SetEvent (hEvent=0x168) returned 1
	[0196.699] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6eba2ec1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.699] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b3bdfd4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b3e423a, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1b2d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1
	[0196.699] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b3e423a, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b40a495, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xbf28, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1
	[0196.699] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b4ef2e1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b4ef2e1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xb61e, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1
	[0196.699] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b47cbb9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b47cbb9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x148de, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1
	[0196.699] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b456971, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b47cbb9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2bfcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1
	[0196.699] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b40a495, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b40a495, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x32e18, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1
	[0196.699] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1
	[0196.700] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c57ed8c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9c57ed8c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9c57ed8c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1
	[0196.700] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa522aa93, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa522aa93, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa522aa93, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1
	[0196.700] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1
	[0196.700] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa522aa93, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa522aa93, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa522aa93, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1
	[0196.700] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b5619f1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b587c54, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x30d3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1
	[0196.700] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1
	[0196.700] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1
	[0196.700] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa522aa93, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa522aa93, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa522aa93, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1
	[0196.700] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c558b79, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9c558b79, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9c558b79, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1
	[0196.700] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa522aa93, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa522aa93, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa522aa93, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xae00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1
	[0196.700] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b47cbb9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b4a2e36, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2c6cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 1
	[0196.700] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a4fbf, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9c5a4fbf, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9c5a4fbf, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1
	[0196.700] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.exe.mui", cAlternateFileName="")) returned 1
	[0196.700] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x6400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1
	[0196.700] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1674eaf4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1674eaf4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1674eaf4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0196.700] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa522aa93, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa522aa93, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa522aa93, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1
	[0196.700] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.701] FindClose (in: hFindFile=0x79ffa8 | out: hFindFile=0x79ffa8) returned 1
	[0196.702] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1274d548 | out: lpFileInformation=0x1274d548*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x2400)) returned 1
	[0196.708] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1274d598 | out: lpFileInformation=0x1274d598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x5c00)) returned 1
	[0196.709] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1274d5e8 | out: lpFileInformation=0x1274d5e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c57ed8c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9c57ed8c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9c57ed8c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1600)) returned 1
	[0196.710] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1274d638 | out: lpFileInformation=0x1274d638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa522aa93, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa522aa93, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa522aa93, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00)) returned 1
	[0196.710] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1274d688 | out: lpFileInformation=0x1274d688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa522aa93, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa522aa93, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa522aa93, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00)) returned 1
	[0196.710] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1274d6d8 | out: lpFileInformation=0x1274d6d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa522aa93, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa522aa93, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa522aa93, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xae00)) returned 1
	[0196.789] SetEvent (hEvent=0x168) returned 1
	[0196.790] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabtip.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1274d728 | out: lpFileInformation=0x1274d728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xc00)) returned 1
	[0196.793] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1274d778 | out: lpFileInformation=0x1274d778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x6400)) returned 1
	[0196.797] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1274d7c8 | out: lpFileInformation=0x1274d7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa522aa93, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa522aa93, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa522aa93, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0196.797] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), fInfoLevelId=0x0, lpFileInformation=0x1274d818 | out: lpFileInformation=0x1274d818*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b3bdfd4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b3e423a, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1b2d8)) returned 1
	[0196.798] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), fInfoLevelId=0x0, lpFileInformation=0x1274d868 | out: lpFileInformation=0x1274d868*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b3e423a, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b40a495, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xbf28)) returned 1
	[0196.798] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), fInfoLevelId=0x0, lpFileInformation=0x1274d8b8 | out: lpFileInformation=0x1274d8b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b4ef2e1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b4ef2e1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xb61e)) returned 1
	[0196.798] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), fInfoLevelId=0x0, lpFileInformation=0x1274d908 | out: lpFileInformation=0x1274d908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b47cbb9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b47cbb9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x148de)) returned 1
	[0196.798] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), fInfoLevelId=0x0, lpFileInformation=0x1274d958 | out: lpFileInformation=0x1274d958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b456971, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b47cbb9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2bfcc)) returned 1
	[0196.798] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), fInfoLevelId=0x0, lpFileInformation=0x1274d9a8 | out: lpFileInformation=0x1274d9a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b40a495, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b40a495, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x32e18)) returned 1
	[0196.799] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), fInfoLevelId=0x0, lpFileInformation=0x1274d9f8 | out: lpFileInformation=0x1274d9f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b5619f1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b587c54, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x30d3a)) returned 1
	[0196.799] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1274da48 | out: lpFileInformation=0x1274da48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x2600)) returned 1
	[0196.801] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1274da98 | out: lpFileInformation=0x1274da98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x2a00)) returned 1
	[0196.801] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1274dae8 | out: lpFileInformation=0x1274dae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa522aa93, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa522aa93, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa522aa93, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00)) returned 1
	[0196.802] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1274db38 | out: lpFileInformation=0x1274db38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c558b79, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9c558b79, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9c558b79, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00)) returned 1
	[0196.802] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), fInfoLevelId=0x0, lpFileInformation=0x1274db88 | out: lpFileInformation=0x1274db88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b47cbb9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b4a2e36, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2c6cc)) returned 1
	[0196.803] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1274dbd8 | out: lpFileInformation=0x1274dbd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a4fbf, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9c5a4fbf, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9c5a4fbf, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1600)) returned 1
	[0196.803] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1274dc28 | out: lpFileInformation=0x1274dc28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1674eaf4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1674eaf4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1674eaf4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2800)) returned 1
	[0196.803] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es"), fInfoLevelId=0x0, lpFileInformation=0x1274dc78 | out: lpFileInformation=0x1274dc78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.803] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.804] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fd68
	[0196.804] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.804] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1674eaf4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1674eaf4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1674eaf4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0196.804] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.804] FindClose (in: hFindFile=0x79fd68 | out: hFindFile=0x79fd68) returned 1
	[0196.804] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1274dd18 | out: lpFileInformation=0x1274dd18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1674eaf4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1674eaf4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1674eaf4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00)) returned 1
	[0196.804] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx"), fInfoLevelId=0x0, lpFileInformation=0x1274dd68 | out: lpFileInformation=0x1274dd68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.805] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fea8
	[0196.805] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.805] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1674eaf4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1674eaf4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1674eaf4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0196.805] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.805] FindClose (in: hFindFile=0x79fea8 | out: hFindFile=0x79fea8) returned 1
	[0196.805] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1274de08 | out: lpFileInformation=0x1274de08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1674eaf4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1674eaf4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1674eaf4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00)) returned 1
	[0196.810] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee"), fInfoLevelId=0x0, lpFileInformation=0x1274de58 | out: lpFileInformation=0x1274de58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.810] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.811] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffe8
	[0196.811] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.811] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1674eaf4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1674eaf4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1674eaf4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0196.811] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.811] FindClose (in: hFindFile=0x79ffe8 | out: hFindFile=0x79ffe8) returned 1
	[0196.811] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1274def8 | out: lpFileInformation=0x1274def8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1674eaf4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1674eaf4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1674eaf4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00)) returned 1
	[0196.811] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi"), fInfoLevelId=0x0, lpFileInformation=0x1274df48 | out: lpFileInformation=0x1274df48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.812] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.812] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9e8
	[0196.812] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.812] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16702634, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16702634, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16702634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0196.812] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.812] FindClose (in: hFindFile=0x79f9e8 | out: hFindFile=0x79f9e8) returned 1
	[0196.812] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1276c008 | out: lpFileInformation=0x1276c008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16702634, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16702634, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16702634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00)) returned 1
	[0196.813] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca"), fInfoLevelId=0x0, lpFileInformation=0x1276c058 | out: lpFileInformation=0x1276c058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.813] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.814] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fb68
	[0196.814] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.814] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16702634, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16702634, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16702634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0196.814] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.814] FindClose (in: hFindFile=0x79fb68 | out: hFindFile=0x79fb68) returned 1
	[0196.814] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1276c0f8 | out: lpFileInformation=0x1276c0f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16702634, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16702634, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16702634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2e00)) returned 1
	[0196.814] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr"), fInfoLevelId=0x0, lpFileInformation=0x1276c148 | out: lpFileInformation=0x1276c148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.814] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.815] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f8e8
	[0196.815] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.815] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16702634, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16702634, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16702634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0196.815] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.815] FindClose (in: hFindFile=0x79f8e8 | out: hFindFile=0x79f8e8) returned 1
	[0196.816] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1276c1e8 | out: lpFileInformation=0x1276c1e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16702634, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16702634, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16702634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00)) returned 1
	[0196.816] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions"), fInfoLevelId=0x0, lpFileInformation=0x1276c238 | out: lpFileInformation=0x1276c238*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.821] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.822] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fb68
	[0196.825] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2f98262, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2f98262, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.825] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1
	[0196.825] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1714a855, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1714a855, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1714a855, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1
	[0196.825] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="insert", cAlternateFileName="")) returned 1
	[0196.825] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="insert.xml", cAlternateFileName="")) returned 1
	[0196.825] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad", cAlternateFileName="")) returned 1
	[0196.825] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 1
	[0196.826] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="main", cAlternateFileName="")) returned 1
	[0196.826] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xadda, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.xml", cAlternateFileName="")) returned 1
	[0196.826] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskclearui", cAlternateFileName="OSKCLE~1")) returned 1
	[0196.826] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskclearui.xml", cAlternateFileName="")) returned 1
	[0196.826] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu", cAlternateFileName="")) returned 1
	[0196.826] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1
	[0196.826] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknav", cAlternateFileName="")) returned 1
	[0196.826] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknav.xml", cAlternateFileName="")) returned 1
	[0196.826] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad", cAlternateFileName="OSKNUM~1")) returned 1
	[0196.826] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1
	[0196.826] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred", cAlternateFileName="")) returned 1
	[0196.826] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred.xml", cAlternateFileName="")) returned 1
	[0196.826] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols", cAlternateFileName="")) returned 1
	[0196.826] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 1
	[0196.826] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.826] FindClose (in: hFindFile=0x79fb68 | out: hFindFile=0x79fb68) returned 1
	[0196.827] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad"), fInfoLevelId=0x0, lpFileInformation=0x1276c8c8 | out: lpFileInformation=0x1276c8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.828] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.828] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9a8
	[0196.829] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.829] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e7453, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167e7453, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167e7453, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1
	[0196.829] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.829] FindClose (in: hFindFile=0x79f9a8 | out: hFindFile=0x79f9a8) returned 1
	[0196.829] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), fInfoLevelId=0x0, lpFileInformation=0x1276c968 | out: lpFileInformation=0x1276c968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e7453, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167e7453, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167e7453, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x59a)) returned 1
	[0196.858] SetEvent (hEvent=0x168) returned 1
	[0196.858] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), fInfoLevelId=0x0, lpFileInformation=0x1276c9b8 | out: lpFileInformation=0x1276c9b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1714a855, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1714a855, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1714a855, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd4)) returned 1
	[0196.858] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert"), fInfoLevelId=0x0, lpFileInformation=0x1276ca08 | out: lpFileInformation=0x1276ca08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.858] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.858] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fc68
	[0196.858] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.859] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="insertbase.xml", cAlternateFileName="")) returned 1
	[0196.859] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.859] FindClose (in: hFindFile=0x79fc68 | out: hFindFile=0x79fc68) returned 1
	[0196.859] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), fInfoLevelId=0x0, lpFileInformation=0x1276caa8 | out: lpFileInformation=0x1276caa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x387)) returned 1
	[0196.860] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), fInfoLevelId=0x0, lpFileInformation=0x1276caf8 | out: lpFileInformation=0x1276caf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd7)) returned 1
	[0196.860] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad"), fInfoLevelId=0x0, lpFileInformation=0x1276cb48 | out: lpFileInformation=0x1276cb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.861] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.861] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fde8
	[0196.861] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.861] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1
	[0196.861] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1
	[0196.861] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1714a855, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1714a855, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1714a855, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1
	[0196.861] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.861] FindClose (in: hFindFile=0x79fde8 | out: hFindFile=0x79fde8) returned 1
	[0196.861] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), fInfoLevelId=0x0, lpFileInformation=0x1276cc88 | out: lpFileInformation=0x1276cc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x180)) returned 1
	[0196.862] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), fInfoLevelId=0x0, lpFileInformation=0x1276ccd8 | out: lpFileInformation=0x1276ccd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x387)) returned 1
	[0196.862] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), fInfoLevelId=0x0, lpFileInformation=0x1276cd28 | out: lpFileInformation=0x1276cd28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1714a855, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1714a855, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1714a855, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x188)) returned 1
	[0196.862] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), fInfoLevelId=0x0, lpFileInformation=0x1276cd78 | out: lpFileInformation=0x1276cd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2b5)) returned 1
	[0196.862] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main"), fInfoLevelId=0x0, lpFileInformation=0x1276cdc8 | out: lpFileInformation=0x1276cdc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.864] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.864] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fee8
	[0196.866] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.866] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e7453, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167e7453, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167e7453, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd05, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1
	[0196.866] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1714a855, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1714a855, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1714a855, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1
	[0196.866] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1
	[0196.866] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xdc9, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_ca.xml", cAlternateFileName="")) returned 1
	[0196.866] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_heb.xml", cAlternateFileName="")) returned 1
	[0196.866] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1
	[0196.866] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_kor.xml", cAlternateFileName="")) returned 1
	[0196.866] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1
	[0196.866] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1714a855, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1714a855, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1714a855, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1
	[0196.866] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1
	[0196.866] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1
	[0196.866] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1
	[0196.866] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e7453, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167e7453, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167e7453, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1
	[0196.866] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.867] FindClose (in: hFindFile=0x79fee8 | out: hFindFile=0x79fee8) returned 1
	[0196.868] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), fInfoLevelId=0x0, lpFileInformation=0x1276d228 | out: lpFileInformation=0x1276d228*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e7453, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167e7453, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167e7453, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd05)) returned 1
	[0196.869] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), fInfoLevelId=0x0, lpFileInformation=0x1276d278 | out: lpFileInformation=0x1276d278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1714a855, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1714a855, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1714a855, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf7)) returned 1
	[0196.869] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), fInfoLevelId=0x0, lpFileInformation=0x1276d2c8 | out: lpFileInformation=0x1276d2c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xdc4)) returned 1
	[0196.869] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), fInfoLevelId=0x0, lpFileInformation=0x1276d318 | out: lpFileInformation=0x1276d318*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xdc9)) returned 1
	[0196.871] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), fInfoLevelId=0x0, lpFileInformation=0x1276d368 | out: lpFileInformation=0x1276d368*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2e2)) returned 1
	[0196.871] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), fInfoLevelId=0x0, lpFileInformation=0x1276d3b8 | out: lpFileInformation=0x1276d3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x324)) returned 1
	[0196.871] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), fInfoLevelId=0x0, lpFileInformation=0x1276d408 | out: lpFileInformation=0x1276d408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1e8)) returned 1
	[0196.871] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), fInfoLevelId=0x0, lpFileInformation=0x1276d458 | out: lpFileInformation=0x1276d458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x269)) returned 1
	[0196.871] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), fInfoLevelId=0x0, lpFileInformation=0x1276d4a8 | out: lpFileInformation=0x1276d4a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1714a855, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1714a855, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1714a855, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x40e8)) returned 1
	[0196.876] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), fInfoLevelId=0x0, lpFileInformation=0x1276d4f8 | out: lpFileInformation=0x1276d4f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3af9)) returned 1
	[0196.876] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), fInfoLevelId=0x0, lpFileInformation=0x1276d548 | out: lpFileInformation=0x1276d548*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x264b)) returned 1
	[0196.876] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), fInfoLevelId=0x0, lpFileInformation=0x1276d598 | out: lpFileInformation=0x1276d598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b)) returned 1
	[0196.877] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), fInfoLevelId=0x0, lpFileInformation=0x1276d5e8 | out: lpFileInformation=0x1276d5e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e7453, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167e7453, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167e7453, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3)) returned 1
	[0196.902] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), fInfoLevelId=0x0, lpFileInformation=0x1276d638 | out: lpFileInformation=0x1276d638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xadda)) returned 1
	[0196.902] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui"), fInfoLevelId=0x0, lpFileInformation=0x1276d688 | out: lpFileInformation=0x1276d688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.902] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fea8
	[0196.902] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd4e74, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.903] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e7453, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167e7453, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167e7453, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskclearuibase.xml", cAlternateFileName="")) returned 1
	[0196.903] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.903] FindClose (in: hFindFile=0x79fea8 | out: hFindFile=0x79fea8) returned 1
	[0196.903] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml"), fInfoLevelId=0x0, lpFileInformation=0x1276d728 | out: lpFileInformation=0x1276d728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e7453, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167e7453, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167e7453, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2e1)) returned 1
	[0196.903] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml"), fInfoLevelId=0x0, lpFileInformation=0x1276d778 | out: lpFileInformation=0x1276d778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xdd)) returned 1
	[0196.912] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu"), fInfoLevelId=0x0, lpFileInformation=0x1276d7c8 | out: lpFileInformation=0x1276d7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.912] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.912] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffa8
	[0196.913] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fbe4b8, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fbe4b8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.913] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e7453, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167e7453, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167e7453, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1
	[0196.913] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.913] FindClose (in: hFindFile=0x79ffa8 | out: hFindFile=0x79ffa8) returned 1
	[0196.913] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), fInfoLevelId=0x0, lpFileInformation=0x1276d868 | out: lpFileInformation=0x1276d868*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e7453, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167e7453, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167e7453, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d7)) returned 1
	[0196.913] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), fInfoLevelId=0x0, lpFileInformation=0x1276d8b8 | out: lpFileInformation=0x1276d8b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd7)) returned 1
	[0196.913] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav"), fInfoLevelId=0x0, lpFileInformation=0x1276d908 | out: lpFileInformation=0x1276d908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.919] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.919] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fe68
	[0196.919] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.919] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknavbase.xml", cAlternateFileName="")) returned 1
	[0196.919] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.919] FindClose (in: hFindFile=0x79fe68 | out: hFindFile=0x79fe68) returned 1
	[0196.919] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml"), fInfoLevelId=0x0, lpFileInformation=0x1276d9a8 | out: lpFileInformation=0x1276d9a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x42d)) returned 1
	[0196.920] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml"), fInfoLevelId=0x0, lpFileInformation=0x1276d9f8 | out: lpFileInformation=0x1276d9f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd5)) returned 1
	[0196.920] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad"), fInfoLevelId=0x0, lpFileInformation=0x1276da48 | out: lpFileInformation=0x1276da48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.930] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.931] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fe28
	[0196.931] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.931] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1
	[0196.931] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.931] FindClose (in: hFindFile=0x79fe28 | out: hFindFile=0x79fe28) returned 1
	[0196.931] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), fInfoLevelId=0x0, lpFileInformation=0x1276dae8 | out: lpFileInformation=0x1276dae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x59d)) returned 1
	[0196.936] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), fInfoLevelId=0x0, lpFileInformation=0x1276db38 | out: lpFileInformation=0x1276db38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xdb)) returned 1
	[0196.936] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred"), fInfoLevelId=0x0, lpFileInformation=0x1276db88 | out: lpFileInformation=0x1276db88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.937] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.937] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fe68
	[0196.937] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.937] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1
	[0196.937] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.937] FindClose (in: hFindFile=0x79fe68 | out: hFindFile=0x79fe68) returned 1
	[0196.937] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), fInfoLevelId=0x0, lpFileInformation=0x1276dc28 | out: lpFileInformation=0x1276dc28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x39c)) returned 1
	[0196.937] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), fInfoLevelId=0x0, lpFileInformation=0x1276dc78 | out: lpFileInformation=0x1276dc78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd7)) returned 1
	[0196.938] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols"), fInfoLevelId=0x0, lpFileInformation=0x1276dcc8 | out: lpFileInformation=0x1276dcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.938] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.938] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffe8
	[0196.938] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.938] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1
	[0196.938] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e7453, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167e7453, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167e7453, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x325, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1
	[0196.938] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 1
	[0196.938] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.938] FindClose (in: hFindFile=0x79ffe8 | out: hFindFile=0x79ffe8) returned 1
	[0196.938] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), fInfoLevelId=0x0, lpFileInformation=0x1276de08 | out: lpFileInformation=0x1276de08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2b6)) returned 1
	[0196.939] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), fInfoLevelId=0x0, lpFileInformation=0x1276de58 | out: lpFileInformation=0x1276de58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e7453, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167e7453, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167e7453, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x325)) returned 1
	[0196.939] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), fInfoLevelId=0x0, lpFileInformation=0x1276dea8 | out: lpFileInformation=0x1276dea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17196d0a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17196d0a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17196d0a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xeef)) returned 1
	[0196.940] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), fInfoLevelId=0x0, lpFileInformation=0x1276def8 | out: lpFileInformation=0x1276def8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x24f)) returned 1
	[0196.940] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il"), fInfoLevelId=0x0, lpFileInformation=0x1276df48 | out: lpFileInformation=0x1276df48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.940] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0068
	[0196.965] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.966] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166dc3e1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166dc3e1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166dc3e1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0196.966] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.966] FindClose (in: hFindFile=0x7a0068 | out: hFindFile=0x7a0068) returned 1
	[0196.966] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x12790008 | out: lpFileInformation=0x12790008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166dc3e1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166dc3e1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166dc3e1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2600)) returned 1
	[0196.967] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr"), fInfoLevelId=0x0, lpFileInformation=0x12790058 | out: lpFileInformation=0x12790058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.967] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fce8
	[0196.967] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.967] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166dc3e1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166dc3e1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166dc3e1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0196.967] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.968] FindClose (in: hFindFile=0x79fce8 | out: hFindFile=0x79fce8) returned 1
	[0196.968] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x127900f8 | out: lpFileInformation=0x127900f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166dc3e1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166dc3e1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166dc3e1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00)) returned 1
	[0196.968] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu"), fInfoLevelId=0x0, lpFileInformation=0x12790148 | out: lpFileInformation=0x12790148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.968] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.968] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fd68
	[0196.968] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.969] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166dc3e1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166dc3e1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166dc3e1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0196.969] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.969] FindClose (in: hFindFile=0x79fd68 | out: hFindFile=0x79fd68) returned 1
	[0196.970] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x127901e8 | out: lpFileInformation=0x127901e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166dc3e1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166dc3e1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166dc3e1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00)) returned 1
	[0196.970] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), fInfoLevelId=0x0, lpFileInformation=0x12790238 | out: lpFileInformation=0x12790238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37dcf714, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x67f00a1f, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x67f00a1f, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xb620)) returned 1
	[0196.974] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), fInfoLevelId=0x0, lpFileInformation=0x12790288 | out: lpFileInformation=0x12790288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f3614fe, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xd31b567d, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xd31db8ce, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x77fd0)) returned 1
	[0196.974] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), fInfoLevelId=0x0, lpFileInformation=0x127902d8 | out: lpFileInformation=0x127902d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37dcf714, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x67f26c7e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x67fbf5f5, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x10cb30)) returned 1
	[0196.974] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), fInfoLevelId=0x0, lpFileInformation=0x12790328 | out: lpFileInformation=0x12790328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f4200b7, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xd3417c6c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xd3548f4a, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x2646a0)) returned 1
	[0196.974] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), fInfoLevelId=0x0, lpFileInformation=0x12790378 | out: lpFileInformation=0x12790378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f3f9e60, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xd3227d93, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xd33cb79b, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x35ce20)) returned 1
	[0196.975] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml"), fInfoLevelId=0x0, lpFileInformation=0x127903c8 | out: lpFileInformation=0x127903c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x972)) returned 1
	[0196.975] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), fInfoLevelId=0x0, lpFileInformation=0x12790418 | out: lpFileInformation=0x12790418*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa20)) returned 1
	[0196.975] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), fInfoLevelId=0x0, lpFileInformation=0x12790468 | out: lpFileInformation=0x12790468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x99e)) returned 1
	[0196.975] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), fInfoLevelId=0x0, lpFileInformation=0x127904b8 | out: lpFileInformation=0x127904b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x984)) returned 1
	[0196.982] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), fInfoLevelId=0x0, lpFileInformation=0x12790508 | out: lpFileInformation=0x12790508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9fc)) returned 1
	[0196.982] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), fInfoLevelId=0x0, lpFileInformation=0x12790558 | out: lpFileInformation=0x12790558*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9d2)) returned 1
	[0196.982] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), fInfoLevelId=0x0, lpFileInformation=0x127905a8 | out: lpFileInformation=0x127905a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa38)) returned 1
	[0196.982] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), fInfoLevelId=0x0, lpFileInformation=0x127905f8 | out: lpFileInformation=0x127905f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa3a)) returned 1
	[0196.983] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), fInfoLevelId=0x0, lpFileInformation=0x12790648 | out: lpFileInformation=0x12790648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa12)) returned 1
	[0196.983] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), fInfoLevelId=0x0, lpFileInformation=0x12790698 | out: lpFileInformation=0x12790698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xbd0)) returned 1
	[0196.983] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), fInfoLevelId=0x0, lpFileInformation=0x127906e8 | out: lpFileInformation=0x127906e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa62)) returned 1
	[0196.983] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), fInfoLevelId=0x0, lpFileInformation=0x12790738 | out: lpFileInformation=0x12790738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa44)) returned 1
	[0196.983] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml"), fInfoLevelId=0x0, lpFileInformation=0x12790788 | out: lpFileInformation=0x12790788*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9e4)) returned 1
	[0196.984] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml"), fInfoLevelId=0x0, lpFileInformation=0x127907d8 | out: lpFileInformation=0x127907d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9d6)) returned 1
	[0196.985] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), fInfoLevelId=0x0, lpFileInformation=0x12790828 | out: lpFileInformation=0x12790828*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa5c)) returned 1
	[0196.986] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml"), fInfoLevelId=0x0, lpFileInformation=0x12790878 | out: lpFileInformation=0x12790878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e68076, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e68076, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e68076, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa0a)) returned 1
	[0196.986] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), fInfoLevelId=0x0, lpFileInformation=0x127908c8 | out: lpFileInformation=0x127908c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9de)) returned 1
	[0196.986] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), fInfoLevelId=0x0, lpFileInformation=0x12790918 | out: lpFileInformation=0x12790918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9da)) returned 1
	[0196.986] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), fInfoLevelId=0x0, lpFileInformation=0x12790968 | out: lpFileInformation=0x12790968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa08)) returned 1
	[0196.986] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), fInfoLevelId=0x0, lpFileInformation=0x127909b8 | out: lpFileInformation=0x127909b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa42)) returned 1
	[0196.987] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), fInfoLevelId=0x0, lpFileInformation=0x12790a08 | out: lpFileInformation=0x12790a08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa14)) returned 1
	[0196.987] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), fInfoLevelId=0x0, lpFileInformation=0x12790a58 | out: lpFileInformation=0x12790a58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa28)) returned 1
	[0196.987] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), fInfoLevelId=0x0, lpFileInformation=0x12790aa8 | out: lpFileInformation=0x12790aa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c6)) returned 1
	[0196.987] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), fInfoLevelId=0x0, lpFileInformation=0x12790af8 | out: lpFileInformation=0x12790af8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c0)) returned 1
	[0196.989] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), fInfoLevelId=0x0, lpFileInformation=0x12790b48 | out: lpFileInformation=0x12790b48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa54)) returned 1
	[0196.990] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), fInfoLevelId=0x0, lpFileInformation=0x12790b98 | out: lpFileInformation=0x12790b98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9ee)) returned 1
	[0196.990] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), fInfoLevelId=0x0, lpFileInformation=0x12790be8 | out: lpFileInformation=0x12790be8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa08)) returned 1
	[0196.990] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), fInfoLevelId=0x0, lpFileInformation=0x12790c38 | out: lpFileInformation=0x12790c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa24)) returned 1
	[0196.990] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), fInfoLevelId=0x0, lpFileInformation=0x12790c88 | out: lpFileInformation=0x12790c88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e1bbc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e1bbc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e1bbc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9d8)) returned 1
	[0196.992] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml"), fInfoLevelId=0x0, lpFileInformation=0x12790cd8 | out: lpFileInformation=0x12790cd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e41e1b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x37e41e1b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x37e41e1b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaa0)) returned 1
	[0196.993] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it"), fInfoLevelId=0x0, lpFileInformation=0x12790d28 | out: lpFileInformation=0x12790d28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.993] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.993] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fa28
	[0196.993] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.993] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166dc3e1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166dc3e1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166dc3e1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0196.993] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.993] FindClose (in: hFindFile=0x79fa28 | out: hFindFile=0x79fa28) returned 1
	[0196.994] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x12790dc8 | out: lpFileInformation=0x12790dc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166dc3e1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166dc3e1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166dc3e1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00)) returned 1
	[0196.994] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp"), fInfoLevelId=0x0, lpFileInformation=0x12790e18 | out: lpFileInformation=0x12790e18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.994] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.994] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ff68
	[0196.994] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.994] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166b6187, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166b6187, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166b6187, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0196.994] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.994] FindClose (in: hFindFile=0x79ff68 | out: hFindFile=0x79ff68) returned 1
	[0196.995] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x12790eb8 | out: lpFileInformation=0x12790eb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166b6187, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166b6187, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166b6187, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0196.995] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\journal.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\journal.dll"), fInfoLevelId=0x0, lpFileInformation=0x12790f08 | out: lpFileInformation=0x12790f08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f2306d6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f2306d6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f2306d6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x136a00)) returned 1
	[0196.995] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr"), fInfoLevelId=0x0, lpFileInformation=0x12790f58 | out: lpFileInformation=0x12790f58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.995] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.995] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f968
	[0196.995] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.995] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166b6187, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166b6187, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166b6187, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0196.995] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.995] FindClose (in: hFindFile=0x79f968 | out: hFindFile=0x79f968) returned 1
	[0196.996] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x12790ff8 | out: lpFileInformation=0x12790ff8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166b6187, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166b6187, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166b6187, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0196.996] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt"), fInfoLevelId=0x0, lpFileInformation=0x12791048 | out: lpFileInformation=0x12791048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0196.996] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0196.996] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffe8
	[0196.996] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0196.996] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1668ff40, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1668ff40, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1668ff40, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0196.999] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0196.999] FindClose (in: hFindFile=0x79ffe8 | out: hFindFile=0x79ffe8) returned 1
	[0196.999] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x127910e8 | out: lpFileInformation=0x127910e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1668ff40, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1668ff40, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1668ff40, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00)) returned 1
	[0197.001] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv"), fInfoLevelId=0x0, lpFileInformation=0x12791138 | out: lpFileInformation=0x12791138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.002] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.002] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79faa8
	[0197.002] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2fe4713, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x2fe4713, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.002] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1668ff40, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1668ff40, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1668ff40, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0197.002] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.002] FindClose (in: hFindFile=0x79faa8 | out: hFindFile=0x79faa8) returned 1
	[0197.003] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x127911d8 | out: lpFileInformation=0x127911d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1668ff40, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1668ff40, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1668ff40, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00)) returned 1
	[0197.003] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), fInfoLevelId=0x0, lpFileInformation=0x12791228 | out: lpFileInformation=0x12791228*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x584f7138, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b8f5213, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b98dcaf, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1a9c00)) returned 1
	[0197.003] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe"), fInfoLevelId=0x0, lpFileInformation=0x12791278 | out: lpFileInformation=0x12791278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5851d393, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5daeeef5, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5db87a6d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x183e00)) returned 1
	[0197.003] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), fInfoLevelId=0x0, lpFileInformation=0x127912c8 | out: lpFileInformation=0x127912c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x584f7138, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x63fd1a26, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x641c177d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x618000)) returned 1
	[0197.011] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll"), fInfoLevelId=0x0, lpFileInformation=0x12791318 | out: lpFileInformation=0x12791318*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37dcf714, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x67e68025, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x67eda783, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x10b400)) returned 1
	[0197.011] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll"), fInfoLevelId=0x0, lpFileInformation=0x12791368 | out: lpFileInformation=0x12791368*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166dc3e1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166dc3e1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166dc3e1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xcc00)) returned 1
	[0197.011] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no"), fInfoLevelId=0x0, lpFileInformation=0x127913b8 | out: lpFileInformation=0x127913b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.012] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.012] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffa8
	[0197.012] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.012] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1668ff40, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1668ff40, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1668ff40, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0197.012] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.012] FindClose (in: hFindFile=0x79ffa8 | out: hFindFile=0x79ffa8) returned 1
	[0197.012] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x12791458 | out: lpFileInformation=0x12791458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1668ff40, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1668ff40, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1668ff40, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2800)) returned 1
	[0197.014] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl"), fInfoLevelId=0x0, lpFileInformation=0x127914a8 | out: lpFileInformation=0x127914a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.014] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.014] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fa68
	[0197.014] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.014] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1668ff40, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1668ff40, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1668ff40, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0197.014] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.014] FindClose (in: hFindFile=0x79fa68 | out: hFindFile=0x79fa68) returned 1
	[0197.014] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x12791548 | out: lpFileInformation=0x12791548*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1668ff40, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1668ff40, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1668ff40, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00)) returned 1
	[0197.015] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl"), fInfoLevelId=0x0, lpFileInformation=0x12791598 | out: lpFileInformation=0x12791598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.015] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.015] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9a8
	[0197.015] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.015] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16669cd9, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16669cd9, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16669cd9, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0197.015] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.015] FindClose (in: hFindFile=0x79f9a8 | out: hFindFile=0x79f9a8) returned 1
	[0197.015] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x12791638 | out: lpFileInformation=0x12791638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16669cd9, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16669cd9, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16669cd9, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00)) returned 1
	[0197.015] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br"), fInfoLevelId=0x0, lpFileInformation=0x12791688 | out: lpFileInformation=0x12791688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.025] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.025] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fc28
	[0197.026] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.026] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16669cd9, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16669cd9, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16669cd9, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0197.026] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.026] FindClose (in: hFindFile=0x79fc28 | out: hFindFile=0x79fc28) returned 1
	[0197.026] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x12791728 | out: lpFileInformation=0x12791728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16669cd9, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16669cd9, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16669cd9, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00)) returned 1
	[0197.026] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt"), fInfoLevelId=0x0, lpFileInformation=0x12791778 | out: lpFileInformation=0x12791778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.027] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.027] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fde8
	[0197.027] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.027] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16643a7b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16643a7b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16669cd9, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0197.027] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.027] FindClose (in: hFindFile=0x79fde8 | out: hFindFile=0x79fde8) returned 1
	[0197.027] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x12791818 | out: lpFileInformation=0x12791818*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16643a7b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16643a7b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16669cd9, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00)) returned 1
	[0197.027] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro"), fInfoLevelId=0x0, lpFileInformation=0x12791868 | out: lpFileInformation=0x12791868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.028] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.028] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f928
	[0197.028] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.028] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e7453, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167e7453, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167e7453, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0197.029] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.029] FindClose (in: hFindFile=0x79f928 | out: hFindFile=0x79f928) returned 1
	[0197.029] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x12791908 | out: lpFileInformation=0x12791908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e7453, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167e7453, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167e7453, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00)) returned 1
	[0197.103] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll"), fInfoLevelId=0x0, lpFileInformation=0x12791958 | out: lpFileInformation=0x12791958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f2306d6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f2306d6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f2306d6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2ea00)) returned 1
	[0197.104] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru"), fInfoLevelId=0x0, lpFileInformation=0x127919a8 | out: lpFileInformation=0x127919a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.104] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.104] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9e8
	[0197.104] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.104] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e7453, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167e7453, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167e7453, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0197.104] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.104] FindClose (in: hFindFile=0x79f9e8 | out: hFindFile=0x79f9e8) returned 1
	[0197.105] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x12791a48 | out: lpFileInformation=0x12791a48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167e7453, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167e7453, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167e7453, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00)) returned 1
	[0197.105] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk"), fInfoLevelId=0x0, lpFileInformation=0x12791a98 | out: lpFileInformation=0x12791a98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.108] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.109] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fde8
	[0197.109] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.109] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167c11f8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167c11f8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167c11f8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0197.109] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.109] FindClose (in: hFindFile=0x79fde8 | out: hFindFile=0x79fde8) returned 1
	[0197.109] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x12791b38 | out: lpFileInformation=0x12791b38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167c11f8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167c11f8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167c11f8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00)) returned 1
	[0197.109] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si"), fInfoLevelId=0x0, lpFileInformation=0x12791b88 | out: lpFileInformation=0x12791b88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.109] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.110] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffa8
	[0197.110] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.110] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167c11f8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167c11f8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167c11f8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0197.110] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.110] FindClose (in: hFindFile=0x79ffa8 | out: hFindFile=0x79ffa8) returned 1
	[0197.110] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x12791c28 | out: lpFileInformation=0x12791c28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167c11f8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167c11f8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167c11f8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00)) returned 1
	[0197.110] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-CS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs"), fInfoLevelId=0x0, lpFileInformation=0x12791c78 | out: lpFileInformation=0x12791c78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.111] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-CS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.111] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-CS\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fde8
	[0197.111] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.111] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166b6187, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166b6187, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166b6187, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0197.111] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.111] FindClose (in: hFindFile=0x79fde8 | out: hFindFile=0x79fde8) returned 1
	[0197.111] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x12791d18 | out: lpFileInformation=0x12791d18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166b6187, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166b6187, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166b6187, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00)) returned 1
	[0197.112] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs"), fInfoLevelId=0x0, lpFileInformation=0x12791d68 | out: lpFileInformation=0x12791d68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.112] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.112] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fe28
	[0197.112] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.112] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166b6187, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166b6187, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166b6187, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0197.113] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.113] FindClose (in: hFindFile=0x79fe28 | out: hFindFile=0x79fe28) returned 1
	[0197.113] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x12791e08 | out: lpFileInformation=0x12791e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166b6187, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166b6187, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166b6187, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2800)) returned 1
	[0197.113] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se"), fInfoLevelId=0x0, lpFileInformation=0x12791e58 | out: lpFileInformation=0x12791e58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.115] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.115] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fce8
	[0197.116] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x300a96d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x300a96d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.116] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167c11f8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167c11f8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167c11f8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0197.116] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.116] FindClose (in: hFindFile=0x79fce8 | out: hFindFile=0x79fce8) returned 1
	[0197.116] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x12791ef8 | out: lpFileInformation=0x12791ef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167c11f8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167c11f8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167c11f8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00)) returned 1
	[0197.116] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), fInfoLevelId=0x0, lpFileInformation=0x12791f48 | out: lpFileInformation=0x12791f48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17170aaf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x17170aaf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x17170aaf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3a2200)) returned 1
	[0197.117] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th"), fInfoLevelId=0x0, lpFileInformation=0x12791f98 | out: lpFileInformation=0x12791f98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.117] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.117] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fb28
	[0197.117] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfb0cf, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.117] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167c11f8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167c11f8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167c11f8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0197.117] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.117] FindClose (in: hFindFile=0x79fb28 | out: hFindFile=0x79fb28) returned 1
	[0197.118] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x127ba058 | out: lpFileInformation=0x127ba058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167c11f8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167c11f8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167c11f8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2800)) returned 1
	[0197.121] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll"), fInfoLevelId=0x0, lpFileInformation=0x127ba0a8 | out: lpFileInformation=0x127ba0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1674eaf4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1674eaf4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1674eaf4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x5800)) returned 1
	[0197.121] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll"), fInfoLevelId=0x0, lpFileInformation=0x127ba0f8 | out: lpFileInformation=0x127ba0f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5b4ef2e1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5b5619f1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x105400)) returned 1
	[0197.121] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll"), fInfoLevelId=0x0, lpFileInformation=0x127ba148 | out: lpFileInformation=0x127ba148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586021ae, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6276149f, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x627876df, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9e000)) returned 1
	[0197.121] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll"), fInfoLevelId=0x0, lpFileInformation=0x127ba198 | out: lpFileInformation=0x127ba198*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5faaf16e, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5faaf16e, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5fad53c8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x17a00)) returned 1
	[0197.121] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr"), fInfoLevelId=0x0, lpFileInformation=0x127ba1e8 | out: lpFileInformation=0x127ba1e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.122] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.122] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f8e8
	[0197.122] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.122] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167c11f8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167c11f8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167c11f8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0197.122] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.122] FindClose (in: hFindFile=0x79f8e8 | out: hFindFile=0x79f8e8) returned 1
	[0197.122] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x127ba288 | out: lpFileInformation=0x127ba288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x167c11f8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x167c11f8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x167c11f8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00)) returned 1
	[0197.122] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua"), fInfoLevelId=0x0, lpFileInformation=0x127ba2d8 | out: lpFileInformation=0x127ba2d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.123] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.123] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f968
	[0197.123] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.123] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1679af9e, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1679af9e, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1679af9e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0197.123] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.123] FindClose (in: hFindFile=0x79f968 | out: hFindFile=0x79f968) returned 1
	[0197.123] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x127ba378 | out: lpFileInformation=0x127ba378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1679af9e, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1679af9e, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1679af9e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2a00)) returned 1
	[0197.124] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn"), fInfoLevelId=0x0, lpFileInformation=0x127ba3c8 | out: lpFileInformation=0x127ba3c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.124] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.124] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fd28
	[0197.124] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.124] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16702634, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16702634, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16702634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0197.124] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.124] FindClose (in: hFindFile=0x79fd28 | out: hFindFile=0x79fd28) returned 1
	[0197.124] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x127ba468 | out: lpFileInformation=0x127ba468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16702634, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16702634, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16702634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1e00)) returned 1
	[0197.124] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-HK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-hk"), fInfoLevelId=0x0, lpFileInformation=0x127ba4b8 | out: lpFileInformation=0x127ba4b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.128] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-HK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-hk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.128] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-HK\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fbe8
	[0197.128] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.128] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16702634, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16702634, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16702634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0197.129] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.129] FindClose (in: hFindFile=0x79fbe8 | out: hFindFile=0x79fbe8) returned 1
	[0197.129] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-HK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-hk\\tipresx.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x127ba558 | out: lpFileInformation=0x127ba558*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16702634, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x16702634, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x16702634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1e00)) returned 1
	[0197.129] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw"), fInfoLevelId=0x0, lpFileInformation=0x127ba5a8 | out: lpFileInformation=0x127ba5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.133] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.133] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fda8
	[0197.133] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3030bc4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3030bc4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.133] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166dc3e1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166dc3e1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166dc3e1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0197.133] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.134] FindClose (in: hFindFile=0x79fda8 | out: hFindFile=0x79fda8) returned 1
	[0197.134] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x127ba648 | out: lpFileInformation=0x127ba648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166dc3e1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x166dc3e1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x166dc3e1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1e00)) returned 1
	[0197.134] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\nPEVimA.jpg" (normalized: "c:\\program files\\common files\\npevima.jpg"), fInfoLevelId=0x0, lpFileInformation=0x127ba698 | out: lpFileInformation=0x127ba698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a6076a0, ftCreationTime.dwHighDateTime=0x1d81b51, ftLastAccessTime.dwLowDateTime=0xa855bc50, ftLastAccessTime.dwHighDateTime=0x1d81c1d, ftLastWriteTime.dwLowDateTime=0xa855bc50, ftLastWriteTime.dwHighDateTime=0x1d81c1d, nFileSizeHigh=0x0, nFileSizeLow=0x12533)) returned 1
	[0197.134] VirtualAlloc (lpAddress=0x127c0000, dwSize=0x100000, flAllocationType=0x1000, flProtect=0x4) returned 0x127c0000
	[0197.138] VirtualAlloc (lpAddress=0x11134000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x11134000
	[0197.138] VirtualAlloc (lpAddress=0x21e5000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x21e5000
	[0197.138] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\ncftp.exe" (normalized: "c:\\program files\\common files\\ncftp.exe"), fInfoLevelId=0x0, lpFileInformation=0x127ba6e8 | out: lpFileInformation=0x127ba6e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65fa21b0, ftCreationTime.dwHighDateTime=0x1d7fd88, ftLastAccessTime.dwLowDateTime=0xe0af11a0, ftLastAccessTime.dwHighDateTime=0x1d8277b, ftLastWriteTime.dwLowDateTime=0xe0af11a0, ftLastWriteTime.dwHighDateTime=0x1d8277b, nFileSizeHigh=0x0, nFileSizeLow=0x13a00)) returned 1
	[0197.139] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\winscp.exe" (normalized: "c:\\program files\\common files\\winscp.exe"), fInfoLevelId=0x0, lpFileInformation=0x127ba738 | out: lpFileInformation=0x127ba738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c289c80, ftCreationTime.dwHighDateTime=0x1d7d310, ftLastAccessTime.dwLowDateTime=0x568bef70, ftLastAccessTime.dwHighDateTime=0x1d8057a, ftLastWriteTime.dwLowDateTime=0x568bef70, ftLastWriteTime.dwHighDateTime=0x1d8057a, nFileSizeHigh=0x0, nFileSizeLow=0x13a00)) returned 1
	[0197.139] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\xSQvcZI.bmp" (normalized: "c:\\program files\\common files\\xsqvczi.bmp"), fInfoLevelId=0x0, lpFileInformation=0x127ba788 | out: lpFileInformation=0x127ba788*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61e205c0, ftCreationTime.dwHighDateTime=0x1d81fd4, ftLastAccessTime.dwLowDateTime=0xbbbe2ce0, ftLastAccessTime.dwHighDateTime=0x1d826d2, ftLastWriteTime.dwLowDateTime=0xbbbe2ce0, ftLastWriteTime.dwHighDateTime=0x1d826d2, nFileSizeHigh=0x0, nFileSizeLow=0x8c0b)) returned 1
	[0197.139] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Internet Explorer" (normalized: "c:\\program files\\internet explorer"), fInfoLevelId=0x0, lpFileInformation=0x127ba7d8 | out: lpFileInformation=0x127ba7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf8dce802, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf8dce802, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0197.139] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer" (normalized: "c:\\program files\\internet explorer"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.139] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf8dce802, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf8dce802, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fd28
	[0197.139] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf8dce802, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf8dce802, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.139] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2b592e0, ftCreationTime.dwHighDateTime=0x1d81051, ftLastAccessTime.dwLowDateTime=0xe0a42090, ftLastAccessTime.dwHighDateTime=0x1d828f9, ftLastWriteTime.dwLowDateTime=0xe0a42090, ftLastWriteTime.dwHighDateTime=0x1d828f9, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="active-charge.exe", cAlternateFileName="ACTIVE~1.EXE")) returned 1
	[0197.139] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b363a70, ftCreationTime.dwHighDateTime=0x1d81e2e, ftLastAccessTime.dwLowDateTime=0xf72760c0, ftLastAccessTime.dwHighDateTime=0x1d81f99, ftLastWriteTime.dwLowDateTime=0xf72760c0, ftLastWriteTime.dwHighDateTime=0x1d81f99, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="alftp.exe", cAlternateFileName="")) returned 1
	[0197.140] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f7a1a10, ftCreationTime.dwHighDateTime=0x1d7fcce, ftLastAccessTime.dwLowDateTime=0x77493a90, ftLastAccessTime.dwHighDateTime=0x1d7fd39, ftLastWriteTime.dwLowDateTime=0x77493a90, ftLastWriteTime.dwHighDateTime=0x1d7fd39, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="begin-republican-chance.exe", cAlternateFileName="BEGIN-~1.EXE")) returned 1
	[0197.140] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf80bc980, ftCreationTime.dwHighDateTime=0x1d7d1ca, ftLastAccessTime.dwLowDateTime=0xdbb1abf0, ftLastAccessTime.dwHighDateTime=0x1d81d6b, ftLastWriteTime.dwLowDateTime=0xdbb1abf0, ftLastWriteTime.dwHighDateTime=0x1d81d6b, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="creditservice.exe", cAlternateFileName="CREDIT~1.EXE")) returned 1
	[0197.140] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2081c9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd2081c9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd2081c9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0197.140] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x558c340, ftCreationTime.dwHighDateTime=0x1d7dd7e, ftLastAccessTime.dwLowDateTime=0xe48eb140, ftLastAccessTime.dwHighDateTime=0x1d813fd, ftLastWriteTime.dwLowDateTime=0xe48eb140, ftLastWriteTime.dwHighDateTime=0x1d813fd, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="flashfxp.exe", cAlternateFileName="")) returned 1
	[0197.140] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3425ad8f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x3425ad8f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x3425ad8f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd200, dwReserved0=0x0, dwReserved1=0x0, cFileName="hmmapi.dll", cAlternateFileName="")) returned 1
	[0197.140] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34175f78, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x34175f78, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x3419c1cf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x78800, dwReserved0=0x0, dwReserved1=0x0, cFileName="iediagcmd.exe", cAlternateFileName="")) returned 1
	[0197.140] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3419c1cf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x3419c1cf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x3419c1cf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x78000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieinstal.exe", cAlternateFileName="")) returned 1
	[0197.140] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34175f78, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x34175f78, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x34175f78, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x36800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ielowutil.exe", cAlternateFileName="")) returned 1
	[0197.140] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3419c1cf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x3419c1cf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x3419c1cf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x66400, dwReserved0=0x0, dwReserved1=0x0, cFileName="IEShims.dll", cAlternateFileName="")) returned 1
	[0197.140] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33517c70, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x33517c70, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x33517c70, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc74c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="iexplore.exe", cAlternateFileName="")) returned 1
	[0197.140] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x30c952e, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x30c952e, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1
	[0197.140] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x30c952e, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x30c952e, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGNUP", cAlternateFileName="")) returned 1
	[0197.140] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3425ad8f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x3425ad8f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x3425ad8f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f0e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1
	[0197.140] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.140] FindClose (in: hFindFile=0x79fd28 | out: hFindFile=0x79fd28) returned 1
	[0197.140] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files\\internet explorer\\ieshims.dll"), fInfoLevelId=0x0, lpFileInformation=0x127bacd8 | out: lpFileInformation=0x127bacd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3419c1cf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x3419c1cf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x3419c1cf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x66400)) returned 1
	[0197.140] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP" (normalized: "c:\\program files\\internet explorer\\signup"), fInfoLevelId=0x0, lpFileInformation=0x127bad28 | out: lpFileInformation=0x127bad28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x30c952e, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x30c952e, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.141] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP" (normalized: "c:\\program files\\internet explorer\\signup"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.141] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x30c952e, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x30c952e, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fce8
	[0197.141] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x30c952e, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x30c952e, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.141] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30c952e, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x970b4468, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x970b4468, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="install.ins", cAlternateFileName="")) returned 1
	[0197.141] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.141] FindClose (in: hFindFile=0x79fce8 | out: hFindFile=0x79fce8) returned 1
	[0197.141] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), fInfoLevelId=0x0, lpFileInformation=0x127badc8 | out: lpFileInformation=0x127badc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30c952e, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x970b4468, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x970b4468, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1c4)) returned 1
	[0197.142] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Internet Explorer\\active-charge.exe" (normalized: "c:\\program files\\internet explorer\\active-charge.exe"), fInfoLevelId=0x0, lpFileInformation=0x127bae18 | out: lpFileInformation=0x127bae18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2b592e0, ftCreationTime.dwHighDateTime=0x1d81051, ftLastAccessTime.dwLowDateTime=0xe0a42090, ftLastAccessTime.dwHighDateTime=0x1d828f9, ftLastWriteTime.dwLowDateTime=0xe0a42090, ftLastWriteTime.dwHighDateTime=0x1d828f9, nFileSizeHigh=0x0, nFileSizeLow=0x13a00)) returned 1
	[0197.142] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Internet Explorer\\alftp.exe" (normalized: "c:\\program files\\internet explorer\\alftp.exe"), fInfoLevelId=0x0, lpFileInformation=0x127bae68 | out: lpFileInformation=0x127bae68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b363a70, ftCreationTime.dwHighDateTime=0x1d81e2e, ftLastAccessTime.dwLowDateTime=0xf72760c0, ftLastAccessTime.dwHighDateTime=0x1d81f99, ftLastWriteTime.dwLowDateTime=0xf72760c0, ftLastWriteTime.dwHighDateTime=0x1d81f99, nFileSizeHigh=0x0, nFileSizeLow=0x13a00)) returned 1
	[0197.142] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Internet Explorer\\begin-republican-chance.exe" (normalized: "c:\\program files\\internet explorer\\begin-republican-chance.exe"), fInfoLevelId=0x0, lpFileInformation=0x127baeb8 | out: lpFileInformation=0x127baeb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f7a1a10, ftCreationTime.dwHighDateTime=0x1d7fcce, ftLastAccessTime.dwLowDateTime=0x77493a90, ftLastAccessTime.dwHighDateTime=0x1d7fd39, ftLastWriteTime.dwLowDateTime=0x77493a90, ftLastWriteTime.dwHighDateTime=0x1d7fd39, nFileSizeHigh=0x0, nFileSizeLow=0x13a00)) returned 1
	[0197.142] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Internet Explorer\\creditservice.exe" (normalized: "c:\\program files\\internet explorer\\creditservice.exe"), fInfoLevelId=0x0, lpFileInformation=0x127baf08 | out: lpFileInformation=0x127baf08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf80bc980, ftCreationTime.dwHighDateTime=0x1d7d1ca, ftLastAccessTime.dwLowDateTime=0xdbb1abf0, ftLastAccessTime.dwHighDateTime=0x1d81d6b, ftLastWriteTime.dwLowDateTime=0xdbb1abf0, ftLastWriteTime.dwHighDateTime=0x1d81d6b, nFileSizeHigh=0x0, nFileSizeLow=0x13a00)) returned 1
	[0197.142] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Internet Explorer\\en-US" (normalized: "c:\\program files\\internet explorer\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x127baf58 | out: lpFileInformation=0x127baf58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2081c9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd2081c9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd2081c9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.143] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US" (normalized: "c:\\program files\\internet explorer\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.143] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2081c9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd2081c9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd2081c9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fa28
	[0197.143] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2081c9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd2081c9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd2081c9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.143] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7175bd4, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa7175bd4, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa7175bd4, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hmmapi.dll.mui", cAlternateFileName="")) returned 1
	[0197.143] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6884daf, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa6884daf, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa6884daf, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieinstal.exe.mui", cAlternateFileName="")) returned 1
	[0197.143] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7175bd4, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa7175bd4, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa7175bd4, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="iexplore.exe.mui", cAlternateFileName="")) returned 1
	[0197.143] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.144] FindClose (in: hFindFile=0x79fa28 | out: hFindFile=0x79fa28) returned 1
	[0197.144] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x127bb098 | out: lpFileInformation=0x127bb098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7175bd4, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa7175bd4, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa7175bd4, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xc00)) returned 1
	[0197.144] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x127bb0e8 | out: lpFileInformation=0x127bb0e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6884daf, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa6884daf, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa6884daf, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xc00)) returned 1
	[0197.153] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x127bb138 | out: lpFileInformation=0x127bb138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7175bd4, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa7175bd4, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa7175bd4, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1800)) returned 1
	[0197.153] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Internet Explorer\\flashfxp.exe" (normalized: "c:\\program files\\internet explorer\\flashfxp.exe"), fInfoLevelId=0x0, lpFileInformation=0x127bb188 | out: lpFileInformation=0x127bb188*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x558c340, ftCreationTime.dwHighDateTime=0x1d7dd7e, ftLastAccessTime.dwLowDateTime=0xe48eb140, ftLastAccessTime.dwHighDateTime=0x1d813fd, ftLastWriteTime.dwLowDateTime=0xe48eb140, ftLastWriteTime.dwHighDateTime=0x1d813fd, nFileSizeHigh=0x0, nFileSizeLow=0x13a00)) returned 1
	[0197.153] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll"), fInfoLevelId=0x0, lpFileInformation=0x127bb1d8 | out: lpFileInformation=0x127bb1d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3425ad8f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x3425ad8f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x3425ad8f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd200)) returned 1
	[0197.154] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Internet Explorer\\iediagcmd.exe" (normalized: "c:\\program files\\internet explorer\\iediagcmd.exe"), fInfoLevelId=0x0, lpFileInformation=0x127bb228 | out: lpFileInformation=0x127bb228*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34175f78, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x34175f78, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x3419c1cf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x78800)) returned 1
	[0197.154] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe"), fInfoLevelId=0x0, lpFileInformation=0x127bb278 | out: lpFileInformation=0x127bb278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3419c1cf, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x3419c1cf, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x3419c1cf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x78000)) returned 1
	[0197.163] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Internet Explorer\\ielowutil.exe" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe"), fInfoLevelId=0x0, lpFileInformation=0x127bb2c8 | out: lpFileInformation=0x127bb2c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34175f78, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x34175f78, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x34175f78, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x36800)) returned 1
	[0197.164] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe"), fInfoLevelId=0x0, lpFileInformation=0x127bb318 | out: lpFileInformation=0x127bb318*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33517c70, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x33517c70, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x33517c70, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc74c0)) returned 1
	[0197.164] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Internet Explorer\\images" (normalized: "c:\\program files\\internet explorer\\images"), fInfoLevelId=0x0, lpFileInformation=0x127bb368 | out: lpFileInformation=0x127bb368*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x30c952e, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x30c952e, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.164] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\images" (normalized: "c:\\program files\\internet explorer\\images"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.166] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\images\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x30c952e, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x30c952e, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fc68
	[0197.167] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x30c952e, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x30c952e, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.167] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x340dd612, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x340dd612, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x340dd612, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x0, dwReserved1=0x0, cFileName="bing.ico", cAlternateFileName="")) returned 1
	[0197.167] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.167] FindClose (in: hFindFile=0x79fc68 | out: hFindFile=0x79fc68) returned 1
	[0197.168] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Internet Explorer\\images\\bing.ico" (normalized: "c:\\program files\\internet explorer\\images\\bing.ico"), fInfoLevelId=0x0, lpFileInformation=0x127bb408 | out: lpFileInformation=0x127bb408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x340dd612, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x340dd612, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x340dd612, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1536)) returned 1
	[0197.168] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll"), fInfoLevelId=0x0, lpFileInformation=0x127bb458 | out: lpFileInformation=0x127bb458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3425ad8f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x3425ad8f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x3425ad8f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f0e0)) returned 1
	[0197.169] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\MSBuild" (normalized: "c:\\program files\\msbuild"), fInfoLevelId=0x0, lpFileInformation=0x127bb4a8 | out: lpFileInformation=0x127bb4a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xf984abce, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf984abce, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.169] CreateFileW (lpFileName="C:\\Program Files\\MSBuild" (normalized: "c:\\program files\\msbuild"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.169] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xf984abce, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf984abce, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fca8
	[0197.170] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xf984abce, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf984abce, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.170] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18146040, ftCreationTime.dwHighDateTime=0x1d812ec, ftLastAccessTime.dwLowDateTime=0x536ce9e0, ftLastAccessTime.dwHighDateTime=0x1d81d9c, ftLastWriteTime.dwLowDateTime=0x536ce9e0, ftLastWriteTime.dwHighDateTime=0x1d81d9c, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="bitkinex.exe", cAlternateFileName="")) returned 1
	[0197.170] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54ebf660, ftCreationTime.dwHighDateTime=0x1d7c263, ftLastAccessTime.dwLowDateTime=0x81242dc0, ftLastAccessTime.dwHighDateTime=0x1d80899, ftLastWriteTime.dwLowDateTime=0x81242dc0, ftLastWriteTime.dwHighDateTime=0x1d80899, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="citizen.exe", cAlternateFileName="")) returned 1
	[0197.170] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde5c2433, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde5c2433, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0197.170] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.170] FindClose (in: hFindFile=0x79fca8 | out: hFindFile=0x79fca8) returned 1
	[0197.171] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft" (normalized: "c:\\program files\\msbuild\\microsoft"), fInfoLevelId=0x0, lpFileInformation=0x127bb5e8 | out: lpFileInformation=0x127bb5e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde5c2433, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde5c2433, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.171] CreateFileW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft" (normalized: "c:\\program files\\msbuild\\microsoft"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.171] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde5c2433, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde5c2433, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9e8
	[0197.172] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde5c2433, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde5c2433, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.172] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde5c2433, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde5c2433, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 1
	[0197.172] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.172] FindClose (in: hFindFile=0x79f9e8 | out: hFindFile=0x79f9e8) returned 1
	[0197.172] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation"), fInfoLevelId=0x0, lpFileInformation=0x127bb688 | out: lpFileInformation=0x127bb688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde5c2433, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde5c2433, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.173] CreateFileW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.174] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde5c2433, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde5c2433, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffe8
	[0197.174] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde5c2433, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde5c2433, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.174] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde5c2433, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde5c2433, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1
	[0197.174] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde5c2433, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde5c2433, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1
	[0197.174] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.175] FindClose (in: hFindFile=0x79ffe8 | out: hFindFile=0x79ffe8) returned 1
	[0197.175] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.0"), fInfoLevelId=0x0, lpFileInformation=0x127bb778 | out: lpFileInformation=0x127bb778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde5c2433, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde5c2433, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.175] CreateFileW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.0"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.175] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde5c2433, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde5c2433, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fd28
	[0197.176] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde5c2433, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde5c2433, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.176] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xdd6e4f3c, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xdd6e4f3c, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="WORKFL~1.TAR")) returned 1
	[0197.176] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xdd6e4f3c, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xdd6e4f3c, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x143e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="WORKFL~2.TAR")) returned 1
	[0197.176] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.176] FindClose (in: hFindFile=0x79fd28 | out: hFindFile=0x79fd28) returned 1
	[0197.176] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\workflow.targets"), fInfoLevelId=0x0, lpFileInformation=0x127bb868 | out: lpFileInformation=0x127bb868*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xdd6e4f3c, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xdd6e4f3c, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x1276)) returned 1
	[0197.177] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\workflow.visualbasic.targets"), fInfoLevelId=0x0, lpFileInformation=0x127bb8b8 | out: lpFileInformation=0x127bb8b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xdd6e4f3c, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xdd6e4f3c, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x143e)) returned 1
	[0197.177] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.5"), fInfoLevelId=0x0, lpFileInformation=0x127bb908 | out: lpFileInformation=0x127bb908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde5c2433, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde5c2433, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.178] CreateFileW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.5"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.178] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde5c2433, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde5c2433, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fda8
	[0197.178] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde5c2433, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde5c2433, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.178] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5fdd7fd, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc5fdd7fd, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xa2907c00, ftLastWriteTime.dwHighDateTime=0x1d06b09, nFileSizeHigh=0x0, nFileSizeLow=0x1c01, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="")) returned 1
	[0197.178] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5fdd7fd, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc5fdd7fd, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xa2907c00, ftLastWriteTime.dwHighDateTime=0x1d06b09, nFileSizeHigh=0x0, nFileSizeLow=0x21e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="")) returned 1
	[0197.178] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.178] FindClose (in: hFindFile=0x79fda8 | out: hFindFile=0x79fda8) returned 1
	[0197.179] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\workflow.targets"), fInfoLevelId=0x0, lpFileInformation=0x127bb9f8 | out: lpFileInformation=0x127bb9f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5fdd7fd, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc5fdd7fd, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xa2907c00, ftLastWriteTime.dwHighDateTime=0x1d06b09, nFileSizeHigh=0x0, nFileSizeLow=0x1c01)) returned 1
	[0197.187] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\workflow.visualbasic.targets"), fInfoLevelId=0x0, lpFileInformation=0x127bba48 | out: lpFileInformation=0x127bba48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5fdd7fd, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc5fdd7fd, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xa2907c00, ftLastWriteTime.dwHighDateTime=0x1d06b09, nFileSizeHigh=0x0, nFileSizeLow=0x21e8)) returned 1
	[0197.187] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\MSBuild\\bitkinex.exe" (normalized: "c:\\program files\\msbuild\\bitkinex.exe"), fInfoLevelId=0x0, lpFileInformation=0x127bba98 | out: lpFileInformation=0x127bba98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18146040, ftCreationTime.dwHighDateTime=0x1d812ec, ftLastAccessTime.dwLowDateTime=0x536ce9e0, ftLastAccessTime.dwHighDateTime=0x1d81d9c, ftLastWriteTime.dwLowDateTime=0x536ce9e0, ftLastWriteTime.dwHighDateTime=0x1d81d9c, nFileSizeHigh=0x0, nFileSizeLow=0x13a00)) returned 1
	[0197.187] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\MSBuild\\citizen.exe" (normalized: "c:\\program files\\msbuild\\citizen.exe"), fInfoLevelId=0x0, lpFileInformation=0x127bbae8 | out: lpFileInformation=0x127bbae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54ebf660, ftCreationTime.dwHighDateTime=0x1d7c263, ftLastAccessTime.dwLowDateTime=0x81242dc0, ftLastAccessTime.dwHighDateTime=0x1d80899, ftLastWriteTime.dwLowDateTime=0x81242dc0, ftLastWriteTime.dwHighDateTime=0x1d80899, nFileSizeHigh=0x0, nFileSizeLow=0x13a00)) returned 1
	[0197.188] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office 15" (normalized: "c:\\program files\\microsoft office 15"), fInfoLevelId=0x0, lpFileInformation=0x127bbb38 | out: lpFileInformation=0x127bbb38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b3095dc, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0xf8548aad, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf8548aad, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office 15" (normalized: "c:\\program files\\microsoft office 15"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.188] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office 15\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b3095dc, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0xf8548aad, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf8548aad, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fa68
	[0197.188] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b3095dc, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0xf8548aad, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf8548aad, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.188] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ff11b10, ftCreationTime.dwHighDateTime=0x1d7b4f2, ftLastAccessTime.dwLowDateTime=0xcbc425d0, ftLastAccessTime.dwHighDateTime=0x1d7e399, ftLastWriteTime.dwLowDateTime=0xcbc425d0, ftLastWriteTime.dwHighDateTime=0x1d7e399, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ccv_server.exe", cAlternateFileName="CCV_SE~1.EXE")) returned 1
	[0197.188] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b3095dc, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b3095dc, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1b355a19, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClientX64", cAlternateFileName="CLIENT~1")) returned 1
	[0197.188] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.188] FindClose (in: hFindFile=0x79fa68 | out: hFindFile=0x79fa68) returned 1
	[0197.188] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office 15\\ClientX64" (normalized: "c:\\program files\\microsoft office 15\\clientx64"), fInfoLevelId=0x0, lpFileInformation=0x127bbc28 | out: lpFileInformation=0x127bbc28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b3095dc, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b355a19, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1b355a19, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office 15\\ClientX64" (normalized: "c:\\program files\\microsoft office 15\\clientx64"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.189] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office 15\\ClientX64\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b3095dc, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b3095dc, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1b355a19, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fb28
	[0197.189] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b3095dc, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b3095dc, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1b355a19, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.189] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b3095dc, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b3095dc, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x20031300, ftLastWriteTime.dwHighDateTime=0x1d0d7b1, nFileSizeHigh=0x0, nFileSizeLow=0x10ae80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IntegratedOffice.exe", cAlternateFileName="INTEGR~1.EXE")) returned 1
	[0197.189] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b355a19, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b355a19, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x20031300, ftLastWriteTime.dwHighDateTime=0x1d0d7b1, nFileSizeHigh=0x0, nFileSizeLow=0x10ae80, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeClickToRun.exe", cAlternateFileName="OFFICE~1.EXE")) returned 1
	[0197.189] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.189] FindClose (in: hFindFile=0x79fb28 | out: hFindFile=0x79fb28) returned 1
	[0197.189] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office 15\\ClientX64\\IntegratedOffice.exe" (normalized: "c:\\program files\\microsoft office 15\\clientx64\\integratedoffice.exe"), fInfoLevelId=0x0, lpFileInformation=0x127bbd18 | out: lpFileInformation=0x127bbd18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b3095dc, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b3095dc, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x20031300, ftLastWriteTime.dwHighDateTime=0x1d0d7b1, nFileSizeHigh=0x0, nFileSizeLow=0x10ae80)) returned 1
	[0197.189] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office 15\\ClientX64\\OfficeClickToRun.exe" (normalized: "c:\\program files\\microsoft office 15\\clientx64\\officeclicktorun.exe"), fInfoLevelId=0x0, lpFileInformation=0x127bbd68 | out: lpFileInformation=0x127bbd68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b355a19, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b355a19, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x20031300, ftLastWriteTime.dwHighDateTime=0x1d0d7b1, nFileSizeHigh=0x0, nFileSizeLow=0x10ae80)) returned 1
	[0197.189] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft Office 15\\ccv_server.exe" (normalized: "c:\\program files\\microsoft office 15\\ccv_server.exe"), fInfoLevelId=0x0, lpFileInformation=0x127bbdb8 | out: lpFileInformation=0x127bbdb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ff11b10, ftCreationTime.dwHighDateTime=0x1d7b4f2, ftLastAccessTime.dwLowDateTime=0xcbc425d0, ftLastAccessTime.dwHighDateTime=0x1d7e399, ftLastWriteTime.dwLowDateTime=0xcbc425d0, ftLastWriteTime.dwHighDateTime=0x1d7e399, nFileSizeHigh=0x0, nFileSizeLow=0x13a00)) returned 1
	[0197.190] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies" (normalized: "c:\\program files\\reference assemblies"), fInfoLevelId=0x0, lpFileInformation=0x127bbe08 | out: lpFileInformation=0x127bbe08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde5c2433, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde5c2433, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.190] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies" (normalized: "c:\\program files\\reference assemblies"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.190] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde5c2433, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde5c2433, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fa68
	[0197.190] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde5c2433, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde5c2433, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.190] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde5c2433, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde5c2433, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0197.191] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.191] FindClose (in: hFindFile=0x79fa68 | out: hFindFile=0x79fa68) returned 1
	[0197.191] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft" (normalized: "c:\\program files\\reference assemblies\\microsoft"), fInfoLevelId=0x0, lpFileInformation=0x127bbea8 | out: lpFileInformation=0x127bbea8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde5c2433, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde5c2433, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.191] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft" (normalized: "c:\\program files\\reference assemblies\\microsoft"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.191] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde5c2433, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde5c2433, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fce8
	[0197.191] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde5c2433, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde5c2433, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.191] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde634c26, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde634c26, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 1
	[0197.191] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.191] FindClose (in: hFindFile=0x79fce8 | out: hFindFile=0x79fce8) returned 1
	[0197.192] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework"), fInfoLevelId=0x0, lpFileInformation=0x127bbf48 | out: lpFileInformation=0x127bbf48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde634c26, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde634c26, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.192] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.192] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde634c26, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde634c26, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fda8
	[0197.192] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde634c26, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde634c26, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.192] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde634c26, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde634c26, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1
	[0197.192] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde634c26, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde6b7421, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde6b7421, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1
	[0197.192] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.192] FindClose (in: hFindFile=0x79fda8 | out: hFindFile=0x79fda8) returned 1
	[0197.192] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0"), fInfoLevelId=0x0, lpFileInformation=0x127d2058 | out: lpFileInformation=0x127d2058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde634c26, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde634c26, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.193] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.193] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde634c26, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde634c26, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fd68
	[0197.215] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde634c26, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde634c26, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.215] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc678dc31, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc678dc31, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x49907a00, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x92000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationBuildTasks.dll", cAlternateFileName="")) returned 1
	[0197.215] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc668f0fd, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc668f0fd, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x49907a00, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x3d1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationCore.dll", cAlternateFileName="")) returned 1
	[0197.215] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc679eccd, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc679eccd, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x49907a00, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x30000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Aero.dll", cAlternateFileName="")) returned 1
	[0197.215] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc67a282c, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc67a282c, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x49907a00, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Classic.dll", cAlternateFileName="")) returned 1
	[0197.215] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc67ac486, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc67ac486, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x49907a00, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x46d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.dll", cAlternateFileName="")) returned 1
	[0197.215] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc67a4f49, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc67a4f49, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x49907a00, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x5d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Luna.dll", cAlternateFileName="")) returned 1
	[0197.215] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc67a9d6d, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc67a9d6d, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x49907a00, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Royale.dll", cAlternateFileName="")) returned 1
	[0197.215] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc68153ee, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc68153ee, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x49907a00, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x82000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReachFramework.dll", cAlternateFileName="")) returned 1
	[0197.215] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde634c26, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde634c26, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde634c26, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RedistList", cAlternateFileName="REDIST~1")) returned 1
	[0197.215] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520d4643, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xdbf02c21, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xdbf02c21, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x63000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.dll", cAlternateFileName="")) returned 1
	[0197.216] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520d4643, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xdc508fdd, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xdc508fdd, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.Selectors.dll", cAlternateFileName="")) returned 1
	[0197.216] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52061f3c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xd8046478, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xd8046478, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IO.Log.dll", cAlternateFileName="")) returned 1
	[0197.216] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc673aa72, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc673aa72, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x49907a00, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x57800, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Printing.dll", cAlternateFileName="")) returned 1
	[0197.216] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520ae3ed, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xd91f8e32, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xd921f2a8, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0xcf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Runtime.Serialization.dll", cAlternateFileName="")) returned 1
	[0197.216] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52088196, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xd8e99330, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xd8f6823d, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x516000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.dll", cAlternateFileName="")) returned 1
	[0197.216] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc681dcd3, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc681dcd3, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x5821300, ftLastWriteTime.dwHighDateTime=0x1d06b0a, nFileSizeHigh=0x0, nFileSizeLow=0xa9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Speech.dll", cAlternateFileName="")) returned 1
	[0197.216] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc685d487, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc685d487, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x4d240100, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x103000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Workflow.Activities.dll", cAlternateFileName="")) returned 1
	[0197.216] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc686f981, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc686f981, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x4d240100, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x173000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Workflow.ComponentModel.dll", cAlternateFileName="")) returned 1
	[0197.216] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6888035, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc6888035, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x4d240100, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x6f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Workflow.Runtime.dll", cAlternateFileName="")) returned 1
	[0197.216] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc682c746, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc682c746, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x49907a00, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x2a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationClient.dll", cAlternateFileName="")) returned 1
	[0197.216] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc683016e, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc683016e, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x49907a00, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x5d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationClientsideProviders.dll", cAlternateFileName="")) returned 1
	[0197.216] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc68378df, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc68378df, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x49907a00, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationProvider.dll", cAlternateFileName="")) returned 1
	[0197.216] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6839e32, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc6839e32, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x49907a00, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationTypes.dll", cAlternateFileName="")) returned 1
	[0197.216] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc683c52e, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc683c52e, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x49907a00, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x110000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsBase.dll", cAlternateFileName="")) returned 1
	[0197.216] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6850fa6, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc6850fa6, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x49907a00, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsFormsIntegration.dll", cAlternateFileName="")) returned 1
	[0197.216] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde634c26, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xdd6e4f3c, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xdd6e4f3c, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinFXList.xml", cAlternateFileName="WINFXL~1.XML")) returned 1
	[0197.216] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.216] FindClose (in: hFindFile=0x79fd68 | out: hFindFile=0x79fd68) returned 1
	[0197.217] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\presentationbuildtasks.dll"), fInfoLevelId=0x0, lpFileInformation=0x127d28c8 | out: lpFileInformation=0x127d28c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc678dc31, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc678dc31, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x49907a00, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x92000)) returned 1
	[0197.222] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\presentationcore.dll"), fInfoLevelId=0x0, lpFileInformation=0x127d2918 | out: lpFileInformation=0x127d2918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc668f0fd, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc668f0fd, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x49907a00, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x3d1e00)) returned 1
	[0197.225] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\presentationframework.aero.dll"), fInfoLevelId=0x0, lpFileInformation=0x127d2968 | out: lpFileInformation=0x127d2968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc679eccd, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc679eccd, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x49907a00, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x30000)) returned 1
	[0197.228] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\presentationframework.classic.dll"), fInfoLevelId=0x0, lpFileInformation=0x127d29b8 | out: lpFileInformation=0x127d29b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc67a282c, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc67a282c, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x49907a00, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x22000)) returned 1
	[0197.230] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Luna.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\presentationframework.luna.dll"), fInfoLevelId=0x0, lpFileInformation=0x127d2a08 | out: lpFileInformation=0x127d2a08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc67a4f49, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc67a4f49, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x49907a00, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x5d000)) returned 1
	[0197.230] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Royale.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\presentationframework.royale.dll"), fInfoLevelId=0x0, lpFileInformation=0x127d2a58 | out: lpFileInformation=0x127d2a58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc67a9d6d, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc67a9d6d, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x49907a00, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x28000)) returned 1
	[0197.231] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\presentationframework.dll"), fInfoLevelId=0x0, lpFileInformation=0x127d2aa8 | out: lpFileInformation=0x127d2aa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc67ac486, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc67ac486, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x49907a00, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x46d000)) returned 1
	[0197.232] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\ReachFramework.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\reachframework.dll"), fInfoLevelId=0x0, lpFileInformation=0x127d2af8 | out: lpFileInformation=0x127d2af8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc68153ee, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc68153ee, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x49907a00, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x82000)) returned 1
	[0197.238] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist"), fInfoLevelId=0x0, lpFileInformation=0x127d2b48 | out: lpFileInformation=0x127d2b48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde634c26, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde634c26, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde634c26, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.240] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.240] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde634c26, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde634c26, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde634c26, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fa28
	[0197.240] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde634c26, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde634c26, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde634c26, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.240] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde634c26, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xdd6e4f3c, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xdd6e4f3c, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x1bd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="FRAMEW~1.XML")) returned 1
	[0197.240] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.240] FindClose (in: hFindFile=0x79fa28 | out: hFindFile=0x79fa28) returned 1
	[0197.241] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\frameworklist.xml"), fInfoLevelId=0x0, lpFileInformation=0x127d2be8 | out: lpFileInformation=0x127d2be8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde634c26, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xdd6e4f3c, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xdd6e4f3c, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x1bd4)) returned 1
	[0197.242] SetEvent (hEvent=0x124) returned 1
	[0197.242] SetEvent (hEvent=0x12c) returned 1
	[0197.242] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0197.248] SetEvent (hEvent=0x14c) returned 1
	[0197.248] SetEvent (hEvent=0x12c) returned 1
	[0197.248] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0197.253] SetEvent (hEvent=0x124) returned 1
	[0197.253] SetEvent (hEvent=0x12c) returned 1
	[0197.253] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0197.309] SetEvent (hEvent=0x14c) returned 1
	[0197.309] SetEvent (hEvent=0x12c) returned 1
	[0197.309] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0197.388] SetEvent (hEvent=0x124) returned 1
	[0197.388] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x3000, flProtect=0x4) returned 0x32910000
	[0197.389] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.IO.Log.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\system.io.log.dll"), fInfoLevelId=0x0, lpFileInformation=0x127d2c38 | out: lpFileInformation=0x127d2c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52061f3c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xd8046478, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xd8046478, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x20000)) returned 1
	[0197.397] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.IdentityModel.Selectors.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\system.identitymodel.selectors.dll"), fInfoLevelId=0x0, lpFileInformation=0x127fc008 | out: lpFileInformation=0x127fc008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520d4643, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xdc508fdd, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xdc508fdd, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x1e000)) returned 1
	[0197.398] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.IdentityModel.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\system.identitymodel.dll"), fInfoLevelId=0x0, lpFileInformation=0x127fc058 | out: lpFileInformation=0x127fc058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520d4643, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xdbf02c21, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xdbf02c21, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x63000)) returned 1
	[0197.398] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Printing.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\system.printing.dll"), fInfoLevelId=0x0, lpFileInformation=0x127fc0a8 | out: lpFileInformation=0x127fc0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc673aa72, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc673aa72, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x49907a00, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x57800)) returned 1
	[0197.402] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0197.423] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Runtime.Serialization.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\system.runtime.serialization.dll"), fInfoLevelId=0x0, lpFileInformation=0x12430058 | out: lpFileInformation=0x12430058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520ae3ed, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xd91f8e32, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xd921f2a8, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0xcf000)) returned 1
	[0197.424] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.ServiceModel.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\system.servicemodel.dll"), fInfoLevelId=0x0, lpFileInformation=0x124300a8 | out: lpFileInformation=0x124300a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52088196, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xd8e99330, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xd8f6823d, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x516000)) returned 1
	[0197.424] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Speech.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\system.speech.dll"), fInfoLevelId=0x0, lpFileInformation=0x124300f8 | out: lpFileInformation=0x124300f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc681dcd3, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc681dcd3, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x5821300, ftLastWriteTime.dwHighDateTime=0x1d06b0a, nFileSizeHigh=0x0, nFileSizeLow=0xa9000)) returned 1
	[0197.428] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Workflow.Activities.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\system.workflow.activities.dll"), fInfoLevelId=0x0, lpFileInformation=0x12430148 | out: lpFileInformation=0x12430148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc685d487, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc685d487, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x4d240100, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x103000)) returned 1
	[0197.429] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Workflow.ComponentModel.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\system.workflow.componentmodel.dll"), fInfoLevelId=0x0, lpFileInformation=0x12430198 | out: lpFileInformation=0x12430198*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc686f981, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc686f981, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x4d240100, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x173000)) returned 1
	[0197.429] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Workflow.Runtime.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\system.workflow.runtime.dll"), fInfoLevelId=0x0, lpFileInformation=0x124301e8 | out: lpFileInformation=0x124301e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6888035, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc6888035, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x4d240100, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x6f000)) returned 1
	[0197.430] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\UIAutomationClient.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\uiautomationclient.dll"), fInfoLevelId=0x0, lpFileInformation=0x12430238 | out: lpFileInformation=0x12430238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc682c746, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc682c746, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x49907a00, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x2a000)) returned 1
	[0197.433] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\UIAutomationClientsideProviders.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\uiautomationclientsideproviders.dll"), fInfoLevelId=0x0, lpFileInformation=0x12430288 | out: lpFileInformation=0x12430288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc683016e, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc683016e, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x49907a00, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x5d000)) returned 1
	[0197.437] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\UIAutomationProvider.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\uiautomationprovider.dll"), fInfoLevelId=0x0, lpFileInformation=0x124302d8 | out: lpFileInformation=0x124302d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc68378df, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc68378df, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x49907a00, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1
	[0197.437] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\UIAutomationTypes.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\uiautomationtypes.dll"), fInfoLevelId=0x0, lpFileInformation=0x12430328 | out: lpFileInformation=0x12430328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6839e32, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc6839e32, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x49907a00, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x18000)) returned 1
	[0197.438] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\winfxlist.xml"), fInfoLevelId=0x0, lpFileInformation=0x12430378 | out: lpFileInformation=0x12430378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde634c26, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xdd6e4f3c, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xdd6e4f3c, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0xa12)) returned 1
	[0197.438] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WindowsBase.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\windowsbase.dll"), fInfoLevelId=0x0, lpFileInformation=0x124303c8 | out: lpFileInformation=0x124303c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc683c52e, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc683c52e, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x49907a00, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x110000)) returned 1
	[0197.440] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WindowsFormsIntegration.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\windowsformsintegration.dll"), fInfoLevelId=0x0, lpFileInformation=0x12430418 | out: lpFileInformation=0x12430418*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6850fa6, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc6850fa6, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x49907a00, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x17000)) returned 1
	[0197.440] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5"), fInfoLevelId=0x0, lpFileInformation=0x12430468 | out: lpFileInformation=0x12430468*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde634c26, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde6b7421, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde6b7421, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.441] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.441] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde634c26, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde6b7421, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde6b7421, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fae8
	[0197.444] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde634c26, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde6b7421, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde6b7421, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.445] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6599d45, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc6599d45, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Conversion.v3.5.dll", cAlternateFileName="")) returned 1
	[0197.445] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6599d45, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc6599d45, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x9c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Engine.dll", cAlternateFileName="")) returned 1
	[0197.445] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6599d45, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc6599d45, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Framework.dll", cAlternateFileName="")) returned 1
	[0197.445] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6599d45, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc6599d45, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Utilities.v3.5.dll", cAlternateFileName="")) returned 1
	[0197.445] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65bfff1, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc65bfff1, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualC.STLCLR.dll", cAlternateFileName="")) returned 1
	[0197.445] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde6b7421, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde6b7421, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde6b7421, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RedistList", cAlternateFileName="REDIST~1")) returned 1
	[0197.445] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65bfff1, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc65bfff1, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.AddIn.Contract.dll", cAlternateFileName="")) returned 1
	[0197.446] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65bfff1, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc65bfff1, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.AddIn.dll", cAlternateFileName="")) returned 1
	[0197.446] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65bfff1, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc65bfff1, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ComponentModel.DataAnnotations.dll", cAlternateFileName="")) returned 1
	[0197.446] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65bfff1, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc65bfff1, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0xa4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Core.dll", cAlternateFileName="")) returned 1
	[0197.446] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65bfff1, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc65bfff1, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.DataSetExtensions.dll", cAlternateFileName="")) returned 1
	[0197.446] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65ec746, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc65ec746, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x38000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Entity.Design.dll", cAlternateFileName="")) returned 1
	[0197.446] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65f0213, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc65f0213, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x2bf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Entity.dll", cAlternateFileName="")) returned 1
	[0197.446] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65f63e3, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc65f63e3, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0xa7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Linq.dll", cAlternateFileName="")) returned 1
	[0197.446] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65f63e3, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc65f63e3, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x71000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Services.Client.dll", cAlternateFileName="")) returned 1
	[0197.446] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc661ca76, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc661ca76, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Services.Design.dll", cAlternateFileName="")) returned 1
	[0197.446] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc661ca76, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc661ca76, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0xaa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Services.dll", cAlternateFileName="")) returned 1
	[0197.446] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65bfff1, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc65bfff1, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x47000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.DirectoryServices.AccountManagement.dll", cAlternateFileName="")) returned 1
	[0197.446] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65bfff1, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc65bfff1, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Management.Instrumentation.dll", cAlternateFileName="")) returned 1
	[0197.446] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc661ca76, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc661ca76, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x3a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Net.dll", cAlternateFileName="")) returned 1
	[0197.446] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5fdd7fd, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc5fdd7fd, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1ea62600, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x78000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.Web.dll", cAlternateFileName="")) returned 1
	[0197.446] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc661ca76, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc661ca76, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x13000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Abstractions.dll", cAlternateFileName="")) returned 1
	[0197.446] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65bfff1, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc65bfff1, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.DynamicData.Design.dll", cAlternateFileName="")) returned 1
	[0197.446] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc661ca76, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc661ca76, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x38000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.DynamicData.dll", cAlternateFileName="")) returned 1
	[0197.446] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc661ca76, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc661ca76, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Entity.Design.dll", cAlternateFileName="")) returned 1
	[0197.446] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc661ca76, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc661ca76, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Entity.dll", cAlternateFileName="")) returned 1
	[0197.447] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc661ca76, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc661ca76, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x52000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Extensions.Design.dll", cAlternateFileName="")) returned 1
	[0197.447] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc661ca76, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc661ca76, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x139000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Extensions.dll", cAlternateFileName="")) returned 1
	[0197.447] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6642d0c, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc6642d0c, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Routing.dll", cAlternateFileName="")) returned 1
	[0197.447] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6668de3, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc6668de3, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x2239ad00, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Windows.Presentation.dll", cAlternateFileName="")) returned 1
	[0197.447] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5fdd7fd, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc5fdd7fd, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1ea62600, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x75000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.WorkflowServices.dll", cAlternateFileName="")) returned 1
	[0197.447] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6642d0c, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc6642d0c, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Xml.Linq.dll", cAlternateFileName="")) returned 1
	[0197.447] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.447] FindClose (in: hFindFile=0x79fae8 | out: hFindFile=0x79fae8) returned 1
	[0197.448] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Microsoft.Build.Conversion.v3.5.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\microsoft.build.conversion.v3.5.dll"), fInfoLevelId=0x0, lpFileInformation=0x12430eb8 | out: lpFileInformation=0x12430eb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6599d45, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc6599d45, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x1a000)) returned 1
	[0197.453] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Microsoft.Build.Engine.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\microsoft.build.engine.dll"), fInfoLevelId=0x0, lpFileInformation=0x12430f08 | out: lpFileInformation=0x12430f08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6599d45, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc6599d45, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x9c000)) returned 1
	[0197.456] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Microsoft.Build.Framework.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\microsoft.build.framework.dll"), fInfoLevelId=0x0, lpFileInformation=0x12430f58 | out: lpFileInformation=0x12430f58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6599d45, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc6599d45, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x9000)) returned 1
	[0197.458] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Microsoft.Build.Utilities.v3.5.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\microsoft.build.utilities.v3.5.dll"), fInfoLevelId=0x0, lpFileInformation=0x12430fa8 | out: lpFileInformation=0x12430fa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6599d45, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc6599d45, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x14000)) returned 1
	[0197.458] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Microsoft.VisualC.STLCLR.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\microsoft.visualc.stlclr.dll"), fInfoLevelId=0x0, lpFileInformation=0x12430ff8 | out: lpFileInformation=0x12430ff8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65bfff1, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc65bfff1, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0xa800)) returned 1
	[0197.460] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\redistlist"), fInfoLevelId=0x0, lpFileInformation=0x12431048 | out: lpFileInformation=0x12431048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde6b7421, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde6b7421, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde6b7421, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.461] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\redistlist"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.461] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde6b7421, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde6b7421, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde6b7421, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ff28
	[0197.461] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde6b7421, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xde6b7421, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xde6b7421, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.461] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6599d45, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc6599d45, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xa4f2d600, ftLastWriteTime.dwHighDateTime=0x1d06b09, nFileSizeHigh=0x0, nFileSizeLow=0x5ec3, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="")) returned 1
	[0197.461] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.461] FindClose (in: hFindFile=0x79ff28 | out: hFindFile=0x79ff28) returned 1
	[0197.461] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\redistlist\\frameworklist.xml"), fInfoLevelId=0x0, lpFileInformation=0x124310e8 | out: lpFileInformation=0x124310e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6599d45, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc6599d45, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xa4f2d600, ftLastWriteTime.dwHighDateTime=0x1d06b09, nFileSizeHigh=0x0, nFileSizeLow=0x5ec3)) returned 1
	[0197.463] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.AddIn.Contract.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\system.addin.contract.dll"), fInfoLevelId=0x0, lpFileInformation=0x12431138 | out: lpFileInformation=0x12431138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65bfff1, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc65bfff1, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0xb000)) returned 1
	[0197.465] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.AddIn.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\system.addin.dll"), fInfoLevelId=0x0, lpFileInformation=0x12431188 | out: lpFileInformation=0x12431188*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65bfff1, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc65bfff1, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x28000)) returned 1
	[0197.482] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.ComponentModel.DataAnnotations.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\system.componentmodel.dataannotations.dll"), fInfoLevelId=0x0, lpFileInformation=0x124311d8 | out: lpFileInformation=0x124311d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65bfff1, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc65bfff1, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0xe000)) returned 1
	[0197.486] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Core.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\system.core.dll"), fInfoLevelId=0x0, lpFileInformation=0x12431228 | out: lpFileInformation=0x12431228*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65bfff1, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc65bfff1, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0xa4000)) returned 1
	[0197.491] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.DataSetExtensions.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\system.data.datasetextensions.dll"), fInfoLevelId=0x0, lpFileInformation=0x12431278 | out: lpFileInformation=0x12431278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65bfff1, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc65bfff1, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0xd000)) returned 1
	[0197.491] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Entity.Design.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\system.data.entity.design.dll"), fInfoLevelId=0x0, lpFileInformation=0x124312c8 | out: lpFileInformation=0x124312c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65ec746, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc65ec746, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x38000)) returned 1
	[0197.491] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Entity.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\system.data.entity.dll"), fInfoLevelId=0x0, lpFileInformation=0x12431318 | out: lpFileInformation=0x12431318*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65f0213, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc65f0213, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x2bf000)) returned 1
	[0197.497] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Linq.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\system.data.linq.dll"), fInfoLevelId=0x0, lpFileInformation=0x12431368 | out: lpFileInformation=0x12431368*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65f63e3, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc65f63e3, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0xa7000)) returned 1
	[0197.497] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Services.Client.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\system.data.services.client.dll"), fInfoLevelId=0x0, lpFileInformation=0x124313b8 | out: lpFileInformation=0x124313b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65f63e3, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc65f63e3, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x71000)) returned 1
	[0197.499] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Services.Design.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\system.data.services.design.dll"), fInfoLevelId=0x0, lpFileInformation=0x12431408 | out: lpFileInformation=0x12431408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc661ca76, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc661ca76, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x28000)) returned 1
	[0197.499] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Services.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\system.data.services.dll"), fInfoLevelId=0x0, lpFileInformation=0x12431458 | out: lpFileInformation=0x12431458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc661ca76, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc661ca76, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0xaa000)) returned 1
	[0197.501] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.DirectoryServices.AccountManagement.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\system.directoryservices.accountmanagement.dll"), fInfoLevelId=0x0, lpFileInformation=0x124314a8 | out: lpFileInformation=0x124314a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65bfff1, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc65bfff1, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x47000)) returned 1
	[0197.502] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Management.Instrumentation.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\system.management.instrumentation.dll"), fInfoLevelId=0x0, lpFileInformation=0x124314f8 | out: lpFileInformation=0x124314f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65bfff1, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc65bfff1, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x23000)) returned 1
	[0197.503] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Net.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\system.net.dll"), fInfoLevelId=0x0, lpFileInformation=0x12431548 | out: lpFileInformation=0x12431548*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc661ca76, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc661ca76, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x3a000)) returned 1
	[0197.503] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.ServiceModel.Web.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\system.servicemodel.web.dll"), fInfoLevelId=0x0, lpFileInformation=0x12431598 | out: lpFileInformation=0x12431598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5fdd7fd, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc5fdd7fd, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1ea62600, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x78000)) returned 1
	[0197.504] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Abstractions.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\system.web.abstractions.dll"), fInfoLevelId=0x0, lpFileInformation=0x124315e8 | out: lpFileInformation=0x124315e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc661ca76, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc661ca76, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x13000)) returned 1
	[0197.508] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.DynamicData.Design.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\system.web.dynamicdata.design.dll"), fInfoLevelId=0x0, lpFileInformation=0x12431638 | out: lpFileInformation=0x12431638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65bfff1, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc65bfff1, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x8000)) returned 1
	[0197.520] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.DynamicData.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\system.web.dynamicdata.dll"), fInfoLevelId=0x0, lpFileInformation=0x12431688 | out: lpFileInformation=0x12431688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc661ca76, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc661ca76, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x38000)) returned 1
	[0197.520] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Entity.Design.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\system.web.entity.design.dll"), fInfoLevelId=0x0, lpFileInformation=0x124316d8 | out: lpFileInformation=0x124316d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc661ca76, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc661ca76, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x20000)) returned 1
	[0197.521] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Entity.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\system.web.entity.dll"), fInfoLevelId=0x0, lpFileInformation=0x12431728 | out: lpFileInformation=0x12431728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc661ca76, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc661ca76, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x22000)) returned 1
	[0197.521] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Extensions.Design.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\system.web.extensions.design.dll"), fInfoLevelId=0x0, lpFileInformation=0x12431778 | out: lpFileInformation=0x12431778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc661ca76, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc661ca76, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x52000)) returned 1
	[0197.523] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Extensions.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\system.web.extensions.dll"), fInfoLevelId=0x0, lpFileInformation=0x124317c8 | out: lpFileInformation=0x124317c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc661ca76, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc661ca76, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x139000)) returned 1
	[0197.523] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Routing.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\system.web.routing.dll"), fInfoLevelId=0x0, lpFileInformation=0x12431818 | out: lpFileInformation=0x12431818*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6642d0c, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc6642d0c, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0xf000)) returned 1
	[0197.525] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Windows.Presentation.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\system.windows.presentation.dll"), fInfoLevelId=0x0, lpFileInformation=0x12431868 | out: lpFileInformation=0x12431868*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6668de3, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc6668de3, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x2239ad00, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x3000)) returned 1
	[0197.526] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.WorkflowServices.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\system.workflowservices.dll"), fInfoLevelId=0x0, lpFileInformation=0x124318b8 | out: lpFileInformation=0x124318b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5fdd7fd, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc5fdd7fd, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1ea62600, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x75000)) returned 1
	[0197.527] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Xml.Linq.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\system.xml.linq.dll"), fInfoLevelId=0x0, lpFileInformation=0x12431908 | out: lpFileInformation=0x12431908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6642d0c, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc6642d0c, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x1fd75300, ftLastWriteTime.dwHighDateTime=0x1d10db2, nFileSizeHigh=0x0, nFileSizeLow=0x22000)) returned 1
	[0197.527] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Uninstall Information" (normalized: "c:\\program files\\uninstall information"), fInfoLevelId=0x0, lpFileInformation=0x12431958 | out: lpFileInformation=0x12431958*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf22b9950, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xf22b9950, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xf22b9950, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.528] CreateFileW (lpFileName="C:\\Program Files\\Uninstall Information" (normalized: "c:\\program files\\uninstall information"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.528] FindFirstFileW (in: lpFileName="C:\\Program Files\\Uninstall Information\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf22b9950, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xf22b9950, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xf22b9950, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0068
	[0197.528] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf22b9950, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xf22b9950, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xf22b9950, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.528] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.528] FindClose (in: hFindFile=0x7a0068 | out: hFindFile=0x7a0068) returned 1
	[0197.528] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender" (normalized: "c:\\program files\\windows defender"), fInfoLevelId=0x0, lpFileInformation=0x124319a8 | out: lpFileInformation=0x124319a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf8f5a609, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf8f5a609, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0197.528] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender" (normalized: "c:\\program files\\windows defender"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.529] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Defender\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf8f5a609, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf8f5a609, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fba8
	[0197.529] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf8f5a609, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf8f5a609, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.529] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x24b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AmMonitoringInstall.mof", cAlternateFileName="")) returned 1
	[0197.529] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="AMMonitoringProvider.dll", cAlternateFileName="")) returned 1
	[0197.529] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x520c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AmStatusInstall.mof", cAlternateFileName="")) returned 1
	[0197.529] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x99c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClientWMIInstall.mof", cAlternateFileName="")) returned 1
	[0197.529] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConfigSecurityPolicy.exe", cAlternateFileName="")) returned 1
	[0197.529] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x68400, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataLayer.dll", cAlternateFileName="")) returned 1
	[0197.529] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2affc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2affc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2affc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x171cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DbgHelp.dll", cAlternateFileName="")) returned 1
	[0197.529] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2fc46e, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2fc46e, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2fc46e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12200, dwReserved0=0x0, dwReserved1=0x0, cFileName="DefenderCSP.dll", cAlternateFileName="")) returned 1
	[0197.546] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2081c9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd2081c9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd2081c9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0197.546] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2affc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2affc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2affc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x42000, dwReserved0=0x0, dwReserved1=0x0, cFileName="EppManifest.dll", cAlternateFileName="")) returned 1
	[0197.546] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11af3b60, ftCreationTime.dwHighDateTime=0x1d7d2b1, ftLastAccessTime.dwLowDateTime=0x17eb29b0, ftLastAccessTime.dwHighDateTime=0x1d7e5c3, ftLastWriteTime.dwLowDateTime=0x17eb29b0, ftLastWriteTime.dwHighDateTime=0x1d7e5c3, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="far.exe", cAlternateFileName="")) returned 1
	[0197.546] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x169, dwReserved0=0x0, dwReserved1=0x0, cFileName="FepUnregister.mof", cAlternateFileName="")) returned 1
	[0197.546] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b73f6f0, ftCreationTime.dwHighDateTime=0x1d7c1ef, ftLastAccessTime.dwLowDateTime=0x1fb8b8a0, ftLastAccessTime.dwHighDateTime=0x1d80f8b, ftLastWriteTime.dwLowDateTime=0x1fb8b8a0, ftLastWriteTime.dwHighDateTime=0x1d80f8b, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="four.exe", cAlternateFileName="")) returned 1
	[0197.546] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289d66, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe289d66, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe289d66, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x19e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAsDesc.dll", cAlternateFileName="")) returned 1
	[0197.546] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289d66, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe289d66, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe289d66, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xdb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpClient.dll", cAlternateFileName="")) returned 1
	[0197.547] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289d66, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe289d66, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe289d66, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x5a660, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpCmdRun.exe", cAlternateFileName="")) returned 1
	[0197.547] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289d66, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe289d66, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe289d66, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x52a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpCommu.dll", cAlternateFileName="")) returned 1
	[0197.547] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289d66, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe289d66, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2affc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1a200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpEvMsg.dll", cAlternateFileName="")) returned 1
	[0197.547] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289d66, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe289d66, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe289d66, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x18e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpOAV.dll", cAlternateFileName="")) returned 1
	[0197.547] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpProvider.dll", cAlternateFileName="")) returned 1
	[0197.547] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289d66, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe289d66, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe289d66, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x89800, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpRtp.dll", cAlternateFileName="")) returned 1
	[0197.547] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289d66, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe289d66, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe289d66, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1c2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpSvc.dll", cAlternateFileName="")) returned 1
	[0197.547] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289d66, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe289d66, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe289d66, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpTpmAtt.dll", cAlternateFileName="")) returned 1
	[0197.547] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2affc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2affc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2affc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpuxhostproxy.dll", cAlternateFileName="")) returned 1
	[0197.547] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2affc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2affc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2affc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xdd60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpUXSrv.exe", cAlternateFileName="")) returned 1
	[0197.547] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x145400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSASCui.exe", cAlternateFileName="")) returned 1
	[0197.547] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289d66, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe289d66, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe289d66, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsMpCom.dll", cAlternateFileName="")) returned 1
	[0197.547] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289d66, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe289d66, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe289d66, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x6120, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsMpEng.exe", cAlternateFileName="")) returned 1
	[0197.547] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289d66, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe289d66, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe289d66, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsMpLics.dll", cAlternateFileName="")) returned 1
	[0197.547] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2affc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2affc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2affc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x6a800, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsMpRes.dll", cAlternateFileName="")) returned 1
	[0197.547] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2affc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2affc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2affc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x18a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="NisIpsPlugin.dll", cAlternateFileName="")) returned 1
	[0197.547] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2affc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2affc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2affc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NisLog.dll", cAlternateFileName="")) returned 1
	[0197.547] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2affc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2affc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2affc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x58fb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NisSrv.exe", cAlternateFileName="")) returned 1
	[0197.547] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2affc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2affc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2affc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10200, dwReserved0=0x0, dwReserved1=0x0, cFileName="NisWfp.dll", cAlternateFileName="")) returned 1
	[0197.547] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10e83ef0, ftCreationTime.dwHighDateTime=0x1d7c368, ftLastAccessTime.dwLowDateTime=0x9c3c9790, ftLastAccessTime.dwHighDateTime=0x1d7dfaa, ftLastWriteTime.dwLowDateTime=0x9c3c9790, ftLastWriteTime.dwHighDateTime=0x1d7dfaa, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="omnipos.exe", cAlternateFileName="")) returned 1
	[0197.547] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x91600, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProtectionManagement.dll", cAlternateFileName="")) returned 1
	[0197.547] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xda54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProtectionManagement.mof", cAlternateFileName="")) returned 1
	[0197.547] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProtectionManagement_Uninstall.mof", cAlternateFileName="")) returned 1
	[0197.548] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2affc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2affc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x51c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="shellext.dll", cAlternateFileName="")) returned 1
	[0197.548] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2affc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2affc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2affc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x264c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SymSrv.dll", cAlternateFileName="")) returned 1
	[0197.548] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2affc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2affc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2affc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="SymSrv.yes", cAlternateFileName="")) returned 1
	[0197.548] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.548] FindClose (in: hFindFile=0x79fba8 | out: hFindFile=0x79fba8) returned 1
	[0197.548] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\AMMonitoringProvider.dll" (normalized: "c:\\program files\\windows defender\\ammonitoringprovider.dll"), fInfoLevelId=0x0, lpFileInformation=0x127ba6e8 | out: lpFileInformation=0x127ba6e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2f200)) returned 1
	[0197.548] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\AmMonitoringInstall.mof" (normalized: "c:\\program files\\windows defender\\ammonitoringinstall.mof"), fInfoLevelId=0x0, lpFileInformation=0x127ba738 | out: lpFileInformation=0x127ba738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x24b6)) returned 1
	[0197.549] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\AmStatusInstall.mof" (normalized: "c:\\program files\\windows defender\\amstatusinstall.mof"), fInfoLevelId=0x0, lpFileInformation=0x127ba788 | out: lpFileInformation=0x127ba788*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x520c)) returned 1
	[0197.549] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\ClientWMIInstall.mof" (normalized: "c:\\program files\\windows defender\\clientwmiinstall.mof"), fInfoLevelId=0x0, lpFileInformation=0x127ba7d8 | out: lpFileInformation=0x127ba7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x99c)) returned 1
	[0197.549] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\ConfigSecurityPolicy.exe" (normalized: "c:\\program files\\windows defender\\configsecuritypolicy.exe"), fInfoLevelId=0x0, lpFileInformation=0x127ba828 | out: lpFileInformation=0x127ba828*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4f000)) returned 1
	[0197.549] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\DataLayer.dll" (normalized: "c:\\program files\\windows defender\\datalayer.dll"), fInfoLevelId=0x0, lpFileInformation=0x127ba878 | out: lpFileInformation=0x127ba878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x68400)) returned 1
	[0197.550] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\DbgHelp.dll" (normalized: "c:\\program files\\windows defender\\dbghelp.dll"), fInfoLevelId=0x0, lpFileInformation=0x127ba8c8 | out: lpFileInformation=0x127ba8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2affc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2affc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2affc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x171cc0)) returned 1
	[0197.650] SetEvent (hEvent=0x168) returned 1
	[0197.650] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\DefenderCSP.dll" (normalized: "c:\\program files\\windows defender\\defendercsp.dll"), fInfoLevelId=0x0, lpFileInformation=0x127ba918 | out: lpFileInformation=0x127ba918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2fc46e, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2fc46e, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2fc46e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12200)) returned 1
	[0197.650] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\EppManifest.dll" (normalized: "c:\\program files\\windows defender\\eppmanifest.dll"), fInfoLevelId=0x0, lpFileInformation=0x127ba968 | out: lpFileInformation=0x127ba968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2affc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2affc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2affc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x42000)) returned 1
	[0197.650] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\FepUnregister.mof" (normalized: "c:\\program files\\windows defender\\fepunregister.mof"), fInfoLevelId=0x0, lpFileInformation=0x127ba9b8 | out: lpFileInformation=0x127ba9b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x169)) returned 1
	[0197.651] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\MSASCui.exe" (normalized: "c:\\program files\\windows defender\\msascui.exe"), fInfoLevelId=0x0, lpFileInformation=0x127baa08 | out: lpFileInformation=0x127baa08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x145400)) returned 1
	[0197.651] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\MpAsDesc.dll" (normalized: "c:\\program files\\windows defender\\mpasdesc.dll"), fInfoLevelId=0x0, lpFileInformation=0x127baa58 | out: lpFileInformation=0x127baa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289d66, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe289d66, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe289d66, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x19e00)) returned 1
	[0197.651] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\MpClient.dll" (normalized: "c:\\program files\\windows defender\\mpclient.dll"), fInfoLevelId=0x0, lpFileInformation=0x127baaa8 | out: lpFileInformation=0x127baaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289d66, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe289d66, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe289d66, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xdb000)) returned 1
	[0197.651] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\MpCmdRun.exe" (normalized: "c:\\program files\\windows defender\\mpcmdrun.exe"), fInfoLevelId=0x0, lpFileInformation=0x127baaf8 | out: lpFileInformation=0x127baaf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289d66, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe289d66, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe289d66, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x5a660)) returned 1
	[0197.651] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\MpCommu.dll" (normalized: "c:\\program files\\windows defender\\mpcommu.dll"), fInfoLevelId=0x0, lpFileInformation=0x127bab48 | out: lpFileInformation=0x127bab48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289d66, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe289d66, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe289d66, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x52a00)) returned 1
	[0197.654] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\MpEvMsg.dll" (normalized: "c:\\program files\\windows defender\\mpevmsg.dll"), fInfoLevelId=0x0, lpFileInformation=0x127bab98 | out: lpFileInformation=0x127bab98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289d66, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe289d66, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2affc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1a200)) returned 1
	[0197.655] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\MpOAV.dll" (normalized: "c:\\program files\\windows defender\\mpoav.dll"), fInfoLevelId=0x0, lpFileInformation=0x127babe8 | out: lpFileInformation=0x127babe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289d66, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe289d66, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe289d66, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x18e00)) returned 1
	[0197.655] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\MpProvider.dll" (normalized: "c:\\program files\\windows defender\\mpprovider.dll"), fInfoLevelId=0x0, lpFileInformation=0x127bac38 | out: lpFileInformation=0x127bac38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c600)) returned 1
	[0197.655] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\MpRtp.dll" (normalized: "c:\\program files\\windows defender\\mprtp.dll"), fInfoLevelId=0x0, lpFileInformation=0x127bac88 | out: lpFileInformation=0x127bac88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289d66, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe289d66, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe289d66, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x89800)) returned 1
	[0197.660] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\MpSvc.dll" (normalized: "c:\\program files\\windows defender\\mpsvc.dll"), fInfoLevelId=0x0, lpFileInformation=0x127bacd8 | out: lpFileInformation=0x127bacd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289d66, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe289d66, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe289d66, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1c2400)) returned 1
	[0197.667] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\MpTpmAtt.dll" (normalized: "c:\\program files\\windows defender\\mptpmatt.dll"), fInfoLevelId=0x0, lpFileInformation=0x127bad28 | out: lpFileInformation=0x127bad28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289d66, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe289d66, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe289d66, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb600)) returned 1
	[0197.667] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\MpUXSrv.exe" (normalized: "c:\\program files\\windows defender\\mpuxsrv.exe"), fInfoLevelId=0x0, lpFileInformation=0x127bad78 | out: lpFileInformation=0x127bad78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2affc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2affc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2affc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xdd60)) returned 1
	[0197.668] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\MsMpCom.dll" (normalized: "c:\\program files\\windows defender\\msmpcom.dll"), fInfoLevelId=0x0, lpFileInformation=0x127badc8 | out: lpFileInformation=0x127badc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289d66, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe289d66, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe289d66, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12600)) returned 1
	[0197.668] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\MsMpEng.exe" (normalized: "c:\\program files\\windows defender\\msmpeng.exe"), fInfoLevelId=0x0, lpFileInformation=0x127bae18 | out: lpFileInformation=0x127bae18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289d66, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe289d66, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe289d66, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x6120)) returned 1
	[0197.668] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\MsMpLics.dll" (normalized: "c:\\program files\\windows defender\\msmplics.dll"), fInfoLevelId=0x0, lpFileInformation=0x127bae68 | out: lpFileInformation=0x127bae68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289d66, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe289d66, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe289d66, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1400)) returned 1
	[0197.668] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\MsMpRes.dll" (normalized: "c:\\program files\\windows defender\\msmpres.dll"), fInfoLevelId=0x0, lpFileInformation=0x127baeb8 | out: lpFileInformation=0x127baeb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2affc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2affc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2affc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x6a800)) returned 1
	[0197.680] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\NisIpsPlugin.dll" (normalized: "c:\\program files\\windows defender\\nisipsplugin.dll"), fInfoLevelId=0x0, lpFileInformation=0x127baf08 | out: lpFileInformation=0x127baf08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2affc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2affc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2affc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x18a00)) returned 1
	[0197.680] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\NisLog.dll" (normalized: "c:\\program files\\windows defender\\nislog.dll"), fInfoLevelId=0x0, lpFileInformation=0x127baf58 | out: lpFileInformation=0x127baf58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2affc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2affc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2affc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd000)) returned 1
	[0197.680] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\NisSrv.exe" (normalized: "c:\\program files\\windows defender\\nissrv.exe"), fInfoLevelId=0x0, lpFileInformation=0x127bafa8 | out: lpFileInformation=0x127bafa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2affc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2affc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2affc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x58fb0)) returned 1
	[0197.681] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\NisWfp.dll" (normalized: "c:\\program files\\windows defender\\niswfp.dll"), fInfoLevelId=0x0, lpFileInformation=0x127baff8 | out: lpFileInformation=0x127baff8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2affc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2affc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2affc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10200)) returned 1
	[0197.682] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\ProtectionManagement.dll" (normalized: "c:\\program files\\windows defender\\protectionmanagement.dll"), fInfoLevelId=0x0, lpFileInformation=0x127bb048 | out: lpFileInformation=0x127bb048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x91600)) returned 1
	[0197.688] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\ProtectionManagement.mof" (normalized: "c:\\program files\\windows defender\\protectionmanagement.mof"), fInfoLevelId=0x0, lpFileInformation=0x127bb098 | out: lpFileInformation=0x127bb098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xda54)) returned 1
	[0197.688] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\ProtectionManagement_Uninstall.mof" (normalized: "c:\\program files\\windows defender\\protectionmanagement_uninstall.mof"), fInfoLevelId=0x0, lpFileInformation=0x127bb0e8 | out: lpFileInformation=0x127bb0e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9aa)) returned 1
	[0197.688] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\SymSrv.dll" (normalized: "c:\\program files\\windows defender\\symsrv.dll"), fInfoLevelId=0x0, lpFileInformation=0x127bb138 | out: lpFileInformation=0x127bb138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2affc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2affc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2affc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x264c0)) returned 1
	[0197.688] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\SymSrv.yes" (normalized: "c:\\program files\\windows defender\\symsrv.yes"), fInfoLevelId=0x0, lpFileInformation=0x127bb188 | out: lpFileInformation=0x127bb188*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2affc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2affc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2affc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1)) returned 1
	[0197.688] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\en-US" (normalized: "c:\\program files\\windows defender\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x127bb1d8 | out: lpFileInformation=0x127bb1d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2081c9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd2081c9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd2081c9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.689] CreateFileW (lpFileName="C:\\Program Files\\Windows Defender\\en-US" (normalized: "c:\\program files\\windows defender\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.689] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Defender\\en-US\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2081c9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd2081c9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd2081c9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9e8
	[0197.694] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2081c9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd2081c9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd2081c9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.694] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa725a929, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa725a929, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa725a929, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="EppManifest.dll.mui", cAlternateFileName="")) returned 1
	[0197.694] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa725a929, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa725a929, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa725a929, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xae00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAsDesc.dll.mui", cAlternateFileName="")) returned 1
	[0197.694] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa725a929, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa725a929, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa725a929, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpEvMsg.dll.mui", cAlternateFileName="")) returned 1
	[0197.694] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa725a929, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa725a929, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa725a929, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x14800, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsMpRes.dll.mui", cAlternateFileName="")) returned 1
	[0197.694] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa725a929, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa725a929, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa725a929, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProtectionManagement.dll.mui", cAlternateFileName="")) returned 1
	[0197.694] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa725a929, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa725a929, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa725a929, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProtectionManagement.mfl", cAlternateFileName="")) returned 1
	[0197.694] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa725a929, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa725a929, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa725a929, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x3a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProtectionManagement_Uninstall.mfl", cAlternateFileName="")) returned 1
	[0197.695] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa725a929, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa725a929, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa725a929, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="shellext.dll.mui", cAlternateFileName="")) returned 1
	[0197.695] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.695] FindClose (in: hFindFile=0x79f9e8 | out: hFindFile=0x79f9e8) returned 1
	[0197.696] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\en-US\\EppManifest.dll.mui" (normalized: "c:\\program files\\windows defender\\en-us\\eppmanifest.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x127bb4a8 | out: lpFileInformation=0x127bb4a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa725a929, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa725a929, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa725a929, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xc00)) returned 1
	[0197.697] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui" (normalized: "c:\\program files\\windows defender\\en-us\\mpasdesc.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x127bb4f8 | out: lpFileInformation=0x127bb4f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa725a929, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa725a929, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa725a929, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xae00)) returned 1
	[0197.700] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui" (normalized: "c:\\program files\\windows defender\\en-us\\mpevmsg.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x127bb548 | out: lpFileInformation=0x127bb548*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa725a929, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa725a929, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa725a929, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x8000)) returned 1
	[0197.700] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui" (normalized: "c:\\program files\\windows defender\\en-us\\msmpres.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x127bb598 | out: lpFileInformation=0x127bb598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa725a929, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa725a929, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa725a929, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x14800)) returned 1
	[0197.700] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\en-US\\ProtectionManagement.dll.mui" (normalized: "c:\\program files\\windows defender\\en-us\\protectionmanagement.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x127bb5e8 | out: lpFileInformation=0x127bb5e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa725a929, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa725a929, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa725a929, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x8000)) returned 1
	[0197.701] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\en-US\\ProtectionManagement.mfl" (normalized: "c:\\program files\\windows defender\\en-us\\protectionmanagement.mfl"), fInfoLevelId=0x0, lpFileInformation=0x127bb638 | out: lpFileInformation=0x127bb638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa725a929, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa725a929, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa725a929, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x135c0)) returned 1
	[0197.701] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\en-US\\ProtectionManagement_Uninstall.mfl" (normalized: "c:\\program files\\windows defender\\en-us\\protectionmanagement_uninstall.mfl"), fInfoLevelId=0x0, lpFileInformation=0x127bb688 | out: lpFileInformation=0x127bb688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa725a929, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa725a929, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa725a929, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x3a2)) returned 1
	[0197.701] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\en-US\\shellext.dll.mui" (normalized: "c:\\program files\\windows defender\\en-us\\shellext.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x127bb6d8 | out: lpFileInformation=0x127bb6d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa725a929, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa725a929, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa725a929, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00)) returned 1
	[0197.701] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\far.exe" (normalized: "c:\\program files\\windows defender\\far.exe"), fInfoLevelId=0x0, lpFileInformation=0x127bb728 | out: lpFileInformation=0x127bb728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11af3b60, ftCreationTime.dwHighDateTime=0x1d7d2b1, ftLastAccessTime.dwLowDateTime=0x17eb29b0, ftLastAccessTime.dwHighDateTime=0x1d7e5c3, ftLastWriteTime.dwLowDateTime=0x17eb29b0, ftLastWriteTime.dwHighDateTime=0x1d7e5c3, nFileSizeHigh=0x0, nFileSizeLow=0x13a00)) returned 1
	[0197.701] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\four.exe" (normalized: "c:\\program files\\windows defender\\four.exe"), fInfoLevelId=0x0, lpFileInformation=0x127bb778 | out: lpFileInformation=0x127bb778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b73f6f0, ftCreationTime.dwHighDateTime=0x1d7c1ef, ftLastAccessTime.dwLowDateTime=0x1fb8b8a0, ftLastAccessTime.dwHighDateTime=0x1d80f8b, ftLastWriteTime.dwLowDateTime=0x1fb8b8a0, ftLastWriteTime.dwHighDateTime=0x1d80f8b, nFileSizeHigh=0x0, nFileSizeLow=0x13a00)) returned 1
	[0197.702] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\mpuxhostproxy.dll" (normalized: "c:\\program files\\windows defender\\mpuxhostproxy.dll"), fInfoLevelId=0x0, lpFileInformation=0x127bb7c8 | out: lpFileInformation=0x127bb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2affc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2affc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2affc5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3200)) returned 1
	[0197.703] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\omnipos.exe" (normalized: "c:\\program files\\windows defender\\omnipos.exe"), fInfoLevelId=0x0, lpFileInformation=0x127bb818 | out: lpFileInformation=0x127bb818*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10e83ef0, ftCreationTime.dwHighDateTime=0x1d7c368, ftLastAccessTime.dwLowDateTime=0x9c3c9790, ftLastAccessTime.dwHighDateTime=0x1d7dfaa, ftLastWriteTime.dwLowDateTime=0x9c3c9790, ftLastWriteTime.dwHighDateTime=0x1d7dfaa, nFileSizeHigh=0x0, nFileSizeLow=0x13a00)) returned 1
	[0197.703] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Defender\\shellext.dll" (normalized: "c:\\program files\\windows defender\\shellext.dll"), fInfoLevelId=0x0, lpFileInformation=0x127bb868 | out: lpFileInformation=0x127bb868*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2affc5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2affc5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x51c00)) returned 1
	[0197.703] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Journal" (normalized: "c:\\program files\\windows journal"), fInfoLevelId=0x0, lpFileInformation=0x127bb8b8 | out: lpFileInformation=0x127bb8b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ebef3a1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xf7dbc21f, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf7dbc21f, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0197.703] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal" (normalized: "c:\\program files\\windows journal"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.703] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ebef3a1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xf7dbc21f, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf7dbc21f, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fa28
	[0197.704] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ebef3a1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xf7dbc21f, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf7dbc21f, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.704] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec155f1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ec3b857, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec3b857, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0197.704] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d07dc60, ftCreationTime.dwHighDateTime=0x1d7dcfc, ftLastAccessTime.dwLowDateTime=0x3bae640, ftLastAccessTime.dwHighDateTime=0x1d819cd, ftLastWriteTime.dwLowDateTime=0x3bae640, ftLastWriteTime.dwHighDateTime=0x1d819cd, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="fling.exe", cAlternateFileName="")) returned 1
	[0197.704] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6771ac06, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x677670bc, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xdda00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkSeg.dll", cAlternateFileName="")) returned 1
	[0197.704] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585b5cfd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6760fb5b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x676822a6, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x13d600, dwReserved0=0x0, dwReserved1=0x0, cFileName="JNTFiltr.dll", cAlternateFileName="")) returned 1
	[0197.704] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x636e0a69, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x637531d6, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x141400, dwReserved0=0x0, dwReserved1=0x0, cFileName="JNWDRV.dll", cAlternateFileName="")) returned 1
	[0197.704] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6369463d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x636ba8bb, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x25800, dwReserved0=0x0, dwReserved1=0x0, cFileName="jnwdui.dll", cAlternateFileName="")) returned 1
	[0197.704] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x637531d6, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x637531d6, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x0, cFileName="jnwmon.dll", cAlternateFileName="")) returned 1
	[0197.704] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x637531d6, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x637531d6, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="jnwppr.dll", cAlternateFileName="")) returned 1
	[0197.704] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5858faa2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x674de9a9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6759d49c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x20b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Journal.exe", cAlternateFileName="")) returned 1
	[0197.704] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5856984c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x67387305, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x673ad592, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPVWCTL.DLL", cAlternateFileName="")) returned 1
	[0197.704] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585b5cfd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x676822a6, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6771ac06, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x193600, dwReserved0=0x0, dwReserved1=0x0, cFileName="NBDoc.DLL", cAlternateFileName="")) returned 1
	[0197.704] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5856984c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x673f9afd, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x673f9afd, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xee00, dwReserved0=0x0, dwReserved1=0x0, cFileName="NBMapTIP.dll", cAlternateFileName="")) returned 1
	[0197.704] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x63779482, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x63779482, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xcc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIALOG.exe", cAlternateFileName="")) returned 1
	[0197.704] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6427e3a0, ftCreationTime.dwHighDateTime=0x1d7ad00, ftLastAccessTime.dwLowDateTime=0x38129760, ftLastAccessTime.dwHighDateTime=0x1d7de88, ftLastWriteTime.dwLowDateTime=0x38129760, ftLastWriteTime.dwHighDateTime=0x1d7de88, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="response_miss.exe", cAlternateFileName="RESPON~1.EXE")) returned 1
	[0197.704] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec3b857, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ec3b857, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec3b857, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1
	[0197.704] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.705] FindClose (in: hFindFile=0x79fa28 | out: hFindFile=0x79fa28) returned 1
	[0197.705] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Journal\\InkSeg.dll" (normalized: "c:\\program files\\windows journal\\inkseg.dll"), fInfoLevelId=0x0, lpFileInformation=0x127bbdb8 | out: lpFileInformation=0x127bbdb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6771ac06, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x677670bc, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xdda00)) returned 1
	[0197.708] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Journal\\JNTFiltr.dll" (normalized: "c:\\program files\\windows journal\\jntfiltr.dll"), fInfoLevelId=0x0, lpFileInformation=0x127bbe58 | out: lpFileInformation=0x127bbe58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585b5cfd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6760fb5b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x676822a6, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x13d600)) returned 1
	[0197.709] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Journal\\JNWDRV.dll" (normalized: "c:\\program files\\windows journal\\jnwdrv.dll"), fInfoLevelId=0x0, lpFileInformation=0x127bbef8 | out: lpFileInformation=0x127bbef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x636e0a69, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x637531d6, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x141400)) returned 1
	[0197.710] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Journal\\Journal.exe" (normalized: "c:\\program files\\windows journal\\journal.exe"), fInfoLevelId=0x0, lpFileInformation=0x127bbf98 | out: lpFileInformation=0x127bbf98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5858faa2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x674de9a9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6759d49c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x20b000)) returned 1
	[0197.710] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Journal\\MSPVWCTL.DLL" (normalized: "c:\\program files\\windows journal\\mspvwctl.dll"), fInfoLevelId=0x0, lpFileInformation=0x127fc0f8 | out: lpFileInformation=0x127fc0f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5856984c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x67387305, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x673ad592, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa1200)) returned 1
	[0197.710] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Journal\\NBDoc.DLL" (normalized: "c:\\program files\\windows journal\\nbdoc.dll"), fInfoLevelId=0x0, lpFileInformation=0x127fc148 | out: lpFileInformation=0x127fc148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585b5cfd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x676822a6, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6771ac06, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x193600)) returned 1
	[0197.710] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Journal\\NBMapTIP.dll" (normalized: "c:\\program files\\windows journal\\nbmaptip.dll"), fInfoLevelId=0x0, lpFileInformation=0x127fc198 | out: lpFileInformation=0x127fc198*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5856984c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x673f9afd, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x673f9afd, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xee00)) returned 1
	[0197.711] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Journal\\PDIALOG.exe" (normalized: "c:\\program files\\windows journal\\pdialog.exe"), fInfoLevelId=0x0, lpFileInformation=0x127fc1e8 | out: lpFileInformation=0x127fc1e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x63779482, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x63779482, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xcc00)) returned 1
	[0197.713] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates" (normalized: "c:\\program files\\windows journal\\templates"), fInfoLevelId=0x0, lpFileInformation=0x127fc238 | out: lpFileInformation=0x127fc238*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec3b857, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ec3b857, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec3b857, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.714] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates" (normalized: "c:\\program files\\windows journal\\templates"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.714] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec3b857, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ec3b857, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec3b857, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fea8
	[0197.720] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec3b857, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ec3b857, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec3b857, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.720] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5858faa2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x674b8718, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x674b8718, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x155e, dwReserved0=0x0, dwReserved1=0x0, cFileName="blank.jtp", cAlternateFileName="")) returned 1
	[0197.720] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585b5cfd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x675e9965, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x675e9965, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2ce6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dotted_Line.jtp", cAlternateFileName="")) returned 1
	[0197.720] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5858faa2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x67445fa7, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x67445fa7, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x361c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_1.jtp", cAlternateFileName="")) returned 1
	[0197.720] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5858faa2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x67445fa7, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x67445fa7, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x4c8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_2.jtp", cAlternateFileName="")) returned 1
	[0197.720] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5858faa2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6759d49c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6759d49c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1e15c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Graph.jtp", cAlternateFileName="")) returned 1
	[0197.720] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6778d31e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6778d31e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x26f6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memo.jtp", cAlternateFileName="")) returned 1
	[0197.720] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6771ac06, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6771ac06, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x275c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Month_Calendar.jtp", cAlternateFileName="")) returned 1
	[0197.720] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5856984c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x673d37bf, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x673d37bf, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music.jtp", cAlternateFileName="")) returned 1
	[0197.720] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585b5cfd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x675c36e7, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x675c36e7, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa95a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Seyes.jtp", cAlternateFileName="")) returned 1
	[0197.720] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5858faa2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x674923a8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x674923a8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1575a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shorthand.jtp", cAlternateFileName="")) returned 1
	[0197.720] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585b5cfd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x675c36e7, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x675c36e7, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x7f5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="To_Do_List.jtp", cAlternateFileName="")) returned 1
	[0197.720] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.720] FindClose (in: hFindFile=0x79fea8 | out: hFindFile=0x79fea8) returned 1
	[0197.721] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp" (normalized: "c:\\program files\\windows journal\\templates\\dotted_line.jtp"), fInfoLevelId=0x0, lpFileInformation=0x127fc5f8 | out: lpFileInformation=0x127fc5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585b5cfd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x675e9965, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x675e9965, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2ce6)) returned 1
	[0197.727] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_1.jtp" (normalized: "c:\\program files\\windows journal\\templates\\genko_1.jtp"), fInfoLevelId=0x0, lpFileInformation=0x127fc648 | out: lpFileInformation=0x127fc648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5858faa2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x67445fa7, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x67445fa7, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x361c)) returned 1
	[0197.728] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp" (normalized: "c:\\program files\\windows journal\\templates\\genko_2.jtp"), fInfoLevelId=0x0, lpFileInformation=0x127fc698 | out: lpFileInformation=0x127fc698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5858faa2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x67445fa7, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x67445fa7, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x4c8c)) returned 1
	[0197.728] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Graph.jtp" (normalized: "c:\\program files\\windows journal\\templates\\graph.jtp"), fInfoLevelId=0x0, lpFileInformation=0x127fc6e8 | out: lpFileInformation=0x127fc6e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5858faa2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6759d49c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6759d49c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1e15c)) returned 1
	[0197.729] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Memo.jtp" (normalized: "c:\\program files\\windows journal\\templates\\memo.jtp"), fInfoLevelId=0x0, lpFileInformation=0x127fc738 | out: lpFileInformation=0x127fc738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6778d31e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6778d31e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x26f6e)) returned 1
	[0197.729] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Month_Calendar.jtp" (normalized: "c:\\program files\\windows journal\\templates\\month_calendar.jtp"), fInfoLevelId=0x0, lpFileInformation=0x127fc788 | out: lpFileInformation=0x127fc788*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6771ac06, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6771ac06, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x275c)) returned 1
	[0197.729] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Music.jtp" (normalized: "c:\\program files\\windows journal\\templates\\music.jtp"), fInfoLevelId=0x0, lpFileInformation=0x127fc7d8 | out: lpFileInformation=0x127fc7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5856984c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x673d37bf, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x673d37bf, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9f58)) returned 1
	[0197.732] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Seyes.jtp" (normalized: "c:\\program files\\windows journal\\templates\\seyes.jtp"), fInfoLevelId=0x0, lpFileInformation=0x127fc828 | out: lpFileInformation=0x127fc828*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585b5cfd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x675c36e7, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x675c36e7, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa95a)) returned 1
	[0197.732] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Shorthand.jtp" (normalized: "c:\\program files\\windows journal\\templates\\shorthand.jtp"), fInfoLevelId=0x0, lpFileInformation=0x127fc878 | out: lpFileInformation=0x127fc878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5858faa2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x674923a8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x674923a8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1575a)) returned 1
	[0197.732] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp" (normalized: "c:\\program files\\windows journal\\templates\\to_do_list.jtp"), fInfoLevelId=0x0, lpFileInformation=0x127fc8c8 | out: lpFileInformation=0x127fc8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585b5cfd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x675c36e7, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x675c36e7, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x7f5a)) returned 1
	[0197.732] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\blank.jtp" (normalized: "c:\\program files\\windows journal\\templates\\blank.jtp"), fInfoLevelId=0x0, lpFileInformation=0x127fc918 | out: lpFileInformation=0x127fc918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5858faa2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x674b8718, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x674b8718, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x155e)) returned 1
	[0197.732] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US" (normalized: "c:\\program files\\windows journal\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x127fc968 | out: lpFileInformation=0x127fc968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec155f1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ec3b857, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec3b857, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.732] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\en-US" (normalized: "c:\\program files\\windows journal\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.733] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec155f1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ec3b857, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec3b857, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fda8
	[0197.749] SetEvent (hEvent=0x168) returned 1
	[0197.749] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec155f1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ec3b857, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec3b857, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.749] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="JNTFiltr.dll.mui", cAlternateFileName="")) returned 1
	[0197.749] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="jnwdui.dll.mui", cAlternateFileName="")) returned 1
	[0197.749] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="jnwmon.dll.mui", cAlternateFileName="")) returned 1
	[0197.749] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x15400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Journal.exe.mui", cAlternateFileName="")) returned 1
	[0197.749] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPVWCTL.DLL.mui", cAlternateFileName="")) returned 1
	[0197.749] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="NBMapTIP.dll.mui", cAlternateFileName="")) returned 1
	[0197.749] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIALOG.exe.mui", cAlternateFileName="")) returned 1
	[0197.749] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.749] FindClose (in: hFindFile=0x79fda8 | out: hFindFile=0x79fda8) returned 1
	[0197.750] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui" (normalized: "c:\\program files\\windows journal\\en-us\\jntfiltr.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x127fcbe8 | out: lpFileInformation=0x127fcbe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xc00)) returned 1
	[0197.751] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui" (normalized: "c:\\program files\\windows journal\\en-us\\journal.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x127fcc38 | out: lpFileInformation=0x127fcc38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x15400)) returned 1
	[0197.754] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\MSPVWCTL.DLL.mui" (normalized: "c:\\program files\\windows journal\\en-us\\mspvwctl.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x127fcc88 | out: lpFileInformation=0x127fcc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e00)) returned 1
	[0197.754] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\NBMapTIP.dll.mui" (normalized: "c:\\program files\\windows journal\\en-us\\nbmaptip.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x127fccd8 | out: lpFileInformation=0x127fccd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00)) returned 1
	[0197.754] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\PDIALOG.exe.mui" (normalized: "c:\\program files\\windows journal\\en-us\\pdialog.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x127fcd28 | out: lpFileInformation=0x127fcd28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00)) returned 1
	[0197.754] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui" (normalized: "c:\\program files\\windows journal\\en-us\\jnwdui.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x127fcd78 | out: lpFileInformation=0x127fcd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a00)) returned 1
	[0197.755] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\jnwmon.dll.mui" (normalized: "c:\\program files\\windows journal\\en-us\\jnwmon.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x127fcdc8 | out: lpFileInformation=0x127fcdc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52047e2, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa52047e2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa52047e2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00)) returned 1
	[0197.755] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Journal\\fling.exe" (normalized: "c:\\program files\\windows journal\\fling.exe"), fInfoLevelId=0x0, lpFileInformation=0x127fce18 | out: lpFileInformation=0x127fce18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d07dc60, ftCreationTime.dwHighDateTime=0x1d7dcfc, ftLastAccessTime.dwLowDateTime=0x3bae640, ftLastAccessTime.dwHighDateTime=0x1d819cd, ftLastWriteTime.dwLowDateTime=0x3bae640, ftLastWriteTime.dwHighDateTime=0x1d819cd, nFileSizeHigh=0x0, nFileSizeLow=0x13a00)) returned 1
	[0197.755] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Journal\\jnwdui.dll" (normalized: "c:\\program files\\windows journal\\jnwdui.dll"), fInfoLevelId=0x0, lpFileInformation=0x127fce68 | out: lpFileInformation=0x127fce68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6369463d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x636ba8bb, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x25800)) returned 1
	[0197.755] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Journal\\jnwmon.dll" (normalized: "c:\\program files\\windows journal\\jnwmon.dll"), fInfoLevelId=0x0, lpFileInformation=0x127fceb8 | out: lpFileInformation=0x127fceb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x637531d6, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x637531d6, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x6800)) returned 1
	[0197.755] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Journal\\jnwppr.dll" (normalized: "c:\\program files\\windows journal\\jnwppr.dll"), fInfoLevelId=0x0, lpFileInformation=0x127fcf08 | out: lpFileInformation=0x127fcf08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585dbf53, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x637531d6, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x637531d6, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x6c00)) returned 1
	[0197.755] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Journal\\response_miss.exe" (normalized: "c:\\program files\\windows journal\\response_miss.exe"), fInfoLevelId=0x0, lpFileInformation=0x127fcf58 | out: lpFileInformation=0x127fcf58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6427e3a0, ftCreationTime.dwHighDateTime=0x1d7ad00, ftLastAccessTime.dwLowDateTime=0x38129760, ftLastAccessTime.dwHighDateTime=0x1d7de88, ftLastWriteTime.dwLowDateTime=0x38129760, ftLastWriteTime.dwHighDateTime=0x1d7de88, nFileSizeHigh=0x0, nFileSizeLow=0x13a00)) returned 1
	[0197.756] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Mail" (normalized: "c:\\program files\\windows mail"), fInfoLevelId=0x0, lpFileInformation=0x127fcfa8 | out: lpFileInformation=0x127fcfa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf6dbd7c8, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf6dbd7c8, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0197.756] CreateFileW (lpFileName="C:\\Program Files\\Windows Mail" (normalized: "c:\\program files\\windows mail"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.756] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Mail\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf6dbd7c8, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf6dbd7c8, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fce8
	[0197.756] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf6dbd7c8, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf6dbd7c8, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.756] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67b08d0, ftCreationTime.dwHighDateTime=0x1d7b260, ftLastAccessTime.dwLowDateTime=0x1356250, ftLastAccessTime.dwHighDateTime=0x1d7f57a, ftLastWriteTime.dwLowDateTime=0x1356250, ftLastWriteTime.dwHighDateTime=0x1d7f57a, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="education.exe", cAlternateFileName="EDUCAT~1.EXE")) returned 1
	[0197.756] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd22e3e9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd22e3e9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd22e3e9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0197.756] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f2a2de2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f2a2de2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f2ef297, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x21ac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoe.dll", cAlternateFileName="")) returned 1
	[0197.756] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3154ed, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f3154ed, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f3154ed, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x25f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOERES.dll", cAlternateFileName="")) returned 1
	[0197.756] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3154ed, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f3154ed, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f3154ed, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10800, dwReserved0=0x0, dwReserved1=0x0, cFileName="oeimport.dll", cAlternateFileName="")) returned 1
	[0197.756] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1944f082, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1944f082, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1944f082, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x7e600, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab.exe", cAlternateFileName="")) returned 1
	[0197.756] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x194e79e8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x194e79e8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x194e79e8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x0, cFileName="wabimp.dll", cAlternateFileName="")) returned 1
	[0197.756] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1944f082, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1944f082, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1944f082, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wabmig.exe", cAlternateFileName="")) returned 1
	[0197.756] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4f33b748, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f33b748, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f33b748, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x65a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe", cAlternateFileName="")) returned 1
	[0197.756] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.756] FindClose (in: hFindFile=0x79fce8 | out: hFindFile=0x79fce8) returned 1
	[0197.757] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Mail\\MSOERES.dll" (normalized: "c:\\program files\\windows mail\\msoeres.dll"), fInfoLevelId=0x0, lpFileInformation=0x127fd318 | out: lpFileInformation=0x127fd318*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3154ed, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f3154ed, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f3154ed, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x25f600)) returned 1
	[0197.759] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Mail\\WinMail.exe" (normalized: "c:\\program files\\windows mail\\winmail.exe"), fInfoLevelId=0x0, lpFileInformation=0x127fd368 | out: lpFileInformation=0x127fd368*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4f33b748, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f33b748, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f33b748, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x65a00)) returned 1
	[0197.759] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Mail\\education.exe" (normalized: "c:\\program files\\windows mail\\education.exe"), fInfoLevelId=0x0, lpFileInformation=0x127fd3b8 | out: lpFileInformation=0x127fd3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67b08d0, ftCreationTime.dwHighDateTime=0x1d7b260, ftLastAccessTime.dwLowDateTime=0x1356250, ftLastAccessTime.dwHighDateTime=0x1d7f57a, ftLastWriteTime.dwLowDateTime=0x1356250, ftLastWriteTime.dwHighDateTime=0x1d7f57a, nFileSizeHigh=0x0, nFileSizeLow=0x13a00)) returned 1
	[0197.759] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Mail\\en-US" (normalized: "c:\\program files\\windows mail\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x127fd408 | out: lpFileInformation=0x127fd408*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd22e3e9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd22e3e9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd22e3e9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.759] CreateFileW (lpFileName="C:\\Program Files\\Windows Mail\\en-US" (normalized: "c:\\program files\\windows mail\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.759] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Mail\\en-US\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd22e3e9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd22e3e9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd22e3e9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffa8
	[0197.759] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd22e3e9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd22e3e9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd22e3e9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.760] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9db8cc30, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9db8cc30, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9db8cc30, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x7a200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoeres.dll.mui", cAlternateFileName="")) returned 1
	[0197.760] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dbb2e90, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9dbb2e90, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9dbb2e90, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe.mui", cAlternateFileName="")) returned 1
	[0197.760] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.760] FindClose (in: hFindFile=0x79ffa8 | out: hFindFile=0x79ffa8) returned 1
	[0197.760] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Mail\\en-US\\WinMail.exe.mui" (normalized: "c:\\program files\\windows mail\\en-us\\winmail.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x127fd4f8 | out: lpFileInformation=0x127fd4f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dbb2e90, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9dbb2e90, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9dbb2e90, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a00)) returned 1
	[0197.761] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui" (normalized: "c:\\program files\\windows mail\\en-us\\msoeres.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x127fd548 | out: lpFileInformation=0x127fd548*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9db8cc30, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0x9db8cc30, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x9db8cc30, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x7a200)) returned 1
	[0197.851] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Mail\\msoe.dll" (normalized: "c:\\program files\\windows mail\\msoe.dll"), fInfoLevelId=0x0, lpFileInformation=0x127fd598 | out: lpFileInformation=0x127fd598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f2a2de2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f2a2de2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f2ef297, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x21ac00)) returned 1
	[0197.851] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Mail\\oeimport.dll" (normalized: "c:\\program files\\windows mail\\oeimport.dll"), fInfoLevelId=0x0, lpFileInformation=0x127fd5e8 | out: lpFileInformation=0x127fd5e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3154ed, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f3154ed, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f3154ed, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10800)) returned 1
	[0197.851] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Mail\\wab.exe" (normalized: "c:\\program files\\windows mail\\wab.exe"), fInfoLevelId=0x0, lpFileInformation=0x127fd638 | out: lpFileInformation=0x127fd638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1944f082, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1944f082, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1944f082, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x7e600)) returned 1
	[0197.851] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Mail\\wabimp.dll" (normalized: "c:\\program files\\windows mail\\wabimp.dll"), fInfoLevelId=0x0, lpFileInformation=0x127fd688 | out: lpFileInformation=0x127fd688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x194e79e8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x194e79e8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x194e79e8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc600)) returned 1
	[0197.851] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Mail\\wabmig.exe" (normalized: "c:\\program files\\windows mail\\wabmig.exe"), fInfoLevelId=0x0, lpFileInformation=0x127fd6d8 | out: lpFileInformation=0x127fd6d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1944f082, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1944f082, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1944f082, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10c00)) returned 1
	[0197.851] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player" (normalized: "c:\\program files\\windows media player"), fInfoLevelId=0x0, lpFileInformation=0x127fd728 | out: lpFileInformation=0x127fd728*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf83d59e8, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf83d59e8, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0197.852] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player" (normalized: "c:\\program files\\windows media player"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.852] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf83d59e8, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf83d59e8, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f8e8
	[0197.852] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf83d59e8, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf83d59e8, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.852] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd22e3e9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd22e3e9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd22e3e9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0197.852] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2132d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc2132d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icons", cAlternateFileName="")) returned 1
	[0197.852] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39bdf670, ftCreationTime.dwHighDateTime=0x1d80fa9, ftLastAccessTime.dwLowDateTime=0x50b13730, ftLastAccessTime.dwHighDateTime=0x1d818b8, ftLastWriteTime.dwLowDateTime=0x50b13730, ftLastWriteTime.dwHighDateTime=0x1d818b8, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="leechftp.exe", cAlternateFileName="")) returned 1
	[0197.852] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3161e94, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3161e94, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Renderer", cAlternateFileName="MEDIAR~1")) returned 1
	[0197.852] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57040aa4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57040aa4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57040aa4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2de00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpvis.DLL", cAlternateFileName="")) returned 1
	[0197.852] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x31880ee, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x31880ee, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network Sharing", cAlternateFileName="NETWOR~1")) returned 1
	[0197.853] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57040aa4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57040aa4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57040aa4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1c1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup_wm.exe", cAlternateFileName="")) returned 1
	[0197.853] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x31880ee, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x31880ee, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Skins", cAlternateFileName="")) returned 1
	[0197.853] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25082bf0, ftCreationTime.dwHighDateTime=0x1d7e1e2, ftLastAccessTime.dwLowDateTime=0x85630bf0, ftLastAccessTime.dwHighDateTime=0x1d7e697, ftLastWriteTime.dwLowDateTime=0x85630bf0, ftLastWriteTime.dwHighDateTime=0x1d7e697, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="thunderbird.exe", cAlternateFileName="THUNDE~1.EXE")) returned 1
	[0197.853] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc47584, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc47584, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visualizations", cAlternateFileName="VISUAL~1")) returned 1
	[0197.853] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57066cfe, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57066cfe, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57066cfe, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x16400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmlaunch.exe", cAlternateFileName="")) returned 1
	[0197.853] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57066cfe, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57066cfe, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57066cfe, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x19600, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpconfig.exe", cAlternateFileName="")) returned 1
	[0197.853] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5708cf59, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5708cf59, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5708cf59, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x29800, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmplayer.exe", cAlternateFileName="")) returned 1
	[0197.853] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5832d50a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5832d50a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5832d50a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1f800, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMPMediaSharing.dll", cAlternateFileName="")) returned 1
	[0197.853] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57230930, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57230930, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57230930, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x168000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpnetwk.exe", cAlternateFileName="")) returned 1
	[0197.853] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57230930, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57230930, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57230930, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x11800, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpnscfg.exe", cAlternateFileName="")) returned 1
	[0197.853] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5832d50a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5832d50a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5832d50a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x91000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpnssci.dll", cAlternateFileName="")) returned 1
	[0197.853] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5832d50a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5832d50a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5832d50a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMPNSSUI.dll", cAlternateFileName="")) returned 1
	[0197.853] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57040aa4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57040aa4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57040aa4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmprph.exe", cAlternateFileName="")) returned 1
	[0197.853] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57066cfe, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57066cfe, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57066cfe, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpshare.exe", cAlternateFileName="")) returned 1
	[0197.853] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57040aa4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57040aa4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57040aa4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2ce00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMPSideShowGadget.exe", cAlternateFileName="")) returned 1
	[0197.853] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.853] FindClose (in: hFindFile=0x79f8e8 | out: hFindFile=0x79f8e8) returned 1
	[0197.853] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Icons" (normalized: "c:\\program files\\windows media player\\icons"), fInfoLevelId=0x0, lpFileInformation=0x127fde08 | out: lpFileInformation=0x127fde08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2132d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc2132d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.854] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Icons" (normalized: "c:\\program files\\windows media player\\icons"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.854] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Icons\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2132d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc2132d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79faa8
	[0197.855] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2132d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc2132d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.855] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.855] FindClose (in: hFindFile=0x79faa8 | out: hFindFile=0x79faa8) returned 1
	[0197.855] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer" (normalized: "c:\\program files\\windows media player\\media renderer"), fInfoLevelId=0x0, lpFileInformation=0x127fde58 | out: lpFileInformation=0x127fde58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3161e94, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3161e94, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0197.855] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer" (normalized: "c:\\program files\\windows media player\\media renderer"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0197.855] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3161e94, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3161e94, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fca8
	[0197.988] SetEvent (hEvent=0x168) returned 1
	[0197.988] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3161e94, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3161e94, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0197.988] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x570b31b3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x570b31b3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x570b31b3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x50db, dwReserved0=0x0, dwReserved1=0x0, cFileName="avtransport.xml", cAlternateFileName="")) returned 1
	[0197.988] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57066cfe, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57066cfe, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57066cfe, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1534, dwReserved0=0x0, dwReserved1=0x0, cFileName="connectionmanager_dmr.xml", cAlternateFileName="")) returned 1
	[0197.988] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57066cfe, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57066cfe, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57066cfe, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xba3, dwReserved0=0x0, dwReserved1=0x0, cFileName="DMR_120.jpg", cAlternateFileName="")) returned 1
	[0197.988] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57066cfe, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57066cfe, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57066cfe, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3a1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DMR_120.png", cAlternateFileName="")) returned 1
	[0197.989] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57066cfe, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57066cfe, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57066cfe, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DMR_48.jpg", cAlternateFileName="")) returned 1
	[0197.989] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57066cfe, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57066cfe, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57066cfe, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="DMR_48.png", cAlternateFileName="")) returned 1
	[0197.989] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57066cfe, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57066cfe, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57066cfe, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x18db, dwReserved0=0x0, dwReserved1=0x0, cFileName="RenderingControl.xml", cAlternateFileName="")) returned 1
	[0197.989] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5708cf59, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5708cf59, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5708cf59, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x933, dwReserved0=0x0, dwReserved1=0x0, cFileName="RenderingControl_DMP.xml", cAlternateFileName="")) returned 1
	[0197.989] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0197.989] FindClose (in: hFindFile=0x79fca8 | out: hFindFile=0x79fca8) returned 1
	[0197.990] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.jpg" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_120.jpg"), fInfoLevelId=0x0, lpFileInformation=0x127d2198 | out: lpFileInformation=0x127d2198*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57066cfe, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57066cfe, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57066cfe, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xba3)) returned 1
	[0197.998] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.png" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_120.png"), fInfoLevelId=0x0, lpFileInformation=0x127d21e8 | out: lpFileInformation=0x127d21e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57066cfe, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57066cfe, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57066cfe, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3a1c)) returned 1
	[0198.003] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.jpg" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_48.jpg"), fInfoLevelId=0x0, lpFileInformation=0x127d2238 | out: lpFileInformation=0x127d2238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57066cfe, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57066cfe, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57066cfe, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4c4)) returned 1
	[0198.005] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.png" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_48.png"), fInfoLevelId=0x0, lpFileInformation=0x127d2288 | out: lpFileInformation=0x127d2288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57066cfe, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57066cfe, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57066cfe, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10a9)) returned 1
	[0198.005] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\RenderingControl.xml" (normalized: "c:\\program files\\windows media player\\media renderer\\renderingcontrol.xml"), fInfoLevelId=0x0, lpFileInformation=0x127d22d8 | out: lpFileInformation=0x127d22d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57066cfe, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57066cfe, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57066cfe, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x18db)) returned 1
	[0198.007] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\RenderingControl_DMP.xml" (normalized: "c:\\program files\\windows media player\\media renderer\\renderingcontrol_dmp.xml"), fInfoLevelId=0x0, lpFileInformation=0x127d2328 | out: lpFileInformation=0x127d2328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5708cf59, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5708cf59, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5708cf59, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x933)) returned 1
	[0198.008] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\avtransport.xml" (normalized: "c:\\program files\\windows media player\\media renderer\\avtransport.xml"), fInfoLevelId=0x0, lpFileInformation=0x127d2378 | out: lpFileInformation=0x127d2378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x570b31b3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x570b31b3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x570b31b3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x50db)) returned 1
	[0198.008] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\connectionmanager_dmr.xml" (normalized: "c:\\program files\\windows media player\\media renderer\\connectionmanager_dmr.xml"), fInfoLevelId=0x0, lpFileInformation=0x127d23c8 | out: lpFileInformation=0x127d23c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57066cfe, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57066cfe, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57066cfe, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1534)) returned 1
	[0198.008] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing" (normalized: "c:\\program files\\windows media player\\network sharing"), fInfoLevelId=0x0, lpFileInformation=0x127d2418 | out: lpFileInformation=0x127d2418*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x31880ee, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x31880ee, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0198.008] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing" (normalized: "c:\\program files\\windows media player\\network sharing"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0198.008] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x31880ee, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x31880ee, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fd28
	[0198.014] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x31880ee, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x31880ee, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.014] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57230930, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57230930, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57230930, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x152e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConnectionManager.xml", cAlternateFileName="")) returned 1
	[0198.014] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5832d50a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5832d50a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5832d50a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ContentDirectory.xml", cAlternateFileName="")) returned 1
	[0198.014] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57230930, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57230930, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57230930, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MediaReceiverRegistrar.xml", cAlternateFileName="")) returned 1
	[0198.014] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5832d50a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5832d50a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5832d50a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1287, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpnss_color120.jpg", cAlternateFileName="")) returned 1
	[0198.014] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5832d50a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5832d50a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5832d50a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3ea5, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpnss_color120.png", cAlternateFileName="")) returned 1
	[0198.014] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5832d50a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5832d50a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5832d50a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1038, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpnss_color32.bmp", cAlternateFileName="")) returned 1
	[0198.014] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5832d50a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5832d50a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5832d50a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x743, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpnss_color32.jpg", cAlternateFileName="")) returned 1
	[0198.014] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5832d50a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5832d50a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5832d50a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2438, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpnss_color48.bmp", cAlternateFileName="")) returned 1
	[0198.014] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57230930, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57230930, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57230930, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x910, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpnss_color48.jpg", cAlternateFileName="")) returned 1
	[0198.014] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5832d50a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5832d50a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5832d50a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x139e, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpnss_color48.png", cAlternateFileName="")) returned 1
	[0198.015] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0198.015] FindClose (in: hFindFile=0x79fd28 | out: hFindFile=0x79fd28) returned 1
	[0198.016] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\ConnectionManager.xml" (normalized: "c:\\program files\\windows media player\\network sharing\\connectionmanager.xml"), fInfoLevelId=0x0, lpFileInformation=0x127d27d8 | out: lpFileInformation=0x127d27d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57230930, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57230930, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57230930, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x152e)) returned 1
	[0198.020] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\ContentDirectory.xml" (normalized: "c:\\program files\\windows media player\\network sharing\\contentdirectory.xml"), fInfoLevelId=0x0, lpFileInformation=0x127d2828 | out: lpFileInformation=0x127d2828*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5832d50a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5832d50a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5832d50a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d5b)) returned 1
	[0198.020] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\MediaReceiverRegistrar.xml" (normalized: "c:\\program files\\windows media player\\network sharing\\mediareceiverregistrar.xml"), fInfoLevelId=0x0, lpFileInformation=0x127d2878 | out: lpFileInformation=0x127d2878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57230930, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57230930, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57230930, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa0e)) returned 1
	[0198.020] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color120.jpg"), fInfoLevelId=0x0, lpFileInformation=0x127d28c8 | out: lpFileInformation=0x127d28c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5832d50a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5832d50a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5832d50a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1287)) returned 1
	[0198.020] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.png" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color120.png"), fInfoLevelId=0x0, lpFileInformation=0x127d2918 | out: lpFileInformation=0x127d2918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5832d50a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5832d50a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5832d50a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3ea5)) returned 1
	[0198.020] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.bmp" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color32.bmp"), fInfoLevelId=0x0, lpFileInformation=0x127d2968 | out: lpFileInformation=0x127d2968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5832d50a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5832d50a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5832d50a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1038)) returned 1
	[0198.021] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color32.jpg"), fInfoLevelId=0x0, lpFileInformation=0x127d29b8 | out: lpFileInformation=0x127d29b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5832d50a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5832d50a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5832d50a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x743)) returned 1
	[0198.021] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.bmp" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.bmp"), fInfoLevelId=0x0, lpFileInformation=0x127d2a08 | out: lpFileInformation=0x127d2a08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5832d50a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5832d50a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5832d50a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2438)) returned 1
	[0198.023] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.jpg"), fInfoLevelId=0x0, lpFileInformation=0x127d2a58 | out: lpFileInformation=0x127d2a58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57230930, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57230930, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57230930, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x910)) returned 1
	[0198.023] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.png" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.png"), fInfoLevelId=0x0, lpFileInformation=0x127d2aa8 | out: lpFileInformation=0x127d2aa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5832d50a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5832d50a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5832d50a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x139e)) returned 1
	[0198.023] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Skins" (normalized: "c:\\program files\\windows media player\\skins"), fInfoLevelId=0x0, lpFileInformation=0x127d2af8 | out: lpFileInformation=0x127d2af8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x31880ee, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x31880ee, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0198.023] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Skins" (normalized: "c:\\program files\\windows media player\\skins"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0198.024] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Skins\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x31880ee, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x31880ee, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fb28
	[0198.024] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x31880ee, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x31880ee, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.024] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57040aa4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57040aa4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57040aa4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10506, dwReserved0=0x0, dwReserved1=0x0, cFileName="Revert.wmz", cAlternateFileName="")) returned 1
	[0198.024] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0198.024] FindClose (in: hFindFile=0x79fb28 | out: hFindFile=0x79fb28) returned 1
	[0198.025] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Skins\\Revert.wmz" (normalized: "c:\\program files\\windows media player\\skins\\revert.wmz"), fInfoLevelId=0x0, lpFileInformation=0x127d2b98 | out: lpFileInformation=0x127d2b98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57040aa4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57040aa4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57040aa4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10506)) returned 1
	[0198.025] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Visualizations" (normalized: "c:\\program files\\windows media player\\visualizations"), fInfoLevelId=0x0, lpFileInformation=0x127d2be8 | out: lpFileInformation=0x127d2be8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc47584, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc47584, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0198.025] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\Visualizations" (normalized: "c:\\program files\\windows media player\\visualizations"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0198.025] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Visualizations\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc47584, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc47584, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fce8
	[0198.025] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc47584, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc47584, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.025] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0198.025] FindClose (in: hFindFile=0x79fce8 | out: hFindFile=0x79fce8) returned 1
	[0198.025] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\WMPMediaSharing.dll" (normalized: "c:\\program files\\windows media player\\wmpmediasharing.dll"), fInfoLevelId=0x0, lpFileInformation=0x127d2c88 | out: lpFileInformation=0x127d2c88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5832d50a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5832d50a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5832d50a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1f800)) returned 1
	[0198.027] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\WMPNSSUI.dll" (normalized: "c:\\program files\\windows media player\\wmpnssui.dll"), fInfoLevelId=0x0, lpFileInformation=0x127d2cd8 | out: lpFileInformation=0x127d2cd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5832d50a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5832d50a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5832d50a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x5c00)) returned 1
	[0198.027] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\WMPSideShowGadget.exe" (normalized: "c:\\program files\\windows media player\\wmpsideshowgadget.exe"), fInfoLevelId=0x0, lpFileInformation=0x127d2d28 | out: lpFileInformation=0x127d2d28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57040aa4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57040aa4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57040aa4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2ce00)) returned 1
	[0198.027] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\en-US" (normalized: "c:\\program files\\windows media player\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x127d2d78 | out: lpFileInformation=0x127d2d78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd22e3e9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd22e3e9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd22e3e9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0198.027] CreateFileW (lpFileName="C:\\Program Files\\Windows Media Player\\en-US" (normalized: "c:\\program files\\windows media player\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0198.027] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd22e3e9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd22e3e9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd22e3e9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fe68
	[0198.041] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd22e3e9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd22e3e9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd22e3e9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.041] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa45f2833, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa45f2833, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa45f2833, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpvis.dll.mui", cAlternateFileName="")) returned 1
	[0198.041] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa45f2833, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa45f2833, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa45f2833, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe200, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup_wm.exe.mui", cAlternateFileName="")) returned 1
	[0198.041] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa45cc5b7, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa45cc5b7, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa45cc5b7, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmlaunch.exe.mui", cAlternateFileName="")) returned 1
	[0198.041] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa45f2833, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa45f2833, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa45f2833, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmplayer.exe.mui", cAlternateFileName="")) returned 1
	[0198.041] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4749d9c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa4749d9c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa4749d9c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMPMediaSharing.dll.mui", cAlternateFileName="")) returned 1
	[0198.041] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4749d9c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa4749d9c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa4749d9c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpnetwk.exe.mui", cAlternateFileName="")) returned 1
	[0198.041] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4749d9c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa4749d9c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa4749d9c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpnscfg.exe.mui", cAlternateFileName="")) returned 1
	[0198.041] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4749d9c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa4749d9c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa4749d9c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpnssci.dll.mui", cAlternateFileName="")) returned 1
	[0198.042] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4749d9c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa4749d9c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa4749d9c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpnssui.dll.mui", cAlternateFileName="")) returned 1
	[0198.042] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa45cc5b7, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa45cc5b7, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa45cc5b7, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMPSideShowGadget.exe.mui", cAlternateFileName="")) returned 1
	[0198.042] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0198.042] FindClose (in: hFindFile=0x79fe68 | out: hFindFile=0x79fe68) returned 1
	[0198.043] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\WMPMediaSharing.dll.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpmediasharing.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x127d3138 | out: lpFileInformation=0x127d3138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4749d9c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa4749d9c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa4749d9c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00)) returned 1
	[0198.044] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\WMPSideShowGadget.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpsideshowgadget.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x127d3188 | out: lpFileInformation=0x127d3188*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa45cc5b7, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa45cc5b7, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa45cc5b7, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1200)) returned 1
	[0198.044] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\mpvis.dll.mui" (normalized: "c:\\program files\\windows media player\\en-us\\mpvis.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x127d31d8 | out: lpFileInformation=0x127d31d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa45f2833, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa45f2833, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa45f2833, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00)) returned 1
	[0198.047] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\setup_wm.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\setup_wm.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x127d3228 | out: lpFileInformation=0x127d3228*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa45f2833, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa45f2833, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa45f2833, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe200)) returned 1
	[0198.048] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmlaunch.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmlaunch.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x127d3278 | out: lpFileInformation=0x127d3278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa45cc5b7, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa45cc5b7, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa45cc5b7, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xc00)) returned 1
	[0198.048] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmplayer.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmplayer.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x127d32c8 | out: lpFileInformation=0x127d32c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa45f2833, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa45f2833, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa45f2833, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00)) returned 1
	[0198.050] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmpnetwk.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpnetwk.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x127d3318 | out: lpFileInformation=0x127d3318*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4749d9c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa4749d9c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa4749d9c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x9e00)) returned 1
	[0198.050] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmpnscfg.exe.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpnscfg.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x127d3368 | out: lpFileInformation=0x127d3368*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4749d9c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa4749d9c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa4749d9c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00)) returned 1
	[0198.050] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmpnssci.dll.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpnssci.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x127d33b8 | out: lpFileInformation=0x127d33b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4749d9c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa4749d9c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa4749d9c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1400)) returned 1
	[0198.050] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\wmpnssui.dll.mui" (normalized: "c:\\program files\\windows media player\\en-us\\wmpnssui.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x127d3408 | out: lpFileInformation=0x127d3408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4749d9c, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa4749d9c, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa4749d9c, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00)) returned 1
	[0198.050] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\leechftp.exe" (normalized: "c:\\program files\\windows media player\\leechftp.exe"), fInfoLevelId=0x0, lpFileInformation=0x127d3458 | out: lpFileInformation=0x127d3458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39bdf670, ftCreationTime.dwHighDateTime=0x1d80fa9, ftLastAccessTime.dwLowDateTime=0x50b13730, ftLastAccessTime.dwHighDateTime=0x1d818b8, ftLastWriteTime.dwLowDateTime=0x50b13730, ftLastWriteTime.dwHighDateTime=0x1d818b8, nFileSizeHigh=0x0, nFileSizeLow=0x13a00)) returned 1
	[0198.050] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\mpvis.DLL" (normalized: "c:\\program files\\windows media player\\mpvis.dll"), fInfoLevelId=0x0, lpFileInformation=0x127d34a8 | out: lpFileInformation=0x127d34a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57040aa4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57040aa4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57040aa4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2de00)) returned 1
	[0198.051] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\setup_wm.exe" (normalized: "c:\\program files\\windows media player\\setup_wm.exe"), fInfoLevelId=0x0, lpFileInformation=0x127d34f8 | out: lpFileInformation=0x127d34f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57040aa4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57040aa4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57040aa4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1c1800)) returned 1
	[0198.055] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\thunderbird.exe" (normalized: "c:\\program files\\windows media player\\thunderbird.exe"), fInfoLevelId=0x0, lpFileInformation=0x127d3548 | out: lpFileInformation=0x127d3548*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25082bf0, ftCreationTime.dwHighDateTime=0x1d7e1e2, ftLastAccessTime.dwLowDateTime=0x85630bf0, ftLastAccessTime.dwHighDateTime=0x1d7e697, ftLastWriteTime.dwLowDateTime=0x85630bf0, ftLastWriteTime.dwHighDateTime=0x1d7e697, nFileSizeHigh=0x0, nFileSizeLow=0x13a00)) returned 1
	[0198.055] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\wmlaunch.exe" (normalized: "c:\\program files\\windows media player\\wmlaunch.exe"), fInfoLevelId=0x0, lpFileInformation=0x127d3598 | out: lpFileInformation=0x127d3598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57066cfe, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57066cfe, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57066cfe, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x16400)) returned 1
	[0198.055] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\wmpconfig.exe" (normalized: "c:\\program files\\windows media player\\wmpconfig.exe"), fInfoLevelId=0x0, lpFileInformation=0x127d35e8 | out: lpFileInformation=0x127d35e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57066cfe, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57066cfe, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57066cfe, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x19600)) returned 1
	[0198.055] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\wmplayer.exe" (normalized: "c:\\program files\\windows media player\\wmplayer.exe"), fInfoLevelId=0x0, lpFileInformation=0x127d3638 | out: lpFileInformation=0x127d3638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5708cf59, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5708cf59, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5708cf59, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x29800)) returned 1
	[0198.055] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\wmpnetwk.exe" (normalized: "c:\\program files\\windows media player\\wmpnetwk.exe"), fInfoLevelId=0x0, lpFileInformation=0x127d3688 | out: lpFileInformation=0x127d3688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57230930, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57230930, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57230930, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x168000)) returned 1
	[0198.059] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\wmpnscfg.exe" (normalized: "c:\\program files\\windows media player\\wmpnscfg.exe"), fInfoLevelId=0x0, lpFileInformation=0x127d36d8 | out: lpFileInformation=0x127d36d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57230930, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57230930, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57230930, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x11800)) returned 1
	[0198.059] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\wmpnssci.dll" (normalized: "c:\\program files\\windows media player\\wmpnssci.dll"), fInfoLevelId=0x0, lpFileInformation=0x127d3728 | out: lpFileInformation=0x127d3728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5832d50a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5832d50a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5832d50a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x91000)) returned 1
	[0198.059] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\wmprph.exe" (normalized: "c:\\program files\\windows media player\\wmprph.exe"), fInfoLevelId=0x0, lpFileInformation=0x127d3778 | out: lpFileInformation=0x127d3778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57040aa4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57040aa4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57040aa4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x15000)) returned 1
	[0198.059] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Media Player\\wmpshare.exe" (normalized: "c:\\program files\\windows media player\\wmpshare.exe"), fInfoLevelId=0x0, lpFileInformation=0x127d37c8 | out: lpFileInformation=0x127d37c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57066cfe, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57066cfe, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57066cfe, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1a000)) returned 1
	[0198.059] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Multimedia Platform" (normalized: "c:\\program files\\windows multimedia platform"), fInfoLevelId=0x0, lpFileInformation=0x127d3818 | out: lpFileInformation=0x127d3818*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf83df5bb, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf83df5bb, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0198.059] CreateFileW (lpFileName="C:\\Program Files\\Windows Multimedia Platform" (normalized: "c:\\program files\\windows multimedia platform"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0198.059] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Multimedia Platform\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf83df5bb, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf83df5bb, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79faa8
	[0198.060] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf83df5bb, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf83df5bb, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.060] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586c1650, ftCreationTime.dwHighDateTime=0x1d7dc97, ftLastAccessTime.dwLowDateTime=0x6f595660, ftLastAccessTime.dwHighDateTime=0x1d7ee27, ftLastWriteTime.dwLowDateTime=0x6f595660, ftLastWriteTime.dwHighDateTime=0x1d7ee27, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="gmailnotifierpro.exe", cAlternateFileName="GMAILN~1.EXE")) returned 1
	[0198.060] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae0ca3f0, ftCreationTime.dwHighDateTime=0x1d80c84, ftLastAccessTime.dwLowDateTime=0x695320f0, ftLastAccessTime.dwHighDateTime=0x1d81bf6, ftLastWriteTime.dwLowDateTime=0x695320f0, ftLastWriteTime.dwHighDateTime=0x1d81bf6, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="operamail.exe", cAlternateFileName="OPERAM~1.EXE")) returned 1
	[0198.060] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34319950, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x34319950, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x34319950, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f0e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1
	[0198.060] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f13830, ftCreationTime.dwHighDateTime=0x1d7b263, ftLastAccessTime.dwLowDateTime=0xc4657aa0, ftLastAccessTime.dwHighDateTime=0x1d7c51c, ftLastWriteTime.dwLowDateTime=0xc4657aa0, ftLastWriteTime.dwHighDateTime=0x1d7c51c, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="webdrive.exe", cAlternateFileName="")) returned 1
	[0198.060] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0198.060] FindClose (in: hFindFile=0x79faa8 | out: hFindFile=0x79faa8) returned 1
	[0198.060] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Multimedia Platform\\gmailnotifierpro.exe" (normalized: "c:\\program files\\windows multimedia platform\\gmailnotifierpro.exe"), fInfoLevelId=0x0, lpFileInformation=0x127d39a8 | out: lpFileInformation=0x127d39a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586c1650, ftCreationTime.dwHighDateTime=0x1d7dc97, ftLastAccessTime.dwLowDateTime=0x6f595660, ftLastAccessTime.dwHighDateTime=0x1d7ee27, ftLastWriteTime.dwLowDateTime=0x6f595660, ftLastWriteTime.dwHighDateTime=0x1d7ee27, nFileSizeHigh=0x0, nFileSizeLow=0x13a00)) returned 1
	[0198.060] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Multimedia Platform\\operamail.exe" (normalized: "c:\\program files\\windows multimedia platform\\operamail.exe"), fInfoLevelId=0x0, lpFileInformation=0x127d39f8 | out: lpFileInformation=0x127d39f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae0ca3f0, ftCreationTime.dwHighDateTime=0x1d80c84, ftLastAccessTime.dwLowDateTime=0x695320f0, ftLastAccessTime.dwHighDateTime=0x1d81bf6, ftLastWriteTime.dwLowDateTime=0x695320f0, ftLastWriteTime.dwHighDateTime=0x1d81bf6, nFileSizeHigh=0x0, nFileSizeLow=0x13a00)) returned 1
	[0198.061] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Multimedia Platform\\sqmapi.dll" (normalized: "c:\\program files\\windows multimedia platform\\sqmapi.dll"), fInfoLevelId=0x0, lpFileInformation=0x127d3a48 | out: lpFileInformation=0x127d3a48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34319950, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x34319950, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x34319950, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f0e8)) returned 1
	[0198.061] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Multimedia Platform\\webdrive.exe" (normalized: "c:\\program files\\windows multimedia platform\\webdrive.exe"), fInfoLevelId=0x0, lpFileInformation=0x127d3a98 | out: lpFileInformation=0x127d3a98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f13830, ftCreationTime.dwHighDateTime=0x1d7b263, ftLastAccessTime.dwLowDateTime=0xc4657aa0, ftLastAccessTime.dwHighDateTime=0x1d7c51c, ftLastWriteTime.dwLowDateTime=0xc4657aa0, ftLastWriteTime.dwHighDateTime=0x1d7c51c, nFileSizeHigh=0x0, nFileSizeLow=0x13a00)) returned 1
	[0198.061] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows NT" (normalized: "c:\\program files\\windows nt"), fInfoLevelId=0x0, lpFileInformation=0x127d3ae8 | out: lpFileInformation=0x127d3ae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf8f545e7, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf8f545e7, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0198.061] CreateFileW (lpFileName="C:\\Program Files\\Windows NT" (normalized: "c:\\program files\\windows nt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0198.061] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf8f545e7, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf8f545e7, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f968
	[0198.061] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf8f545e7, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf8f545e7, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.061] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd22e3e9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd22e3e9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1
	[0198.061] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a9d0170, ftCreationTime.dwHighDateTime=0x1d80916, ftLastAccessTime.dwLowDateTime=0x15403ad0, ftLastAccessTime.dwHighDateTime=0x1d80dcc, ftLastWriteTime.dwLowDateTime=0x15403ad0, ftLastWriteTime.dwHighDateTime=0x1d80dcc, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mxslipstream.exe", cAlternateFileName="MXSLIP~1.EXE")) returned 1
	[0198.061] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd22e3e9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd22e3e9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService", cAlternateFileName="TABLET~1")) returned 1
	[0198.061] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0198.062] FindClose (in: hFindFile=0x79f968 | out: hFindFile=0x79f968) returned 1
	[0198.062] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories" (normalized: "c:\\program files\\windows nt\\accessories"), fInfoLevelId=0x0, lpFileInformation=0x127d3c28 | out: lpFileInformation=0x127d3c28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd22e3e9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd22e3e9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0198.062] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\Accessories" (normalized: "c:\\program files\\windows nt\\accessories"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0198.062] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd22e3e9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd22e3e9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ff68
	[0198.062] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd22e3e9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd22e3e9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.062] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd22e3e9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd22e3e9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd22e3e9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0198.062] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2203aecd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2203aecd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2206112b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x44f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wordpad.exe", cAlternateFileName="")) returned 1
	[0198.062] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2206112b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2206112b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2206112b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2aa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordpadFilter.dll", cAlternateFileName="")) returned 1
	[0198.062] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0198.062] FindClose (in: hFindFile=0x79ff68 | out: hFindFile=0x79ff68) returned 1
	[0198.062] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\WordpadFilter.dll" (normalized: "c:\\program files\\windows nt\\accessories\\wordpadfilter.dll"), fInfoLevelId=0x0, lpFileInformation=0x127d3d68 | out: lpFileInformation=0x127d3d68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2206112b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2206112b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2206112b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2aa00)) returned 1
	[0198.068] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\en-US" (normalized: "c:\\program files\\windows nt\\accessories\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x127d3db8 | out: lpFileInformation=0x127d3db8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd22e3e9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd22e3e9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd22e3e9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0198.068] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\Accessories\\en-US" (normalized: "c:\\program files\\windows nt\\accessories\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0198.068] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\en-US\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd22e3e9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd22e3e9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd22e3e9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f8e8
	[0198.069] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd22e3e9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd22e3e9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd22e3e9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.069] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa005b596, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa005b596, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa005b596, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x0, dwReserved1=0x0, cFileName="wordpad.exe.mui", cAlternateFileName="")) returned 1
	[0198.069] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0198.069] FindClose (in: hFindFile=0x79f8e8 | out: hFindFile=0x79f8e8) returned 1
	[0198.069] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\en-US\\wordpad.exe.mui" (normalized: "c:\\program files\\windows nt\\accessories\\en-us\\wordpad.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x127d3e58 | out: lpFileInformation=0x127d3e58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa005b596, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa005b596, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa005b596, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xc800)) returned 1
	[0198.071] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\wordpad.exe" (normalized: "c:\\program files\\windows nt\\accessories\\wordpad.exe"), fInfoLevelId=0x0, lpFileInformation=0x127d3ea8 | out: lpFileInformation=0x127d3ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2203aecd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2203aecd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2206112b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x44f000)) returned 1
	[0198.071] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows NT\\TableTextService" (normalized: "c:\\program files\\windows nt\\tabletextservice"), fInfoLevelId=0x0, lpFileInformation=0x127d3ef8 | out: lpFileInformation=0x127d3ef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd22e3e9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd22e3e9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0198.072] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\TableTextService" (normalized: "c:\\program files\\windows nt\\tabletextservice"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0198.072] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd22e3e9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd22e3e9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fde8
	[0198.092] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd22e3e9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd22e3e9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.092] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd22e3e9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd254645, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd254645, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0198.092] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26bc7614, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x26bc7614, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x26bc7614, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService.dll", cAlternateFileName="")) returned 1
	[0198.092] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x277d946b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x277d946b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x277d946b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3626, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextServiceAmharic.txt", cAlternateFileName="")) returned 1
	[0198.092] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26b54f09, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x26b54f09, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x26b54f09, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x136c70, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextServiceArray.txt", cAlternateFileName="")) returned 1
	[0198.092] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2760f839, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2760f839, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2760f839, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xef500, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextServiceDaYi.txt", cAlternateFileName="")) returned 1
	[0198.092] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510703d3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510703d3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510703d3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3632, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextServiceTigrinya.txt", cAlternateFileName="")) returned 1
	[0198.092] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26cd268a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x26cd268a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x26cd268a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb072, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextServiceYi.txt", cAlternateFileName="")) returned 1
	[0198.093] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0198.093] FindClose (in: hFindFile=0x79fde8 | out: hFindFile=0x79fde8) returned 1
	[0198.097] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextService.dll" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservice.dll"), fInfoLevelId=0x0, lpFileInformation=0x126d4238 | out: lpFileInformation=0x126d4238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26bc7614, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x26bc7614, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x26bc7614, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa2600)) returned 1
	[0198.099] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceAmharic.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextserviceamharic.txt"), fInfoLevelId=0x0, lpFileInformation=0x126d4288 | out: lpFileInformation=0x126d4288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x277d946b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x277d946b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x277d946b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3626)) returned 1
	[0198.099] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceArray.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicearray.txt"), fInfoLevelId=0x0, lpFileInformation=0x126d42d8 | out: lpFileInformation=0x126d42d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26b54f09, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x26b54f09, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x26b54f09, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x136c70)) returned 1
	[0198.113] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceDaYi.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicedayi.txt"), fInfoLevelId=0x0, lpFileInformation=0x126d4328 | out: lpFileInformation=0x126d4328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2760f839, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2760f839, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2760f839, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xef500)) returned 1
	[0198.169] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceTigrinya.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicetigrinya.txt"), fInfoLevelId=0x0, lpFileInformation=0x126d4378 | out: lpFileInformation=0x126d4378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510703d3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510703d3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510703d3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3632)) returned 1
	[0198.170] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceYi.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextserviceyi.txt"), fInfoLevelId=0x0, lpFileInformation=0x126d43c8 | out: lpFileInformation=0x126d43c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26cd268a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x26cd268a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x26cd268a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb072)) returned 1
	[0198.170] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\en-US" (normalized: "c:\\program files\\windows nt\\tabletextservice\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x126d4418 | out: lpFileInformation=0x126d4418*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd22e3e9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd254645, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd254645, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0198.170] CreateFileW (lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\en-US" (normalized: "c:\\program files\\windows nt\\tabletextservice\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0198.171] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\en-US\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd22e3e9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd254645, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd254645, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fb28
	[0198.171] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd22e3e9, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd254645, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd254645, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.171] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0b88724, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa0b88724, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa0b88724, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService.dll.mui", cAlternateFileName="")) returned 1
	[0198.171] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0198.171] FindClose (in: hFindFile=0x79fb28 | out: hFindFile=0x79fb28) returned 1
	[0198.171] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\en-US\\TableTextService.dll.mui" (normalized: "c:\\program files\\windows nt\\tabletextservice\\en-us\\tabletextservice.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x126d44b8 | out: lpFileInformation=0x126d44b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0b88724, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa0b88724, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa0b88724, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x2400)) returned 1
	[0198.172] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows NT\\mxslipstream.exe" (normalized: "c:\\program files\\windows nt\\mxslipstream.exe"), fInfoLevelId=0x0, lpFileInformation=0x126d4508 | out: lpFileInformation=0x126d4508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a9d0170, ftCreationTime.dwHighDateTime=0x1d80916, ftLastAccessTime.dwLowDateTime=0x15403ad0, ftLastAccessTime.dwHighDateTime=0x1d80dcc, ftLastWriteTime.dwLowDateTime=0x15403ad0, ftLastWriteTime.dwHighDateTime=0x1d80dcc, nFileSizeHigh=0x0, nFileSizeLow=0x13a00)) returned 1
	[0198.172] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer" (normalized: "c:\\program files\\windows photo viewer"), fInfoLevelId=0x0, lpFileInformation=0x126d4558 | out: lpFileInformation=0x126d4558*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd254645, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd254645, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0198.172] CreateFileW (lpFileName="C:\\Program Files\\Windows Photo Viewer" (normalized: "c:\\program files\\windows photo viewer"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0198.172] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd254645, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd254645, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fde8
	[0198.176] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x3000, flProtect=0x4) returned 0x332a0000
	[0198.176] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd254645, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd254645, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.177] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd254645, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd254645, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd254645, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0198.177] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57197fce, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57197fce, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57197fce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x19ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingDevices.exe", cAlternateFileName="")) returned 1
	[0198.177] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57197fce, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57197fce, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57197fce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x240a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingEngine.dll", cAlternateFileName="")) returned 1
	[0198.177] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57197fce, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57197fce, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57197fce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1e5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoAcq.dll", cAlternateFileName="")) returned 1
	[0198.177] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5714bb11, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5714bb11, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5714bb11, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoBase.dll", cAlternateFileName="")) returned 1
	[0198.177] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57171d78, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57171d78, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57197fce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1be200, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoViewer.dll", cAlternateFileName="")) returned 1
	[0198.177] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0198.177] FindClose (in: hFindFile=0x79fde8 | out: hFindFile=0x79fde8) returned 1
	[0198.178] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\ImagingDevices.exe" (normalized: "c:\\program files\\windows photo viewer\\imagingdevices.exe"), fInfoLevelId=0x0, lpFileInformation=0x126d4788 | out: lpFileInformation=0x126d4788*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57197fce, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57197fce, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57197fce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x19ac0)) returned 1
	[0198.179] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\ImagingEngine.dll" (normalized: "c:\\program files\\windows photo viewer\\imagingengine.dll"), fInfoLevelId=0x0, lpFileInformation=0x126d47d8 | out: lpFileInformation=0x126d47d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57197fce, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57197fce, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57197fce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x240a00)) returned 1
	[0198.184] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\PhotoAcq.dll" (normalized: "c:\\program files\\windows photo viewer\\photoacq.dll"), fInfoLevelId=0x0, lpFileInformation=0x126d4828 | out: lpFileInformation=0x126d4828*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57197fce, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57197fce, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57197fce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1e5600)) returned 1
	[0198.191] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\PhotoBase.dll" (normalized: "c:\\program files\\windows photo viewer\\photobase.dll"), fInfoLevelId=0x0, lpFileInformation=0x126d4878 | out: lpFileInformation=0x126d4878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5714bb11, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5714bb11, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5714bb11, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb600)) returned 1
	[0198.192] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll" (normalized: "c:\\program files\\windows photo viewer\\photoviewer.dll"), fInfoLevelId=0x0, lpFileInformation=0x126d48c8 | out: lpFileInformation=0x126d48c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57171d78, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x57171d78, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x57197fce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1be200)) returned 1
	[0198.195] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US" (normalized: "c:\\program files\\windows photo viewer\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x126d4918 | out: lpFileInformation=0x126d4918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd254645, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd254645, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd254645, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0198.195] CreateFileW (lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US" (normalized: "c:\\program files\\windows photo viewer\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0198.195] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd254645, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd254645, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd254645, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fda8
	[0198.195] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd254645, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd254645, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd254645, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.195] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5a5ccbb, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa5a5ccbb, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa5a5ccbb, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingDevices.exe.mui", cAlternateFileName="")) returned 1
	[0198.195] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5a82f01, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa5a82f01, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa5a82f01, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x6200, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoAcq.dll.mui", cAlternateFileName="")) returned 1
	[0198.196] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5a82f01, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa5a82f01, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa5a82f01, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoViewer.dll.mui", cAlternateFileName="")) returned 1
	[0198.196] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0198.196] FindClose (in: hFindFile=0x79fda8 | out: hFindFile=0x79fda8) returned 1
	[0198.196] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui" (normalized: "c:\\program files\\windows photo viewer\\en-us\\imagingdevices.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126d4aa8 | out: lpFileInformation=0x126d4aa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5a5ccbb, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa5a5ccbb, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa5a5ccbb, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0xe00)) returned 1
	[0198.196] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui" (normalized: "c:\\program files\\windows photo viewer\\en-us\\photoacq.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x126d4af8 | out: lpFileInformation=0x126d4af8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5a82f01, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa5a82f01, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa5a82f01, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x6200)) returned 1
	[0198.200] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoViewer.dll.mui" (normalized: "c:\\program files\\windows photo viewer\\en-us\\photoviewer.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x126d4b48 | out: lpFileInformation=0x126d4b48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5a82f01, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa5a82f01, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa5a82f01, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x4200)) returned 1
	[0198.200] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Portable Devices" (normalized: "c:\\program files\\windows portable devices"), fInfoLevelId=0x0, lpFileInformation=0x126d4b98 | out: lpFileInformation=0x126d4b98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf7d6578b, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf7d6578b, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0198.200] CreateFileW (lpFileName="C:\\Program Files\\Windows Portable Devices" (normalized: "c:\\program files\\windows portable devices"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0198.201] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Portable Devices\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf7d6578b, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf7d6578b, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ff68
	[0198.201] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf7d6578b, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf7d6578b, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.201] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x451cadc0, ftCreationTime.dwHighDateTime=0x1d7b2ae, ftLastAccessTime.dwLowDateTime=0xd40a0960, ftLastAccessTime.dwHighDateTime=0x1d818e3, ftLastWriteTime.dwLowDateTime=0xd40a0960, ftLastWriteTime.dwHighDateTime=0x1d818e3, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="3dftp.exe", cAlternateFileName="")) returned 1
	[0198.201] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3533170f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x3533170f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x3533170f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f0e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1
	[0198.201] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0198.201] FindClose (in: hFindFile=0x79ff68 | out: hFindFile=0x79ff68) returned 1
	[0198.201] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Portable Devices\\3dftp.exe" (normalized: "c:\\program files\\windows portable devices\\3dftp.exe"), fInfoLevelId=0x0, lpFileInformation=0x126d4c88 | out: lpFileInformation=0x126d4c88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x451cadc0, ftCreationTime.dwHighDateTime=0x1d7b2ae, ftLastAccessTime.dwLowDateTime=0xd40a0960, ftLastAccessTime.dwHighDateTime=0x1d818e3, ftLastWriteTime.dwLowDateTime=0xd40a0960, ftLastWriteTime.dwHighDateTime=0x1d818e3, nFileSizeHigh=0x0, nFileSizeLow=0x13a00)) returned 1
	[0198.202] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Portable Devices\\sqmapi.dll" (normalized: "c:\\program files\\windows portable devices\\sqmapi.dll"), fInfoLevelId=0x0, lpFileInformation=0x126d4cd8 | out: lpFileInformation=0x126d4cd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3533170f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x3533170f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x3533170f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f0e8)) returned 1
	[0198.205] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Sidebar" (normalized: "c:\\program files\\windows sidebar"), fInfoLevelId=0x0, lpFileInformation=0x126d4d28 | out: lpFileInformation=0x126d4d28*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf7870e46, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf7870e46, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0198.205] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar" (normalized: "c:\\program files\\windows sidebar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0198.205] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf7870e46, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf7870e46, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffa8
	[0198.205] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf7870e46, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf7870e46, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.205] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc47584, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc47584, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadgets", cAlternateFileName="")) returned 1
	[0198.206] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb0f80f0, ftCreationTime.dwHighDateTime=0x1d7f5b0, ftLastAccessTime.dwLowDateTime=0x5be538e0, ftLastAccessTime.dwHighDateTime=0x1d814fd, ftLastWriteTime.dwLowDateTime=0x5be538e0, ftLastWriteTime.dwHighDateTime=0x1d814fd, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="public.exe", cAlternateFileName="")) returned 1
	[0198.206] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc47584, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc47584, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared Gadgets", cAlternateFileName="SHARED~1")) returned 1
	[0198.206] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0198.206] FindClose (in: hFindFile=0x79ffa8 | out: hFindFile=0x79ffa8) returned 1
	[0198.206] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets" (normalized: "c:\\program files\\windows sidebar\\gadgets"), fInfoLevelId=0x0, lpFileInformation=0x126d4e68 | out: lpFileInformation=0x126d4e68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc47584, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc47584, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0198.206] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets" (normalized: "c:\\program files\\windows sidebar\\gadgets"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0198.206] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc47584, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc47584, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9e8
	[0198.207] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc47584, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc47584, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.207] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0198.207] FindClose (in: hFindFile=0x79f9e8 | out: hFindFile=0x79f9e8) returned 1
	[0198.207] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Shared Gadgets" (normalized: "c:\\program files\\windows sidebar\\shared gadgets"), fInfoLevelId=0x0, lpFileInformation=0x126d4eb8 | out: lpFileInformation=0x126d4eb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc47584, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc47584, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0198.207] CreateFileW (lpFileName="C:\\Program Files\\Windows Sidebar\\Shared Gadgets" (normalized: "c:\\program files\\windows sidebar\\shared gadgets"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0198.207] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc47584, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc47584, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffa8
	[0198.207] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc47584, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc47584, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.208] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0198.208] FindClose (in: hFindFile=0x79ffa8 | out: hFindFile=0x79ffa8) returned 1
	[0198.208] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\public.exe" (normalized: "c:\\program files\\windows sidebar\\public.exe"), fInfoLevelId=0x0, lpFileInformation=0x126d4f08 | out: lpFileInformation=0x126d4f08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb0f80f0, ftCreationTime.dwHighDateTime=0x1d7f5b0, ftLastAccessTime.dwLowDateTime=0x5be538e0, ftLastAccessTime.dwHighDateTime=0x1d814fd, ftLastWriteTime.dwLowDateTime=0x5be538e0, ftLastWriteTime.dwHighDateTime=0x1d814fd, nFileSizeHigh=0x0, nFileSizeLow=0x13a00)) returned 1
	[0198.208] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps" (normalized: "c:\\program files\\windowsapps"), fInfoLevelId=0x0, lpFileInformation=0x126d4f58 | out: lpFileInformation=0x126d4f58*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2224dfa5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2224dfa5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1
	[0198.208] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps" (normalized: "c:\\program files\\windowsapps"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0198.208] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2224dfa5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2224dfa5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0068
	[0198.209] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2224dfa5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2224dfa5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.211] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc47584, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc47584, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Deleted", cAlternateFileName="")) returned 1
	[0198.211] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29f0b1bb, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x936d064c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x936d064c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.0_N")) returned 1
	[0198.211] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x936d064c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x936d064c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe", cAlternateFileName="MICROS~1.0_X")) returned 1
	[0198.211] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f59f46a, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x943087a2, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x943087a2, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe", cAlternateFileName="MICROS~2.0_N")) returned 1
	[0198.211] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f316dd6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x942e23d9, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x942e23d9, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MICROS~3.0_N")) returned 1
	[0198.211] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcef23b4e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x950bde7a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x950bde7a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MICROS~4.0_N")) returned 1
	[0198.211] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcefbc21b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x950bde7a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x950bde7a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe", cAlternateFileName="MICROS~2.0_X")) returned 1
	[0198.211] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc825b3ce, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x95ddaedf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x95ddaedf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MIADDF~1.0_N")) returned 1
	[0198.211] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc82cd965, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x95ddaedf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x95ddaedf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe", cAlternateFileName="MICROS~3.0_X")) returned 1
	[0198.211] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4188a18, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x96bb6961, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x96bb6961, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MI90D7~1.0_N")) returned 1
	[0198.211] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc41fb14b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x96bb6961, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x96bb6961, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe", cAlternateFileName="MICROS~4.0_X")) returned 1
	[0198.212] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb6833b2, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x9796c1ac, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x9796c1ac, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MIF7D7~1.0_N")) returned 1
	[0198.212] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9ca7e5, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x97992404, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x97992404, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe", cAlternateFileName="MI7AA9~1.0_X")) returned 1
	[0198.212] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc14fa320, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x986d5458, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x986d5458, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe", cAlternateFileName="MIBA67~1.SCA")) returned 1
	[0198.212] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc0ca1dd3, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x986af2f4, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x986af2f4, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MICC3B~1.0_N")) returned 1
	[0198.212] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc0d609db, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x986af2f4, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x986af2f4, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe", cAlternateFileName="MIBB30~1.0_X")) returned 1
	[0198.212] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a9304a0, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x992e71ee, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x992e71ee, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MI2247~1.0_N")) returned 1
	[0198.212] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ae8da63, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x992e71ee, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x992e71ee, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe", cAlternateFileName="MIECF5~1.0_X")) returned 1
	[0198.212] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12299da4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x99f455a4, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x99f455a4, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MIA544~1.0_N")) returned 1
	[0198.212] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1235872d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x99f455a4, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x99f455a4, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Getstarted_2.3.7.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI49B0~1.0_X")) returned 1
	[0198.213] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbdbc104a, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x9b74311d, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x9b74311d, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Messaging_1.10.22012.0_neutral_split.scale-150_8wekyb3d8bbwe", cAlternateFileName="MI49E9~1.SCA")) returned 1
	[0198.213] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbc1146ca, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x9b71ceca, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x9b71ceca, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MI1776~1.0_N")) returned 1
	[0198.213] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbc160b8b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x9b74311d, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x9b74311d, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Messaging_1.10.22012.0_x86__8wekyb3d8bbwe", cAlternateFileName="MI8EA6~1.0_X")) returned 1
	[0198.213] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a8671c, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x9c75affd, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x9c75affd, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftOfficeHub_17.6306.23501.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI80F4~1.0_X")) returned 1
	[0198.213] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4870576, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x9c75affd, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x9c75affd, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftOfficeHub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MID688~1.0_N")) returned 1
	[0198.213] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd57013c3, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x9e574ab8, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x9e574ab8, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_split.scale-100_8wekyb3d8bbwe", cAlternateFileName="MIA9BB~1.SCA")) returned 1
	[0198.213] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3553a5f, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x9e54e85e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x9e54e85e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MIAB2E~1.0_N")) returned 1
	[0198.213] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd361240e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x9e54e85e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x9e54e85e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_x64__8wekyb3d8bbwe", cAlternateFileName="MIAFF4~1.0_X")) returned 1
	[0198.213] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaed07d8, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x9e9c6ec3, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x9e9c6ec3, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI052E~1.0_X")) returned 1
	[0198.213] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb10ca82, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x9ed5a790, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x9ed5a790, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe", cAlternateFileName="MI3AF7~1.0_X")) returned 1
	[0198.214] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa951b886, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x91bb1939, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x91bb1939, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI4ACC~1.0_X")) returned 1
	[0198.214] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa977de06, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x917f803f, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x917f803f, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe", cAlternateFileName="MI0106~1.0_X")) returned 1
	[0198.214] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb2fc956, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x9f0a1af0, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x9f0a1af0, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe", cAlternateFileName="MIEBDA~1.0_X")) returned 1
	[0198.214] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb964f40, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x9f3e8f81, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x9f3e8f81, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe", cAlternateFileName="MIA018~1.0_X")) returned 1
	[0198.214] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9993f76, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x921814bc, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x921814bc, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI7399~1.0_X")) returned 1
	[0198.214] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa99e0475, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x91eac945, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x91eac945, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe", cAlternateFileName="MI38C6~1.0_X")) returned 1
	[0198.214] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf67b84b6, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa1654d78, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xa1654d78, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.OneNote_17.6131.10051.0_x64__8wekyb3d8bbwe", cAlternateFileName="MIFB46~1.0_X")) returned 1
	[0198.214] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf663ace4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa1654d78, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xa1654d78, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.OneNote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MI1AFA~1.0_N")) returned 1
	[0198.215] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe5efffc, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa2e0636b, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xa2e0636b, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI4126~1.0_X")) returned 1
	[0198.215] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe5576ca, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa2e0636b, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xa2e0636b, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MI01E4~1.0_N")) returned 1
	[0198.215] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb846df56, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa3b95998, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xa3b95998, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.People_10.0.2840.0_neutral_split.scale-100_8wekyb3d8bbwe", cAlternateFileName="MI6AC0~1.SCA")) returned 1
	[0198.215] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7f10c44, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa3b6f78c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xa3b6f78c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.People_10.0.2840.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI2350~1.0_X")) returned 1
	[0198.215] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7e52063, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa3b6f78c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xa3b6f78c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.People_2015.1012.106.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MI82F5~1.0_N")) returned 1
	[0198.215] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe448a0df, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa46e8c39, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xa46e8c39, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SkypeApp_3.2.1.0_neutral_~_kzf8qxf38zg5c", cAlternateFileName="MI8A06~1.0_N")) returned 1
	[0198.215] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4843d57, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa46e8c39, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xa46e8c39, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SkypeApp_3.2.1.0_x86__kzf8qxf38zg5c", cAlternateFileName="MIFE1F~1.0_X")) returned 1
	[0198.215] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6660fae, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x9143e393, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x9143e393, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VCLibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe", cAlternateFileName="MICROS~1.1_X")) returned 1
	[0198.215] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf671fcb8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x91143404, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x91143404, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VCLibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe", cAlternateFileName="MICROS~2.1_X")) returned 1
	[0198.215] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9a2c6d6, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x9280fbf2, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x9280fbf2, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VCLibs.140.00_14.0.22929.0_x64__8wekyb3d8bbwe", cAlternateFileName="MIBD25~1.0_X")) returned 1
	[0198.215] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9aeb505, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x924a261b, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x924a261b, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VCLibs.140.00_14.0.22929.0_x86__8wekyb3d8bbwe", cAlternateFileName="MI02C5~1.0_X")) returned 1
	[0198.215] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x199d08db, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0xa5d8f1f1, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xa5d8f1f1, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.Photos_15.1001.16470.0_neutral_split.scale-100_8wekyb3d8bbwe", cAlternateFileName="MI313A~1.SCA")) returned 1
	[0198.216] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17eb1939, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0xa5d68de8, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xa5d68de8, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.Photos_15.1001.16470.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI2703~1.0_X")) returned 1
	[0198.216] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17e3f2ab, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0xa5d68de8, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xa5d68de8, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.Photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MIF55B~1.0_N")) returned 1
	[0198.216] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8ae0062, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa6f24701, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xa6f24701, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsAlarms_10.1510.12020.0_neutral_split.scale-100_8wekyb3d8bbwe", cAlternateFileName="MI2CED~1.SCA")) returned 1
	[0198.216] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8667b09, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa6f24701, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xa6f24701, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsAlarms_10.1510.12020.0_x64__8wekyb3d8bbwe", cAlternateFileName="MIDE24~1.0_X")) returned 1
	[0198.216] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe861b5c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa6efe350, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xa6efe350, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsAlarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MIBFF2~1.0_N")) returned 1
	[0198.216] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed47d8c2, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa7e314ea, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xa7e314ea, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsCalculator_10.1510.9020.0_neutral_split.scale-100_8wekyb3d8bbwe", cAlternateFileName="MIBC60~1.SCA")) returned 1
	[0198.217] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecc4b5d0, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa7e0b217, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xa7e0b217, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsCalculator_10.1510.9020.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI55E9~1.0_X")) returned 1
	[0198.217] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeca0f192, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa7e0b217, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xa7e0b217, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsCalculator_2015.1009.20.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MID846~1.0_N")) returned 1
	[0198.217] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x259e618e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0xa8c592f0, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xa8c592f0, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsCamera_2015.1071.40.0_neutral_split.scale-100_8wekyb3d8bbwe", cAlternateFileName="MI2220~1.SCA")) returned 1
	[0198.217] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x247b80cf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0xa8c592f0, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xa8c592f0, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsCamera_2015.1071.40.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MI273B~1.0_N")) returned 1
	[0198.217] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24876a76, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0xa8c592f0, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xa8c592f0, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsCamera_2015.1071.40.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI7DFD~1.0_X")) returned 1
	[0198.217] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb0577601, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xab8c0ebb, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xab8c0ebb, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.windowscommunicationsapps_17.6308.42271.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI7C55~1.0_X")) returned 1
	[0198.217] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb03fa0c5, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xab8c0ebb, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xab8c0ebb, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.windowscommunicationsapps_2015.6308.42271.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MI01F4~1.0_N")) returned 1
	[0198.217] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f4b74dc, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0xad0261db, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xad0261db, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsMaps_4.1509.50911.0_neutral_split.scale-100_8wekyb3d8bbwe", cAlternateFileName="MIFFEE~1.SCA")) returned 1
	[0198.217] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1decf8b1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0xacfffe15, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xacfffe15, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsMaps_4.1509.50911.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MIC8BA~1.0_N")) returned 1
	[0198.217] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e74dedb, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0xad0261db, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xad0261db, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsMaps_4.1509.50911.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI2862~1.0_X")) returned 1
	[0198.218] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3450c739, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0xae7fdabd, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xae7fdabd, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsPhone_10.1510.9010.0_x64__8wekyb3d8bbwe", cAlternateFileName="MID9F7~1.0_X")) returned 1
	[0198.218] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342f688a, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0xae7d77ba, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xae7d77ba, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsPhone_2015.1009.10.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MI99D1~1.0_N")) returned 1
	[0198.218] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17b264d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xaf698066, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xaf698066, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsSoundRecorder_10.1510.12110.0_x64__8wekyb3d8bbwe", cAlternateFileName="MIC5B1~1.0_X")) returned 1
	[0198.218] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf16a7835, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xaf671e32, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xaf671e32, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsSoundRecorder_2015.1012.110.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MI87DD~1.0_N")) returned 1
	[0198.218] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab4ff4b5, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xb0b9ac11, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xb0b9ac11, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsStore_2015.10.13.0_neutral_split.scale-100_8wekyb3d8bbwe", cAlternateFileName="MI2257~1.SCA")) returned 1
	[0198.218] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9d016c5, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xb0b9ac11, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xb0b9ac11, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsStore_2015.10.13.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI0D6C~1.0_X")) returned 1
	[0198.218] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9482e97, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xb0b9ac11, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xb0b9ac11, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsStore_2015.1013.14.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MI4019~1.0_N")) returned 1
	[0198.218] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadc5633, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0xb285d174, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xb285d174, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.XboxApp_2015.930.526.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MIEF7F~1.0_N")) returned 1
	[0198.219] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd911fa, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0xb28834e8, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xb28834e8, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.XboxApp_9.9.30030.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI1F43~1.0_X")) returned 1
	[0198.219] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd973b40a, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xb4781bbb, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xb4781bbb, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ZuneMusic_2019.6.13251.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MI85B7~1.0_N")) returned 1
	[0198.219] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdbafedb6, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xb47a7f7b, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xb47a7f7b, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ZuneMusic_3.6.13251.0_neutral_resources.scale-140_8wekyb3d8bbwe", cAlternateFileName="MI65C9~1.SCA")) returned 1
	[0198.219] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd97878c3, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xb47a7f7b, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xb47a7f7b, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ZuneMusic_3.6.13251.0_x64__8wekyb3d8bbwe", cAlternateFileName="MIF2F7~1.0_X")) returned 1
	[0198.219] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdfb85373, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xb5e4e4f0, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xb5e4e4f0, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ZuneVideo_2019.6.13251.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MI1C14~1.0_N")) returned 1
	[0198.219] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe103be21, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xb5e74740, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xb5e74740, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ZuneVideo_3.6.13251.0_neutral_resources.scale-150_8wekyb3d8bbwe", cAlternateFileName="MI4EC1~1.SCA")) returned 1
	[0198.219] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdfbf7ad1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xb5e74740, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xb5e74740, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ZuneVideo_3.6.13251.0_x64__8wekyb3d8bbwe", cAlternateFileName="MI82C6~1.0_X")) returned 1
	[0198.219] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0198.219] FindClose (in: hFindFile=0x7a0068 | out: hFindFile=0x7a0068) returned 1
	[0198.219] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Deleted" (normalized: "c:\\program files\\windowsapps\\deleted"), fInfoLevelId=0x0, lpFileInformation=0x1251e918 | out: lpFileInformation=0x1251e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc47584, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc47584, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0198.220] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Deleted" (normalized: "c:\\program files\\windowsapps\\deleted"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0198.220] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Deleted\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc47584, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc47584, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fe68
	[0198.220] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc47584, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc47584, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.220] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0198.220] FindClose (in: hFindFile=0x79fe68 | out: hFindFile=0x79fe68) returned 1
	[0198.221] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe"), fInfoLevelId=0x0, lpFileInformation=0x1251e968 | out: lpFileInformation=0x1251e968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29f0b1bb, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x936d064c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x936d064c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0198.221] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0198.221] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29f0b1bb, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x936d064c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x936d064c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9e8
	[0198.226] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29f0b1bb, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x936d064c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x936d064c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.226] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a03c50a, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a03c50a, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a03c50a, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x154, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1
	[0198.226] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29f0b1bb, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x29f313ff, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x29f313ff, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1
	[0198.226] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a03c50a, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a03c50a, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a06274a, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x296b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1
	[0198.226] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x936d064c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x936d064c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x936d064c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1
	[0198.226] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0198.226] FindClose (in: hFindFile=0x79f9e8 | out: hFindFile=0x79f9e8) returned 1
	[0198.227] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml"), fInfoLevelId=0x0, lpFileInformation=0x1251eaf8 | out: lpFileInformation=0x1251eaf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a03c50a, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a03c50a, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a03c50a, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x154)) returned 1
	[0198.236] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\appxmetadata"), fInfoLevelId=0x0, lpFileInformation=0x1251eb48 | out: lpFileInformation=0x1251eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29f0b1bb, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x29f313ff, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x29f313ff, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0198.236] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\appxmetadata"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0198.236] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29f0b1bb, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x29f313ff, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x29f313ff, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffe8
	[0198.236] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29f0b1bb, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x29f313ff, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x29f313ff, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.236] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29f313ff, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x29f313ff, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x29f313ff, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3ff1, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBundleManifest.xml", cAlternateFileName="")) returned 1
	[0198.237] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0198.237] FindClose (in: hFindFile=0x79ffe8 | out: hFindFile=0x79ffe8) returned 1
	[0198.237] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\appxbundlemanifest.xml"), fInfoLevelId=0x0, lpFileInformation=0x1251ebe8 | out: lpFileInformation=0x1251ebe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29f313ff, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x29f313ff, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x29f313ff, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3ff1)) returned 1
	[0198.240] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x"), fInfoLevelId=0x0, lpFileInformation=0x1251ec38 | out: lpFileInformation=0x1251ec38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a03c50a, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a03c50a, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a06274a, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x296b)) returned 1
	[0198.240] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata"), fInfoLevelId=0x0, lpFileInformation=0x1251ec88 | out: lpFileInformation=0x1251ec88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x936d064c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x936d064c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x936d064c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0198.244] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0198.244] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x936d064c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x936d064c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x936d064c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0068
	[0198.244] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x936d064c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x936d064c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x936d064c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.244] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0198.245] FindClose (in: hFindFile=0x7a0068 | out: hFindFile=0x7a0068) returned 1
	[0198.245] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe"), fInfoLevelId=0x0, lpFileInformation=0x1251ecd8 | out: lpFileInformation=0x1251ecd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x936d064c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x936d064c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0198.247] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0198.247] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x936d064c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x936d064c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fb68
	[0198.251] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x936d064c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x936d064c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.252] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0ae96d, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0ae96d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x8d7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1
	[0198.252] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0ae96d, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0ae96d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x11b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1
	[0198.252] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0ae96d, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0ae96d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1
	[0198.252] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0ae96d, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0ae96d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2992, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1
	[0198.252] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3f6071, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3f6071, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1
	[0198.252] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3f6071, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3f6071, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a6584f3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x84f800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Builder3D.exe", cAlternateFileName="")) returned 1
	[0198.252] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a6584f3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a6584f3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a6584f3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common", cAlternateFileName="")) returned 1
	[0198.252] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a6584f3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a6584f3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a6584f3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2fe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lib3mfUAP.dll", cAlternateFileName="")) returned 1
	[0198.252] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x936d064c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x936d064c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x936d064c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1
	[0198.252] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a99fbb2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a99fbb2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a9c5d29, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x51280, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 1
	[0198.252] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0198.252] FindClose (in: hFindFile=0x79fb68 | out: hFindFile=0x79fb68) returned 1
	[0198.254] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\appxblockmap.xml"), fInfoLevelId=0x0, lpFileInformation=0x1251f098 | out: lpFileInformation=0x1251f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0ae96d, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0ae96d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x8d7c)) returned 1
	[0198.255] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\appxmanifest.xml"), fInfoLevelId=0x0, lpFileInformation=0x1251f0e8 | out: lpFileInformation=0x1251f0e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0ae96d, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0ae96d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x11b3)) returned 1
	[0198.255] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\AppxMetadata" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\appxmetadata"), fInfoLevelId=0x0, lpFileInformation=0x1251f138 | out: lpFileInformation=0x1251f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0ae96d, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0ae96d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0198.257] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\AppxMetadata" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\appxmetadata"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0198.257] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0ae96d, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0ae96d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fe68
	[0198.257] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0ae96d, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0ae96d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.257] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0ae96d, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0ae96d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2a8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 1
	[0198.257] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0198.257] FindClose (in: hFindFile=0x79fe68 | out: hFindFile=0x79fe68) returned 1
	[0198.258] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat"), fInfoLevelId=0x0, lpFileInformation=0x1251f1d8 | out: lpFileInformation=0x1251f1d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0ae96d, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0ae96d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2a8b)) returned 1
	[0198.258] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\appxsignature.p7x"), fInfoLevelId=0x0, lpFileInformation=0x1251f228 | out: lpFileInformation=0x1251f228*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0ae96d, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0ae96d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2992)) returned 1
	[0198.258] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets"), fInfoLevelId=0x0, lpFileInformation=0x1251f278 | out: lpFileInformation=0x1251f278*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3f6071, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3f6071, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0198.258] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0198.259] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3f6071, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3f6071, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fea8
	[0198.263] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3f6071, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3f6071, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.263] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0ae96d, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0ae96d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x7046, dwReserved0=0x0, dwReserved1=0x0, cFileName="3mf.ico", cAlternateFileName="")) returned 1
	[0198.263] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a205ee1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a205ee1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Catalog", cAlternateFileName="")) returned 1
	[0198.263] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Contrast", cAlternateFileName="")) returned 1
	[0198.263] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1455, dwReserved0=0x0, dwReserved1=0x0, cFileName="CubeTile_contrast-black.png", cAlternateFileName="")) returned 1
	[0198.263] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x139e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CubeTile_contrast-white.png", cAlternateFileName="")) returned 1
	[0198.263] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="DarkBlue.png", cAlternateFileName="")) returned 1
	[0198.263] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EmbossBitmaps", cAlternateFileName="EMBOSS~1")) returned 1
	[0198.264] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xe5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="HelpIcon_contrast-black.png", cAlternateFileName="")) returned 1
	[0198.264] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xea1, dwReserved0=0x0, dwReserved1=0x0, cFileName="HelpIcon_contrast-white.png", cAlternateFileName="")) returned 1
	[0198.264] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="LightBlue.png", cAlternateFileName="")) returned 1
	[0198.264] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="LoadIconRTL_contrast-black.png", cAlternateFileName="")) returned 1
	[0198.264] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd72, dwReserved0=0x0, dwReserved1=0x0, cFileName="LoadIconRTL_contrast-white.png", cAlternateFileName="")) returned 1
	[0198.264] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd84, dwReserved0=0x0, dwReserved1=0x0, cFileName="LoadIcon_contrast-black.png", cAlternateFileName="")) returned 1
	[0198.264] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LoadIcon_contrast-white.png", cAlternateFileName="")) returned 1
	[0198.264] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="MediumBlue.png", cAlternateFileName="")) returned 1
	[0198.264] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3f6071, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3f6071, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3f6071, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd09, dwReserved0=0x0, dwReserved1=0x0, cFileName="ScanIcon_contrast-black.png", cAlternateFileName="")) returned 1
	[0198.264] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3f6071, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3f6071, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3f6071, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd13, dwReserved0=0x0, dwReserved1=0x0, cFileName="ScanIcon_contrast-white.png", cAlternateFileName="")) returned 1
	[0198.264] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0198.264] FindClose (in: hFindFile=0x79fea8 | out: hFindFile=0x79fea8) returned 1
	[0198.266] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\3mf.ico" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\3mf.ico"), fInfoLevelId=0x0, lpFileInformation=0x1251f818 | out: lpFileInformation=0x1251f818*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0ae96d, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0ae96d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x7046)) returned 1
	[0198.269] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog"), fInfoLevelId=0x0, lpFileInformation=0x1251f868 | out: lpFileInformation=0x1251f868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a205ee1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a205ee1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0198.269] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0198.269] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a205ee1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a205ee1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffe8
	[0198.274] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a205ee1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a205ee1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.274] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0ae96d, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0ae96d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2f08e, dwReserved0=0x0, dwReserved1=0x0, cFileName="bulldozer.3mf", cAlternateFileName="")) returned 1
	[0198.274] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0d4e75, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0d4e75, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0d4e75, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1e17, dwReserved0=0x0, dwReserved1=0x0, cFileName="Catalog.json", cAlternateFileName="")) returned 1
	[0198.274] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0d4e75, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0d4e75, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0d4e75, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x26a27, dwReserved0=0x0, dwReserved1=0x0, cFileName="chess.3mf", cAlternateFileName="")) returned 1
	[0198.274] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0d4e75, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0d4e75, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0d4e75, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2e48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="giftbox.3mf", cAlternateFileName="")) returned 1
	[0198.274] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0d4e75, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0d4e75, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0fb0a6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x4ab3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="gimblekeychain.3mf", cAlternateFileName="")) returned 1
	[0198.274] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0fb0a6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0fb0a6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0fb0a6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcf95, dwReserved0=0x0, dwReserved1=0x0, cFileName="keychain.3mf", cAlternateFileName="")) returned 1
	[0198.274] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0fb0a6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0fb0a6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a121327, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="paperboat.3mf", cAlternateFileName="")) returned 1
	[0198.274] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a121327, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a121327, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a121327, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1d6ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="pencilbox.3mf", cAlternateFileName="")) returned 1
	[0198.274] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a121327, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a121327, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a121327, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x59ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="shape_cone.3mf", cAlternateFileName="")) returned 1
	[0198.274] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a121327, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a121327, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a121327, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2377, dwReserved0=0x0, dwReserved1=0x0, cFileName="shape_cube.3mf", cAlternateFileName="")) returned 1
	[0198.274] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a121327, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a121327, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a121327, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x58de, dwReserved0=0x0, dwReserved1=0x0, cFileName="shape_cylinder.3mf", cAlternateFileName="")) returned 1
	[0198.274] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a121327, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a121327, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a121327, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x202f, dwReserved0=0x0, dwReserved1=0x0, cFileName="shape_hexagon.3mf", cAlternateFileName="")) returned 1
	[0198.275] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a14757e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a14757e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a14757e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1271, dwReserved0=0x0, dwReserved1=0x0, cFileName="shape_pyramid.3mf", cAlternateFileName="")) returned 1
	[0198.275] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a14757e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a14757e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a14757e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x214c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="shape_sphere.3mf", cAlternateFileName="")) returned 1
	[0198.275] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a14757e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a14757e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a16d55e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3be62, dwReserved0=0x0, dwReserved1=0x0, cFileName="shape_torus.3mf", cAlternateFileName="")) returned 1
	[0198.275] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a16d55e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a16d55e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a16d55e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x173f, dwReserved0=0x0, dwReserved1=0x0, cFileName="shape_wedge.3mf", cAlternateFileName="")) returned 1
	[0198.275] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a16d55e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a16d55e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a16d55e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x33976, dwReserved0=0x0, dwReserved1=0x0, cFileName="shuttle.3mf", cAlternateFileName="")) returned 1
	[0198.275] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a16d55e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a16d55e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a1937b9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x346af, dwReserved0=0x0, dwReserved1=0x0, cFileName="spookytree.3mf", cAlternateFileName="")) returned 1
	[0198.275] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1937b9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a1937b9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a1937b9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x37936, dwReserved0=0x0, dwReserved1=0x0, cFileName="traincarcaboose.3mf", cAlternateFileName="")) returned 1
	[0198.275] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1937b9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a1937b9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a1937b9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x4acbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="trainengine.3mf", cAlternateFileName="")) returned 1
	[0198.275] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1937b9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a1937b9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a1b9a1f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x295d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="traintrackconnector.3mf", cAlternateFileName="")) returned 1
	[0198.275] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1b9a1f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a1b9a1f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a1b9a1f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2b16d, dwReserved0=0x0, dwReserved1=0x0, cFileName="traintrackleftturn.3mf", cAlternateFileName="")) returned 1
	[0198.275] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1b9a1f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a1b9a1f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a1b9a1f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x23e72, dwReserved0=0x0, dwReserved1=0x0, cFileName="traintrackrightturn.3mf", cAlternateFileName="")) returned 1
	[0198.275] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1dfc7e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a1dfc7e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a1dfc7e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x39d3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="traintracksplit.3mf", cAlternateFileName="")) returned 1
	[0198.276] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1dfc7e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a1dfc7e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a1dfc7e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1f7ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="traintrackstraight.3mf", cAlternateFileName="")) returned 1
	[0198.276] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1dfc7e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a1dfc7e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a205ee1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x38dfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="trophycylinder.3mf", cAlternateFileName="")) returned 1
	[0198.276] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a205ee1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a205ee1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a205ee1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x48280, dwReserved0=0x0, dwReserved1=0x0, cFileName="trophystar.3mf", cAlternateFileName="")) returned 1
	[0198.276] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a205ee1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a205ee1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1cb0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="windmill.3mf", cAlternateFileName="")) returned 1
	[0198.276] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0198.276] FindClose (in: hFindFile=0x79ffe8 | out: hFindFile=0x79ffe8) returned 1
	[0198.281] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\Catalog.json" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\catalog.json"), fInfoLevelId=0x0, lpFileInformation=0x12532198 | out: lpFileInformation=0x12532198*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0d4e75, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0d4e75, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0d4e75, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1e17)) returned 1
	[0198.301] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\bulldozer.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\bulldozer.3mf"), fInfoLevelId=0x0, lpFileInformation=0x125321e8 | out: lpFileInformation=0x125321e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0ae96d, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0ae96d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2f08e)) returned 1
	[0198.302] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\chess.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\chess.3mf"), fInfoLevelId=0x0, lpFileInformation=0x12532238 | out: lpFileInformation=0x12532238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0d4e75, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0d4e75, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0d4e75, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x26a27)) returned 1
	[0198.307] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\giftbox.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\giftbox.3mf"), fInfoLevelId=0x0, lpFileInformation=0x12532288 | out: lpFileInformation=0x12532288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0d4e75, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0d4e75, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0d4e75, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2e48e)) returned 1
	[0198.307] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\gimblekeychain.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\gimblekeychain.3mf"), fInfoLevelId=0x0, lpFileInformation=0x125322d8 | out: lpFileInformation=0x125322d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0d4e75, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0d4e75, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0fb0a6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x4ab3d)) returned 1
	[0198.308] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\keychain.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\keychain.3mf"), fInfoLevelId=0x0, lpFileInformation=0x12532328 | out: lpFileInformation=0x12532328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0fb0a6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0fb0a6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0fb0a6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcf95)) returned 1
	[0198.308] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\paperboat.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\paperboat.3mf"), fInfoLevelId=0x0, lpFileInformation=0x12532378 | out: lpFileInformation=0x12532378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0fb0a6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0fb0a6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a121327, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0e2)) returned 1
	[0198.308] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\pencilbox.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\pencilbox.3mf"), fInfoLevelId=0x0, lpFileInformation=0x125323c8 | out: lpFileInformation=0x125323c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a121327, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a121327, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a121327, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1d6ce)) returned 1
	[0198.377] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_cone.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_cone.3mf"), fInfoLevelId=0x0, lpFileInformation=0x12532418 | out: lpFileInformation=0x12532418*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a121327, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a121327, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a121327, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x59ff)) returned 1
	[0198.378] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_cube.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_cube.3mf"), fInfoLevelId=0x0, lpFileInformation=0x12532468 | out: lpFileInformation=0x12532468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a121327, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a121327, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a121327, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2377)) returned 1
	[0198.378] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_cylinder.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_cylinder.3mf"), fInfoLevelId=0x0, lpFileInformation=0x125324b8 | out: lpFileInformation=0x125324b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a121327, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a121327, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a121327, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x58de)) returned 1
	[0198.378] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_hexagon.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_hexagon.3mf"), fInfoLevelId=0x0, lpFileInformation=0x12532508 | out: lpFileInformation=0x12532508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a121327, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a121327, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a121327, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x202f)) returned 1
	[0198.379] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_pyramid.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_pyramid.3mf"), fInfoLevelId=0x0, lpFileInformation=0x12532558 | out: lpFileInformation=0x12532558*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a14757e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a14757e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a14757e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1271)) returned 1
	[0198.379] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_sphere.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_sphere.3mf"), fInfoLevelId=0x0, lpFileInformation=0x125325a8 | out: lpFileInformation=0x125325a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a14757e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a14757e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a14757e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x214c7)) returned 1
	[0198.381] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_torus.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_torus.3mf"), fInfoLevelId=0x0, lpFileInformation=0x125325f8 | out: lpFileInformation=0x125325f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a14757e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a14757e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a16d55e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3be62)) returned 1
	[0198.381] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_wedge.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_wedge.3mf"), fInfoLevelId=0x0, lpFileInformation=0x12532648 | out: lpFileInformation=0x12532648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a16d55e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a16d55e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a16d55e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x173f)) returned 1
	[0198.381] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shuttle.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shuttle.3mf"), fInfoLevelId=0x0, lpFileInformation=0x12532698 | out: lpFileInformation=0x12532698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a16d55e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a16d55e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a16d55e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x33976)) returned 1
	[0198.382] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\spookytree.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\spookytree.3mf"), fInfoLevelId=0x0, lpFileInformation=0x125326e8 | out: lpFileInformation=0x125326e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a16d55e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a16d55e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a1937b9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x346af)) returned 1
	[0198.385] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traincarcaboose.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\traincarcaboose.3mf"), fInfoLevelId=0x0, lpFileInformation=0x12532738 | out: lpFileInformation=0x12532738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1937b9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a1937b9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a1937b9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x37936)) returned 1
	[0198.386] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\trainengine.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\trainengine.3mf"), fInfoLevelId=0x0, lpFileInformation=0x12532788 | out: lpFileInformation=0x12532788*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1937b9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a1937b9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a1937b9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x4acbb)) returned 1
	[0198.392] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traintrackconnector.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\traintrackconnector.3mf"), fInfoLevelId=0x0, lpFileInformation=0x125327d8 | out: lpFileInformation=0x125327d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1937b9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a1937b9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a1b9a1f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x295d0)) returned 1
	[0198.392] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traintrackleftturn.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\traintrackleftturn.3mf"), fInfoLevelId=0x0, lpFileInformation=0x12532828 | out: lpFileInformation=0x12532828*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1b9a1f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a1b9a1f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a1b9a1f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2b16d)) returned 1
	[0198.392] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traintrackrightturn.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\traintrackrightturn.3mf"), fInfoLevelId=0x0, lpFileInformation=0x12532878 | out: lpFileInformation=0x12532878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1b9a1f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a1b9a1f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a1b9a1f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x23e72)) returned 1
	[0198.393] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traintracksplit.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\traintracksplit.3mf"), fInfoLevelId=0x0, lpFileInformation=0x125328c8 | out: lpFileInformation=0x125328c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1dfc7e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a1dfc7e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a1dfc7e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x39d3a)) returned 1
	[0198.396] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traintrackstraight.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\traintrackstraight.3mf"), fInfoLevelId=0x0, lpFileInformation=0x12532918 | out: lpFileInformation=0x12532918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1dfc7e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a1dfc7e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a1dfc7e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1f7ca)) returned 1
	[0198.396] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\trophycylinder.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\trophycylinder.3mf"), fInfoLevelId=0x0, lpFileInformation=0x12532968 | out: lpFileInformation=0x12532968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1dfc7e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a1dfc7e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a205ee1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x38dfd)) returned 1
	[0198.396] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\trophystar.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\trophystar.3mf"), fInfoLevelId=0x0, lpFileInformation=0x125329b8 | out: lpFileInformation=0x125329b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a205ee1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a205ee1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a205ee1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x48280)) returned 1
	[0198.398] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\windmill.3mf" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\windmill.3mf"), fInfoLevelId=0x0, lpFileInformation=0x12532a08 | out: lpFileInformation=0x12532a08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a205ee1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a205ee1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1cb0a)) returned 1
	[0198.398] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast"), fInfoLevelId=0x0, lpFileInformation=0x12532a58 | out: lpFileInformation=0x12532a58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0198.401] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0198.401] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffa8
	[0198.406] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.406] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a22c330, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1530, dwReserved0=0x0, dwReserved1=0x0, cFileName="BuilderLogo.png", cAlternateFileName="")) returned 1
	[0198.406] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Contrast-black", cAlternateFileName="CONTRA~1")) returned 1
	[0198.406] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 1
	[0198.406] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xbe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icon.targetsize-16.png", cAlternateFileName="")) returned 1
	[0198.406] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x16f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icon.targetsize-256.png", cAlternateFileName="")) returned 1
	[0198.406] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcae, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icon.targetsize-32.png", cAlternateFileName="")) returned 1
	[0198.406] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icon.targetsize-48.png", cAlternateFileName="")) returned 1
	[0198.406] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x108d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logo.scale-100.png", cAlternateFileName="")) returned 1
	[0198.406] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xf68, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logo.scale-80.png", cAlternateFileName="")) returned 1
	[0198.406] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc45, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.scale-100.png", cAlternateFileName="")) returned 1
	[0198.406] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.scale-80.png", cAlternateFileName="")) returned 1
	[0198.406] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.targetsize-16.png", cAlternateFileName="")) returned 1
	[0198.406] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x148e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.targetsize-256.png", cAlternateFileName="")) returned 1
	[0198.406] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc71, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.targetsize-32.png", cAlternateFileName="")) returned 1
	[0198.406] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd03, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.targetsize-48.png", cAlternateFileName="")) returned 1
	[0198.406] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1d49, dwReserved0=0x0, dwReserved1=0x0, cFileName="SplashScreen.scale-100.png", cAlternateFileName="")) returned 1
	[0198.407] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x165a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square310x310Logo.scale-100.png", cAlternateFileName="")) returned 1
	[0198.407] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x13d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square310x310Logo.scale-80.png", cAlternateFileName="")) returned 1
	[0198.407] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xdc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square70x70Logo.scale-100.png", cAlternateFileName="")) returned 1
	[0198.407] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd39, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square70x70Logo.scale-80.png", cAlternateFileName="")) returned 1
	[0198.407] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd19, dwReserved0=0x0, dwReserved1=0x0, cFileName="StoreLogo.scale-100.png", cAlternateFileName="")) returned 1
	[0198.407] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x112b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wide310x150Logo.scale-100.png", cAlternateFileName="")) returned 1
	[0198.407] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xfd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wide310x150Logo.scale-80.png", cAlternateFileName="")) returned 1
	[0198.407] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0198.407] FindClose (in: hFindFile=0x79ffa8 | out: hFindFile=0x79ffa8) returned 1
	[0198.408] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\BuilderLogo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\builderlogo.png"), fInfoLevelId=0x0, lpFileInformation=0x125331d8 | out: lpFileInformation=0x125331d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a22c330, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1530)) returned 1
	[0198.410] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black"), fInfoLevelId=0x0, lpFileInformation=0x12533228 | out: lpFileInformation=0x12533228*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0198.410] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0198.410] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fd68
	[0198.420] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.420] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a22c330, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1461, dwReserved0=0x0, dwReserved1=0x0, cFileName="BuilderLogo.png", cAlternateFileName="")) returned 1
	[0198.420] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a22c330, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xbab, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icon.targetsize-16.png", cAlternateFileName="")) returned 1
	[0198.420] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a22c330, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x153c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icon.targetsize-256.png", cAlternateFileName="")) returned 1
	[0198.420] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a22c330, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icon.targetsize-32.png", cAlternateFileName="")) returned 1
	[0198.420] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a22c330, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd08, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icon.targetsize-48.png", cAlternateFileName="")) returned 1
	[0198.420] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a22c330, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1026, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logo.scale-100.png", cAlternateFileName="")) returned 1
	[0198.420] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a22c330, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xebc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logo.scale-80.png", cAlternateFileName="")) returned 1
	[0198.420] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc04, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.scale-100.png", cAlternateFileName="")) returned 1
	[0198.420] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xbfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.scale-80.png", cAlternateFileName="")) returned 1
	[0198.420] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xb8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.targetsize-16.png", cAlternateFileName="")) returned 1
	[0198.420] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x13bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.targetsize-256.png", cAlternateFileName="")) returned 1
	[0198.420] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc35, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.targetsize-32.png", cAlternateFileName="")) returned 1
	[0198.421] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.targetsize-48.png", cAlternateFileName="")) returned 1
	[0198.421] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x27a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SplashScreen.scale-100.png", cAlternateFileName="")) returned 1
	[0198.421] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x153d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square310x310Logo.scale-100.png", cAlternateFileName="")) returned 1
	[0198.421] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x12d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square310x310Logo.scale-80.png", cAlternateFileName="")) returned 1
	[0198.421] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square70x70Logo.scale-100.png", cAlternateFileName="")) returned 1
	[0198.421] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square70x70Logo.scale-80.png", cAlternateFileName="")) returned 1
	[0198.421] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xccb, dwReserved0=0x0, dwReserved1=0x0, cFileName="StoreLogo.scale-100.png", cAlternateFileName="")) returned 1
	[0198.421] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x10b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wide310x150Logo.scale-100.png", cAlternateFileName="")) returned 1
	[0198.421] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xf2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wide310x150Logo.scale-80.png", cAlternateFileName="")) returned 1
	[0198.421] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0198.421] FindClose (in: hFindFile=0x79fd68 | out: hFindFile=0x79fd68) returned 1
	[0198.422] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\BuilderLogo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\builderlogo.png"), fInfoLevelId=0x0, lpFileInformation=0x12533908 | out: lpFileInformation=0x12533908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a22c330, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1461)) returned 1
	[0198.426] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Icon.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\icon.targetsize-16.png"), fInfoLevelId=0x0, lpFileInformation=0x12533958 | out: lpFileInformation=0x12533958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a22c330, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xbab)) returned 1
	[0198.426] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Icon.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\icon.targetsize-256.png"), fInfoLevelId=0x0, lpFileInformation=0x125339a8 | out: lpFileInformation=0x125339a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a22c330, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x153c)) returned 1
	[0198.435] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Icon.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\icon.targetsize-32.png"), fInfoLevelId=0x0, lpFileInformation=0x125339f8 | out: lpFileInformation=0x125339f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a22c330, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc6c)) returned 1
	[0198.435] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Icon.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\icon.targetsize-48.png"), fInfoLevelId=0x0, lpFileInformation=0x12533a48 | out: lpFileInformation=0x12533a48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a22c330, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd08)) returned 1
	[0198.436] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\logo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x12533a98 | out: lpFileInformation=0x12533a98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a22c330, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1026)) returned 1
	[0198.436] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Logo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\logo.scale-80.png"), fInfoLevelId=0x0, lpFileInformation=0x12533ae8 | out: lpFileInformation=0x12533ae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a22c330, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xebc)) returned 1
	[0198.451] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\SmallLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\smalllogo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x12533b38 | out: lpFileInformation=0x12533b38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc04)) returned 1
	[0198.452] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\SmallLogo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\smalllogo.scale-80.png"), fInfoLevelId=0x0, lpFileInformation=0x12533b88 | out: lpFileInformation=0x12533b88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xbfc)) returned 1
	[0198.452] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\SmallLogo.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\smalllogo.targetsize-16.png"), fInfoLevelId=0x0, lpFileInformation=0x12533bd8 | out: lpFileInformation=0x12533bd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xb8f)) returned 1
	[0198.452] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\SmallLogo.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\smalllogo.targetsize-256.png"), fInfoLevelId=0x0, lpFileInformation=0x12533c28 | out: lpFileInformation=0x12533c28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x13bc)) returned 1
	[0198.511] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\SmallLogo.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\smalllogo.targetsize-32.png"), fInfoLevelId=0x0, lpFileInformation=0x12533c78 | out: lpFileInformation=0x12533c78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc35)) returned 1
	[0198.511] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\SmallLogo.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\smalllogo.targetsize-48.png"), fInfoLevelId=0x0, lpFileInformation=0x12533cc8 | out: lpFileInformation=0x12533cc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcbd)) returned 1
	[0198.511] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\splashscreen.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x12533d18 | out: lpFileInformation=0x12533d18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x27a0)) returned 1
	[0198.512] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Square310x310Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\square310x310logo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x12533d68 | out: lpFileInformation=0x12533d68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x153d)) returned 1
	[0198.524] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Square310x310Logo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\square310x310logo.scale-80.png"), fInfoLevelId=0x0, lpFileInformation=0x12533db8 | out: lpFileInformation=0x12533db8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x12d5)) returned 1
	[0198.524] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Square70x70Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\square70x70logo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x12533e08 | out: lpFileInformation=0x12533e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd8e)) returned 1
	[0198.528] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Square70x70Logo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\square70x70logo.scale-80.png"), fInfoLevelId=0x0, lpFileInformation=0x12533e58 | out: lpFileInformation=0x12533e58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xce0)) returned 1
	[0198.528] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\StoreLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\storelogo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x12533ea8 | out: lpFileInformation=0x12533ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xccb)) returned 1
	[0198.529] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Wide310x150Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\wide310x150logo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x12533ef8 | out: lpFileInformation=0x12533ef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x10b6)) returned 1
	[0198.532] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Wide310x150Logo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\wide310x150logo.scale-80.png"), fInfoLevelId=0x0, lpFileInformation=0x12533f48 | out: lpFileInformation=0x12533f48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xf2f)) returned 1
	[0198.532] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Icon.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\icon.targetsize-16.png"), fInfoLevelId=0x0, lpFileInformation=0x12533f98 | out: lpFileInformation=0x12533f98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xbe1)) returned 1
	[0198.533] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Icon.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\icon.targetsize-256.png"), fInfoLevelId=0x0, lpFileInformation=0x1243e008 | out: lpFileInformation=0x1243e008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x16f3)) returned 1
	[0198.533] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Icon.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\icon.targetsize-32.png"), fInfoLevelId=0x0, lpFileInformation=0x1243e058 | out: lpFileInformation=0x1243e058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcae)) returned 1
	[0198.533] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Icon.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\icon.targetsize-48.png"), fInfoLevelId=0x0, lpFileInformation=0x1243e0a8 | out: lpFileInformation=0x1243e0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd6e)) returned 1
	[0198.534] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\logo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x1243e0f8 | out: lpFileInformation=0x1243e0f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x108d)) returned 1
	[0198.551] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Logo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\logo.scale-80.png"), fInfoLevelId=0x0, lpFileInformation=0x1243e148 | out: lpFileInformation=0x1243e148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xf68)) returned 1
	[0198.552] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\SmallLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\smalllogo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x1243e198 | out: lpFileInformation=0x1243e198*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc45)) returned 1
	[0198.552] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\SmallLogo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\smalllogo.scale-80.png"), fInfoLevelId=0x0, lpFileInformation=0x1243e1e8 | out: lpFileInformation=0x1243e1e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a)) returned 1
	[0198.552] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\SmallLogo.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\smalllogo.targetsize-16.png"), fInfoLevelId=0x0, lpFileInformation=0x1243e238 | out: lpFileInformation=0x1243e238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xbc4)) returned 1
	[0198.552] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\SmallLogo.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\smalllogo.targetsize-256.png"), fInfoLevelId=0x0, lpFileInformation=0x1243e288 | out: lpFileInformation=0x1243e288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x148e)) returned 1
	[0198.552] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\SmallLogo.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\smalllogo.targetsize-32.png"), fInfoLevelId=0x0, lpFileInformation=0x1243e2d8 | out: lpFileInformation=0x1243e2d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc71)) returned 1
	[0198.552] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\SmallLogo.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\smalllogo.targetsize-48.png"), fInfoLevelId=0x0, lpFileInformation=0x1243e328 | out: lpFileInformation=0x1243e328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd03)) returned 1
	[0198.563] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\splashscreen.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x1243e378 | out: lpFileInformation=0x1243e378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1d49)) returned 1
	[0198.564] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Square310x310Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\square310x310logo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x1243e3c8 | out: lpFileInformation=0x1243e3c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x165a)) returned 1
	[0198.564] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Square310x310Logo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\square310x310logo.scale-80.png"), fInfoLevelId=0x0, lpFileInformation=0x1243e418 | out: lpFileInformation=0x1243e418*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x13d2)) returned 1
	[0198.564] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Square70x70Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\square70x70logo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x1243e468 | out: lpFileInformation=0x1243e468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xdc0)) returned 1
	[0198.566] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Square70x70Logo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\square70x70logo.scale-80.png"), fInfoLevelId=0x0, lpFileInformation=0x1243e4b8 | out: lpFileInformation=0x1243e4b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd39)) returned 1
	[0198.566] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\StoreLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\storelogo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x1243e508 | out: lpFileInformation=0x1243e508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd19)) returned 1
	[0198.566] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Wide310x150Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\wide310x150logo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x1243e558 | out: lpFileInformation=0x1243e558*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x112b)) returned 1
	[0198.567] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Wide310x150Logo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\wide310x150logo.scale-80.png"), fInfoLevelId=0x0, lpFileInformation=0x1243e5a8 | out: lpFileInformation=0x1243e5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xfd5)) returned 1
	[0198.567] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white"), fInfoLevelId=0x0, lpFileInformation=0x1243e5f8 | out: lpFileInformation=0x1243e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0198.567] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0198.567] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fa68
	[0198.573] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.573] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1493, dwReserved0=0x0, dwReserved1=0x0, cFileName="BuilderLogo.png", cAlternateFileName="")) returned 1
	[0198.573] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xb9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icon.targetsize-16.png", cAlternateFileName="")) returned 1
	[0198.573] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1530, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icon.targetsize-256.png", cAlternateFileName="")) returned 1
	[0198.573] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc68, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icon.targetsize-32.png", cAlternateFileName="")) returned 1
	[0198.573] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd12, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icon.targetsize-48.png", cAlternateFileName="")) returned 1
	[0198.573] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1028, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logo.scale-100.png", cAlternateFileName="")) returned 1
	[0198.573] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xecf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logo.scale-80.png", cAlternateFileName="")) returned 1
	[0198.573] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xbf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.scale-100.png", cAlternateFileName="")) returned 1
	[0198.574] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xbed, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.scale-80.png", cAlternateFileName="")) returned 1
	[0198.574] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xb8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.targetsize-16.png", cAlternateFileName="")) returned 1
	[0198.574] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x13b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.targetsize-256.png", cAlternateFileName="")) returned 1
	[0198.574] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.targetsize-32.png", cAlternateFileName="")) returned 1
	[0198.574] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcac, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.targetsize-48.png", cAlternateFileName="")) returned 1
	[0198.574] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1d49, dwReserved0=0x0, dwReserved1=0x0, cFileName="SplashScreen.scale-100.png", cAlternateFileName="")) returned 1
	[0198.574] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x152b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square310x310Logo.scale-100.png", cAlternateFileName="")) returned 1
	[0198.574] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x12dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square310x310Logo.scale-80.png", cAlternateFileName="")) returned 1
	[0198.574] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square70x70Logo.scale-100.png", cAlternateFileName="")) returned 1
	[0198.574] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcde, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square70x70Logo.scale-80.png", cAlternateFileName="")) returned 1
	[0198.574] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="StoreLogo.scale-100.png", cAlternateFileName="")) returned 1
	[0198.574] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x10b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wide310x150Logo.scale-100.png", cAlternateFileName="")) returned 1
	[0198.574] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xf3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wide310x150Logo.scale-80.png", cAlternateFileName="")) returned 1
	[0198.574] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0198.574] FindClose (in: hFindFile=0x79fa68 | out: hFindFile=0x79fa68) returned 1
	[0198.575] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\BuilderLogo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\builderlogo.png"), fInfoLevelId=0x0, lpFileInformation=0x1243ecd8 | out: lpFileInformation=0x1243ecd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1493)) returned 1
	[0198.577] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Icon.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\icon.targetsize-16.png"), fInfoLevelId=0x0, lpFileInformation=0x1243ed28 | out: lpFileInformation=0x1243ed28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xb9c)) returned 1
	[0198.577] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Icon.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\icon.targetsize-256.png"), fInfoLevelId=0x0, lpFileInformation=0x1243ed78 | out: lpFileInformation=0x1243ed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1530)) returned 1
	[0198.579] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Icon.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\icon.targetsize-32.png"), fInfoLevelId=0x0, lpFileInformation=0x1243edc8 | out: lpFileInformation=0x1243edc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc68)) returned 1
	[0198.580] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Icon.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\icon.targetsize-48.png"), fInfoLevelId=0x0, lpFileInformation=0x1243ee18 | out: lpFileInformation=0x1243ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd12)) returned 1
	[0198.580] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\logo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x1243ee68 | out: lpFileInformation=0x1243ee68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1028)) returned 1
	[0198.580] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Logo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\logo.scale-80.png"), fInfoLevelId=0x0, lpFileInformation=0x1243eeb8 | out: lpFileInformation=0x1243eeb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xecf)) returned 1
	[0198.582] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\SmallLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\smalllogo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x1243ef08 | out: lpFileInformation=0x1243ef08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xbf4)) returned 1
	[0198.582] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\SmallLogo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\smalllogo.scale-80.png"), fInfoLevelId=0x0, lpFileInformation=0x1243ef58 | out: lpFileInformation=0x1243ef58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xbed)) returned 1
	[0198.582] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\SmallLogo.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\smalllogo.targetsize-16.png"), fInfoLevelId=0x0, lpFileInformation=0x1243efa8 | out: lpFileInformation=0x1243efa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xb8d)) returned 1
	[0198.583] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\SmallLogo.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\smalllogo.targetsize-256.png"), fInfoLevelId=0x0, lpFileInformation=0x1243eff8 | out: lpFileInformation=0x1243eff8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x13b1)) returned 1
	[0198.586] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\SmallLogo.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\smalllogo.targetsize-32.png"), fInfoLevelId=0x0, lpFileInformation=0x1243f048 | out: lpFileInformation=0x1243f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc2b)) returned 1
	[0198.586] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\SmallLogo.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\smalllogo.targetsize-48.png"), fInfoLevelId=0x0, lpFileInformation=0x1243f098 | out: lpFileInformation=0x1243f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcac)) returned 1
	[0198.587] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\splashscreen.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x1243f0e8 | out: lpFileInformation=0x1243f0e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1d49)) returned 1
	[0198.590] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Square310x310Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\square310x310logo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x1243f138 | out: lpFileInformation=0x1243f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x152b)) returned 1
	[0198.592] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Square310x310Logo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\square310x310logo.scale-80.png"), fInfoLevelId=0x0, lpFileInformation=0x1243f188 | out: lpFileInformation=0x1243f188*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x12dc)) returned 1
	[0198.592] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Square70x70Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\square70x70logo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x1243f1d8 | out: lpFileInformation=0x1243f1d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd8b)) returned 1
	[0198.594] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Square70x70Logo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\square70x70logo.scale-80.png"), fInfoLevelId=0x0, lpFileInformation=0x1243f228 | out: lpFileInformation=0x1243f228*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcde)) returned 1
	[0198.594] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\StoreLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\storelogo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x1243f278 | out: lpFileInformation=0x1243f278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcbf)) returned 1
	[0198.595] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Wide310x150Logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\wide310x150logo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x1243f2c8 | out: lpFileInformation=0x1243f2c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x10b0)) returned 1
	[0198.596] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Wide310x150Logo.scale-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\wide310x150logo.scale-80.png"), fInfoLevelId=0x0, lpFileInformation=0x1243f318 | out: lpFileInformation=0x1243f318*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xf3b)) returned 1
	[0198.596] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\CubeTile_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\cubetile_contrast-black.png"), fInfoLevelId=0x0, lpFileInformation=0x1243f368 | out: lpFileInformation=0x1243f368*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1455)) returned 1
	[0198.600] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\CubeTile_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\cubetile_contrast-white.png"), fInfoLevelId=0x0, lpFileInformation=0x1243f3b8 | out: lpFileInformation=0x1243f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x139e)) returned 1
	[0198.601] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\DarkBlue.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\darkblue.png"), fInfoLevelId=0x0, lpFileInformation=0x1243f408 | out: lpFileInformation=0x1243f408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcbe)) returned 1
	[0198.601] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps"), fInfoLevelId=0x0, lpFileInformation=0x1243f458 | out: lpFileInformation=0x1243f458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0198.601] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0198.601] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fe28
	[0198.604] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.617] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x257a, dwReserved0=0x0, dwReserved1=0x0, cFileName="4-Point Star.png", cAlternateFileName="")) returned 1
	[0198.617] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2a2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="4-Point Star_render.png", cAlternateFileName="")) returned 1
	[0198.617] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="8-Point Star.png", cAlternateFileName="")) returned 1
	[0198.617] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2f76, dwReserved0=0x0, dwReserved1=0x0, cFileName="8-Point Star_render.png", cAlternateFileName="")) returned 1
	[0198.617] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1ca9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Arrow.png", cAlternateFileName="")) returned 1
	[0198.617] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1e41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Arrow_render.png", cAlternateFileName="")) returned 1
	[0198.617] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a337abe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a337abe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a337abe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2f0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chevron.png", cAlternateFileName="")) returned 1
	[0198.617] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a337abe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a337abe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a337abe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2633, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chevron_render.png", cAlternateFileName="")) returned 1
	[0198.617] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a337abe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a337abe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a337abe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x336c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cloud.png", cAlternateFileName="")) returned 1
	[0198.618] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a337abe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a337abe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a337abe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2b7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cloud_render.png", cAlternateFileName="")) returned 1
	[0198.618] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a337abe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a337abe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a337abe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3de9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Donut.png", cAlternateFileName="")) returned 1
	[0198.618] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a337abe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a337abe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a337abe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3b09, dwReserved0=0x0, dwReserved1=0x0, cFileName="Donut_render.png", cAlternateFileName="")) returned 1
	[0198.618] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a337abe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a337abe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a337abe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x24c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Double Wave.png", cAlternateFileName="")) returned 1
	[0198.618] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a337abe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a337abe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a337abe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1f9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Double Wave_render.png", cAlternateFileName="")) returned 1
	[0198.618] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a35d6d3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a35d6d3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a35d6d3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3479, dwReserved0=0x0, dwReserved1=0x0, cFileName="heart.png", cAlternateFileName="")) returned 1
	[0198.618] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a35d6d3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a35d6d3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a35d6d3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2bb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="heart_render.png", cAlternateFileName="")) returned 1
	[0198.618] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a35d6d3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a35d6d3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a35d6d3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3d07, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lightning bolt.png", cAlternateFileName="")) returned 1
	[0198.618] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a35d6d3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a35d6d3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a35d6d3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3324, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lightning bolt_render.png", cAlternateFileName="")) returned 1
	[0198.618] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a35d6d3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a35d6d3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a35d6d3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Moon.png", cAlternateFileName="")) returned 1
	[0198.618] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a35d6d3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a35d6d3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a35d6d3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x28d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Moon_render.png", cAlternateFileName="")) returned 1
	[0198.618] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a35d6d3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a35d6d3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a35d6d3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2d4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multiply.png", cAlternateFileName="")) returned 1
	[0198.618] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a35d6d3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a35d6d3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a35d6d3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2996, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multiply_render.png", cAlternateFileName="")) returned 1
	[0198.618] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x4544, dwReserved0=0x0, dwReserved1=0x0, cFileName="No Symbol.png", cAlternateFileName="")) returned 1
	[0198.618] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x4728, dwReserved0=0x0, dwReserved1=0x0, cFileName="No Symbol_render.png", cAlternateFileName="")) returned 1
	[0198.618] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2962, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oval.png", cAlternateFileName="")) returned 1
	[0198.618] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2a06, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oval_render.png", cAlternateFileName="")) returned 1
	[0198.618] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1384, dwReserved0=0x0, dwReserved1=0x0, cFileName="plus.png", cAlternateFileName="")) returned 1
	[0198.618] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x12c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="plus_render.png", cAlternateFileName="")) returned 1
	[0198.619] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xf7d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rectangle.png", cAlternateFileName="")) returned 1
	[0198.619] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xef7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rectangle_render.png", cAlternateFileName="")) returned 1
	[0198.619] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x17e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rounded  Rectangle.png", cAlternateFileName="")) returned 1
	[0198.619] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3a9bbf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3a9bbf, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3a9bbf, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x18a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rounded  Rectangle_render.png", cAlternateFileName="")) returned 1
	[0198.619] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3a9bbf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3a9bbf, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3a9bbf, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x4921, dwReserved0=0x0, dwReserved1=0x0, cFileName="Smiley face.png", cAlternateFileName="")) returned 1
	[0198.619] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3a9bbf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3a9bbf, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3a9bbf, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x380c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Smiley face_render.png", cAlternateFileName="")) returned 1
	[0198.619] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3a9bbf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3a9bbf, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3a9bbf, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x337b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sun.png", cAlternateFileName="")) returned 1
	[0198.619] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3a9bbf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3a9bbf, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3a9bbf, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3b76, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sun_render.png", cAlternateFileName="")) returned 1
	[0198.620] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3a9bbf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3a9bbf, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3a9bbf, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2e87, dwReserved0=0x0, dwReserved1=0x0, cFileName="Triangle.png", cAlternateFileName="")) returned 1
	[0198.620] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3a9bbf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3a9bbf, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3a9bbf, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2419, dwReserved0=0x0, dwReserved1=0x0, cFileName="Triangle_render.png", cAlternateFileName="")) returned 1
	[0198.620] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3a9bbf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3a9bbf, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x26ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wave.png", cAlternateFileName="")) returned 1
	[0198.620] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x226d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wave_render.png", cAlternateFileName="")) returned 1
	[0198.620] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0198.620] FindClose (in: hFindFile=0x79fe28 | out: hFindFile=0x79fe28) returned 1
	[0198.621] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\4-Point Star.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\4-point star.png"), fInfoLevelId=0x0, lpFileInformation=0x12454148 | out: lpFileInformation=0x12454148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x257a)) returned 1
	[0198.626] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\4-Point Star_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\4-point star_render.png"), fInfoLevelId=0x0, lpFileInformation=0x12454198 | out: lpFileInformation=0x12454198*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2a2b)) returned 1
	[0198.626] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\8-Point Star.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\8-point star.png"), fInfoLevelId=0x0, lpFileInformation=0x124541e8 | out: lpFileInformation=0x124541e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2da8)) returned 1
	[0198.632] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\8-Point Star_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\8-point star_render.png"), fInfoLevelId=0x0, lpFileInformation=0x12454238 | out: lpFileInformation=0x12454238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2f76)) returned 1
	[0198.632] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Arrow.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\arrow.png"), fInfoLevelId=0x0, lpFileInformation=0x12454288 | out: lpFileInformation=0x12454288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1ca9)) returned 1
	[0198.633] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Arrow_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\arrow_render.png"), fInfoLevelId=0x0, lpFileInformation=0x124542d8 | out: lpFileInformation=0x124542d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1e41)) returned 1
	[0198.633] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Chevron.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\chevron.png"), fInfoLevelId=0x0, lpFileInformation=0x12454328 | out: lpFileInformation=0x12454328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a337abe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a337abe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a337abe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2f0a)) returned 1
	[0198.636] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Chevron_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\chevron_render.png"), fInfoLevelId=0x0, lpFileInformation=0x12454378 | out: lpFileInformation=0x12454378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a337abe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a337abe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a337abe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2633)) returned 1
	[0198.637] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Cloud.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\cloud.png"), fInfoLevelId=0x0, lpFileInformation=0x124543c8 | out: lpFileInformation=0x124543c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a337abe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a337abe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a337abe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x336c)) returned 1
	[0198.637] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Cloud_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\cloud_render.png"), fInfoLevelId=0x0, lpFileInformation=0x12454418 | out: lpFileInformation=0x12454418*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a337abe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a337abe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a337abe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2b7f)) returned 1
	[0198.637] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Donut.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\donut.png"), fInfoLevelId=0x0, lpFileInformation=0x12454468 | out: lpFileInformation=0x12454468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a337abe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a337abe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a337abe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3de9)) returned 1
	[0198.642] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Donut_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\donut_render.png"), fInfoLevelId=0x0, lpFileInformation=0x124544b8 | out: lpFileInformation=0x124544b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a337abe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a337abe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a337abe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3b09)) returned 1
	[0198.643] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Double Wave.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\double wave.png"), fInfoLevelId=0x0, lpFileInformation=0x12454508 | out: lpFileInformation=0x12454508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a337abe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a337abe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a337abe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x24c8)) returned 1
	[0198.643] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Double Wave_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\double wave_render.png"), fInfoLevelId=0x0, lpFileInformation=0x12454558 | out: lpFileInformation=0x12454558*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a337abe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a337abe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a337abe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1f9c)) returned 1
	[0198.643] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Lightning bolt.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\lightning bolt.png"), fInfoLevelId=0x0, lpFileInformation=0x124545a8 | out: lpFileInformation=0x124545a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a35d6d3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a35d6d3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a35d6d3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3d07)) returned 1
	[0198.647] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Lightning bolt_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\lightning bolt_render.png"), fInfoLevelId=0x0, lpFileInformation=0x124545f8 | out: lpFileInformation=0x124545f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a35d6d3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a35d6d3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a35d6d3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3324)) returned 1
	[0198.647] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Moon.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\moon.png"), fInfoLevelId=0x0, lpFileInformation=0x12454648 | out: lpFileInformation=0x12454648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a35d6d3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a35d6d3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a35d6d3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8)) returned 1
	[0198.649] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Moon_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\moon_render.png"), fInfoLevelId=0x0, lpFileInformation=0x12454698 | out: lpFileInformation=0x12454698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a35d6d3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a35d6d3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a35d6d3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x28d5)) returned 1
	[0198.649] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Multiply.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\multiply.png"), fInfoLevelId=0x0, lpFileInformation=0x124546e8 | out: lpFileInformation=0x124546e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a35d6d3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a35d6d3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a35d6d3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2d4a)) returned 1
	[0198.649] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Multiply_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\multiply_render.png"), fInfoLevelId=0x0, lpFileInformation=0x12454738 | out: lpFileInformation=0x12454738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a35d6d3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a35d6d3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a35d6d3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2996)) returned 1
	[0198.650] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\No Symbol.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\no symbol.png"), fInfoLevelId=0x0, lpFileInformation=0x12454788 | out: lpFileInformation=0x12454788*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x4544)) returned 1
	[0198.651] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\No Symbol_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\no symbol_render.png"), fInfoLevelId=0x0, lpFileInformation=0x124547d8 | out: lpFileInformation=0x124547d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x4728)) returned 1
	[0198.651] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Oval.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\oval.png"), fInfoLevelId=0x0, lpFileInformation=0x12454828 | out: lpFileInformation=0x12454828*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2962)) returned 1
	[0198.651] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Oval_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\oval_render.png"), fInfoLevelId=0x0, lpFileInformation=0x12454878 | out: lpFileInformation=0x12454878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2a06)) returned 1
	[0198.652] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Rectangle.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\rectangle.png"), fInfoLevelId=0x0, lpFileInformation=0x124548c8 | out: lpFileInformation=0x124548c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xf7d)) returned 1
	[0198.654] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Rectangle_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\rectangle_render.png"), fInfoLevelId=0x0, lpFileInformation=0x12454918 | out: lpFileInformation=0x12454918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xef7)) returned 1
	[0198.655] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Rounded  Rectangle.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\rounded  rectangle.png"), fInfoLevelId=0x0, lpFileInformation=0x12454968 | out: lpFileInformation=0x12454968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x17e0)) returned 1
	[0198.656] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Rounded  Rectangle_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\rounded  rectangle_render.png"), fInfoLevelId=0x0, lpFileInformation=0x124549b8 | out: lpFileInformation=0x124549b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3a9bbf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3a9bbf, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3a9bbf, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x18a2)) returned 1
	[0198.657] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Smiley face.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\smiley face.png"), fInfoLevelId=0x0, lpFileInformation=0x12454a08 | out: lpFileInformation=0x12454a08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3a9bbf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3a9bbf, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3a9bbf, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x4921)) returned 1
	[0198.657] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Smiley face_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\smiley face_render.png"), fInfoLevelId=0x0, lpFileInformation=0x12454a58 | out: lpFileInformation=0x12454a58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3a9bbf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3a9bbf, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3a9bbf, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x380c)) returned 1
	[0198.660] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Sun.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\sun.png"), fInfoLevelId=0x0, lpFileInformation=0x12454aa8 | out: lpFileInformation=0x12454aa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3a9bbf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3a9bbf, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3a9bbf, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x337b)) returned 1
	[0198.660] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Sun_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\sun_render.png"), fInfoLevelId=0x0, lpFileInformation=0x12454af8 | out: lpFileInformation=0x12454af8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3a9bbf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3a9bbf, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3a9bbf, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3b76)) returned 1
	[0198.660] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Triangle.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\triangle.png"), fInfoLevelId=0x0, lpFileInformation=0x12454b48 | out: lpFileInformation=0x12454b48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3a9bbf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3a9bbf, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3a9bbf, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2e87)) returned 1
	[0198.661] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Triangle_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\triangle_render.png"), fInfoLevelId=0x0, lpFileInformation=0x12454b98 | out: lpFileInformation=0x12454b98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3a9bbf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3a9bbf, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3a9bbf, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2419)) returned 1
	[0198.661] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Wave.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\wave.png"), fInfoLevelId=0x0, lpFileInformation=0x12454be8 | out: lpFileInformation=0x12454be8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3a9bbf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3a9bbf, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x26ab)) returned 1
	[0198.750] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Wave_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\wave_render.png"), fInfoLevelId=0x0, lpFileInformation=0x12454c38 | out: lpFileInformation=0x12454c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x226d)) returned 1
	[0198.750] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\heart.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\heart.png"), fInfoLevelId=0x0, lpFileInformation=0x12454c88 | out: lpFileInformation=0x12454c88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a35d6d3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a35d6d3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a35d6d3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3479)) returned 1
	[0198.750] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\heart_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\heart_render.png"), fInfoLevelId=0x0, lpFileInformation=0x12454cd8 | out: lpFileInformation=0x12454cd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a35d6d3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a35d6d3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a35d6d3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2bb3)) returned 1
	[0198.751] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\plus.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\plus.png"), fInfoLevelId=0x0, lpFileInformation=0x12454d28 | out: lpFileInformation=0x12454d28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1384)) returned 1
	[0198.751] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\plus_render.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\plus_render.png"), fInfoLevelId=0x0, lpFileInformation=0x12454d78 | out: lpFileInformation=0x12454d78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x12c2)) returned 1
	[0198.751] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\HelpIcon_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\helpicon_contrast-black.png"), fInfoLevelId=0x0, lpFileInformation=0x12454dc8 | out: lpFileInformation=0x12454dc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xe5a)) returned 1
	[0198.751] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\HelpIcon_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\helpicon_contrast-white.png"), fInfoLevelId=0x0, lpFileInformation=0x12454e18 | out: lpFileInformation=0x12454e18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xea1)) returned 1
	[0198.758] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\LightBlue.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\lightblue.png"), fInfoLevelId=0x0, lpFileInformation=0x12454e68 | out: lpFileInformation=0x12454e68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcbf)) returned 1
	[0198.758] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\LoadIconRTL_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\loadiconrtl_contrast-black.png"), fInfoLevelId=0x0, lpFileInformation=0x12454eb8 | out: lpFileInformation=0x12454eb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd6b)) returned 1
	[0198.758] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\LoadIconRTL_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\loadiconrtl_contrast-white.png"), fInfoLevelId=0x0, lpFileInformation=0x12454f08 | out: lpFileInformation=0x12454f08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd72)) returned 1
	[0198.758] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\LoadIcon_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\loadicon_contrast-black.png"), fInfoLevelId=0x0, lpFileInformation=0x12454f58 | out: lpFileInformation=0x12454f58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd84)) returned 1
	[0198.759] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\LoadIcon_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\loadicon_contrast-white.png"), fInfoLevelId=0x0, lpFileInformation=0x12454fa8 | out: lpFileInformation=0x12454fa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd9e)) returned 1
	[0198.759] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\MediumBlue.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\mediumblue.png"), fInfoLevelId=0x0, lpFileInformation=0x12454ff8 | out: lpFileInformation=0x12454ff8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcbe)) returned 1
	[0198.759] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\ScanIcon_contrast-black.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\scanicon_contrast-black.png"), fInfoLevelId=0x0, lpFileInformation=0x12455048 | out: lpFileInformation=0x12455048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3f6071, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3f6071, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3f6071, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd09)) returned 1
	[0198.759] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\ScanIcon_contrast-white.png" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\scanicon_contrast-white.png"), fInfoLevelId=0x0, lpFileInformation=0x12455098 | out: lpFileInformation=0x12455098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3f6071, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3f6071, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3f6071, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd13)) returned 1
	[0198.759] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Builder3D.exe" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\builder3d.exe"), fInfoLevelId=0x0, lpFileInformation=0x124550e8 | out: lpFileInformation=0x124550e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3f6071, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3f6071, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a6584f3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x84f800)) returned 1
	[0198.765] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Common" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\common"), fInfoLevelId=0x0, lpFileInformation=0x12455138 | out: lpFileInformation=0x12455138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a6584f3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a6584f3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a6584f3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0198.765] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Common" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\common"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0198.765] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Common\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a6584f3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a6584f3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a6584f3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fde8
	[0198.766] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a6584f3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a6584f3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a6584f3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.766] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a6584f3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a6584f3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a6584f3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe.txt", cAlternateFileName="")) returned 1
	[0198.766] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0198.766] FindClose (in: hFindFile=0x79fde8 | out: hFindFile=0x79fde8) returned 1
	[0198.766] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Common\\ReadMe.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\common\\readme.txt"), fInfoLevelId=0x0, lpFileInformation=0x124551d8 | out: lpFileInformation=0x124551d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a6584f3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a6584f3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a6584f3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3cf)) returned 1
	[0198.766] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Lib3mfUAP.dll" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\lib3mfuap.dll"), fInfoLevelId=0x0, lpFileInformation=0x12455228 | out: lpFileInformation=0x12455228*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a6584f3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a6584f3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a6584f3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2fe00)) returned 1
	[0198.770] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata"), fInfoLevelId=0x0, lpFileInformation=0x12455278 | out: lpFileInformation=0x12455278*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x936d064c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x936d064c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x936d064c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0198.770] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0198.771] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x936d064c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x936d064c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x936d064c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffa8
	[0198.771] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x936d064c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x936d064c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x936d064c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.771] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0198.771] FindClose (in: hFindFile=0x79ffa8 | out: hFindFile=0x79ffa8) returned 1
	[0198.771] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\resources.pri"), fInfoLevelId=0x0, lpFileInformation=0x124552c8 | out: lpFileInformation=0x124552c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a99fbb2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a99fbb2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a9c5d29, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x51280)) returned 1
	[0198.772] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe"), fInfoLevelId=0x0, lpFileInformation=0x12455318 | out: lpFileInformation=0x12455318*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f59f46a, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x943087a2, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x943087a2, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0198.832] SetEvent (hEvent=0x168) returned 1
	[0198.832] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0198.832] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f59f46a, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x943087a2, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x943087a2, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fce8
	[0198.899] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f59f46a, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x943087a2, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x943087a2, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.899] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f78f56f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f78f56f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f78f56f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1
	[0198.899] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f59f46a, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f59f46a, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f78f56f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xab8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1
	[0198.899] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f78f56f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f78f56f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f78f56f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x296b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1
	[0198.899] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f78f56f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f78f56f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f78f56f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1
	[0198.899] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f78f56f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f78f56f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f78f56f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x127, dwReserved0=0x0, dwReserved1=0x0, cFileName="default.html", cAlternateFileName="")) returned 1
	[0198.899] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f78f56f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f801cbe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f801cbe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1
	[0198.899] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f801cbe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f801cbe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f801cbe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1
	[0198.899] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x943087a2, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x3636a2ee, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x3636a2ee, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1
	[0198.899] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f801cbe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f801cbe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f801cbe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 1
	[0198.899] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0198.899] FindClose (in: hFindFile=0x79fce8 | out: hFindFile=0x79fce8) returned 1
	[0198.901] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\appxblockmap.xml"), fInfoLevelId=0x0, lpFileInformation=0x12455688 | out: lpFileInformation=0x12455688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f78f56f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f78f56f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f78f56f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xbc4)) returned 1
	[0198.902] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\appxmanifest.xml"), fInfoLevelId=0x0, lpFileInformation=0x124556d8 | out: lpFileInformation=0x124556d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f59f46a, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f59f46a, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f78f56f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xab8)) returned 1
	[0198.902] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\appxsignature.p7x"), fInfoLevelId=0x0, lpFileInformation=0x12455728 | out: lpFileInformation=0x12455728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f78f56f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f78f56f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f78f56f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x296b)) returned 1
	[0198.906] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css"), fInfoLevelId=0x0, lpFileInformation=0x12455778 | out: lpFileInformation=0x12455778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f78f56f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f78f56f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f78f56f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0198.906] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0198.906] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f78f56f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f78f56f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f78f56f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fde8
	[0198.906] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f78f56f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f78f56f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f78f56f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.906] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f78f56f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f78f56f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f78f56f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xe, dwReserved0=0x0, dwReserved1=0x0, cFileName="default.css", cAlternateFileName="")) returned 1
	[0198.906] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0198.907] FindClose (in: hFindFile=0x79fde8 | out: hFindFile=0x79fde8) returned 1
	[0198.907] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css\\default.css" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css\\default.css"), fInfoLevelId=0x0, lpFileInformation=0x12455818 | out: lpFileInformation=0x12455818*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f78f56f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f78f56f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f78f56f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xe)) returned 1
	[0198.907] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\default.html" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\default.html"), fInfoLevelId=0x0, lpFileInformation=0x12455868 | out: lpFileInformation=0x12455868*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f78f56f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f78f56f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f78f56f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x127)) returned 1
	[0198.908] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images"), fInfoLevelId=0x0, lpFileInformation=0x124558b8 | out: lpFileInformation=0x124558b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f78f56f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f801cbe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f801cbe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0198.908] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0198.908] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f78f56f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f801cbe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f801cbe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fce8
	[0198.928] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f78f56f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f801cbe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f801cbe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.928] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f78f56f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f78f56f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7b5810, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConnectorAppList.scale-100.png", cAlternateFileName="")) returned 1
	[0198.928] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7b5810, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7b5810, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7b5810, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConnectorAppList.targetsize-16.png", cAlternateFileName="")) returned 1
	[0198.928] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7b5810, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7b5810, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7b5810, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConnectorAppList.targetsize-20.png", cAlternateFileName="")) returned 1
	[0198.928] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7b5810, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7b5810, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7b5810, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConnectorAppList.targetsize-24.png", cAlternateFileName="")) returned 1
	[0198.928] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7b5810, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7b5810, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7b5810, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConnectorAppList.targetsize-256.png", cAlternateFileName="")) returned 1
	[0198.928] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7b5810, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7b5810, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7b5810, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConnectorAppList.targetsize-32.png", cAlternateFileName="")) returned 1
	[0198.928] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7b5810, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7b5810, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7b5810, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConnectorAppList.targetsize-40.png", cAlternateFileName="")) returned 1
	[0198.928] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7dbaf9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7dbaf9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7dbaf9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConnectorAppList.targetsize-48.png", cAlternateFileName="")) returned 1
	[0198.928] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7dbaf9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7dbaf9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7dbaf9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConnectorAppList.targetsize-64.png", cAlternateFileName="")) returned 1
	[0198.929] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7dbaf9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7dbaf9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7dbaf9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x12a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConnectorAppList.targetsize-80.png", cAlternateFileName="")) returned 1
	[0198.929] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7dbaf9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7dbaf9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7dbaf9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x16c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConnectorAppList.targetsize-96.png", cAlternateFileName="")) returned 1
	[0198.929] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7dbaf9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7dbaf9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7dbaf9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x299, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.scale-100.png", cAlternateFileName="")) returned 1
	[0198.929] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7dbaf9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7dbaf9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7dbaf9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0x0, dwReserved1=0x0, cFileName="smalllogo.scale-100.png", cAlternateFileName="")) returned 1
	[0198.929] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7dbaf9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7dbaf9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7dbaf9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x477, dwReserved0=0x0, dwReserved1=0x0, cFileName="splashscreen.scale-100.png", cAlternateFileName="")) returned 1
	[0198.929] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f801cbe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f801cbe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f801cbe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="storelogo.scale-100.png", cAlternateFileName="")) returned 1
	[0198.929] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0198.929] FindClose (in: hFindFile=0x79fce8 | out: hFindFile=0x79fce8) returned 1
	[0198.931] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x12672418 | out: lpFileInformation=0x12672418*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f78f56f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f78f56f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7b5810, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc5)) returned 1
	[0198.937] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-16.png"), fInfoLevelId=0x0, lpFileInformation=0x12672468 | out: lpFileInformation=0x12672468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7b5810, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7b5810, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7b5810, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xa2)) returned 1
	[0198.938] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-20.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-20.png"), fInfoLevelId=0x0, lpFileInformation=0x126724b8 | out: lpFileInformation=0x126724b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7b5810, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7b5810, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7b5810, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x9f)) returned 1
	[0198.938] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-24.png"), fInfoLevelId=0x0, lpFileInformation=0x12672508 | out: lpFileInformation=0x12672508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7b5810, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7b5810, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7b5810, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xa8)) returned 1
	[0198.938] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-256.png"), fInfoLevelId=0x0, lpFileInformation=0x12672558 | out: lpFileInformation=0x12672558*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7b5810, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7b5810, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7b5810, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x384)) returned 1
	[0198.970] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-32.png"), fInfoLevelId=0x0, lpFileInformation=0x126725a8 | out: lpFileInformation=0x126725a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7b5810, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7b5810, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7b5810, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xb2)) returned 1
	[0198.971] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-40.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-40.png"), fInfoLevelId=0x0, lpFileInformation=0x126725f8 | out: lpFileInformation=0x126725f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7b5810, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7b5810, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7b5810, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcc)) returned 1
	[0198.971] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-48.png"), fInfoLevelId=0x0, lpFileInformation=0x12672648 | out: lpFileInformation=0x12672648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7dbaf9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7dbaf9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7dbaf9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xdf)) returned 1
	[0198.971] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-64.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-64.png"), fInfoLevelId=0x0, lpFileInformation=0x12672698 | out: lpFileInformation=0x12672698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7dbaf9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7dbaf9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7dbaf9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xf8)) returned 1
	[0198.975] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-80.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-80.png"), fInfoLevelId=0x0, lpFileInformation=0x126726e8 | out: lpFileInformation=0x126726e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7dbaf9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7dbaf9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7dbaf9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x12a)) returned 1
	[0198.975] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-96.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-96.png"), fInfoLevelId=0x0, lpFileInformation=0x12672738 | out: lpFileInformation=0x12672738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7dbaf9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7dbaf9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7dbaf9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x16c)) returned 1
	[0198.975] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\logo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\logo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x12672788 | out: lpFileInformation=0x12672788*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7dbaf9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7dbaf9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7dbaf9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x299)) returned 1
	[0198.976] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\smalllogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\smalllogo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x126727d8 | out: lpFileInformation=0x126727d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7dbaf9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7dbaf9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7dbaf9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x12c)) returned 1
	[0198.980] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\splashscreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\splashscreen.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x12672828 | out: lpFileInformation=0x12672828*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7dbaf9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7dbaf9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7dbaf9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x477)) returned 1
	[0198.981] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\storelogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\storelogo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x12672878 | out: lpFileInformation=0x12672878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f801cbe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f801cbe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f801cbe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x16a)) returned 1
	[0198.981] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js"), fInfoLevelId=0x0, lpFileInformation=0x126728c8 | out: lpFileInformation=0x126728c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f801cbe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f801cbe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f801cbe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0198.981] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0198.981] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f801cbe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f801cbe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f801cbe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fd68
	[0198.982] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f801cbe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f801cbe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f801cbe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.982] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f801cbe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f801cbe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f801cbe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x233, dwReserved0=0x0, dwReserved1=0x0, cFileName="default.js", cAlternateFileName="")) returned 1
	[0198.982] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0198.982] FindClose (in: hFindFile=0x79fd68 | out: hFindFile=0x79fd68) returned 1
	[0198.982] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js\\default.js" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js\\default.js"), fInfoLevelId=0x0, lpFileInformation=0x12672968 | out: lpFileInformation=0x12672968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f801cbe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f801cbe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f801cbe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x233)) returned 1
	[0198.982] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata"), fInfoLevelId=0x0, lpFileInformation=0x126729b8 | out: lpFileInformation=0x126729b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x943087a2, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x3636a2ee, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x3636a2ee, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0198.986] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0198.987] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x943087a2, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x3636a2ee, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x3636a2ee, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fb28
	[0198.987] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x943087a2, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x3636a2ee, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x3636a2ee, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.987] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3636a2ee, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x3636a2ee, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x3636a2ee, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 1
	[0198.987] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0198.987] FindClose (in: hFindFile=0x79fb28 | out: hFindFile=0x79fb28) returned 1
	[0198.987] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\autogen"), fInfoLevelId=0x0, lpFileInformation=0x12672a58 | out: lpFileInformation=0x12672a58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3636a2ee, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x3636a2ee, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x3636a2ee, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0198.992] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\autogen"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0198.992] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3636a2ee, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x3636a2ee, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x3636a2ee, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fce8
	[0198.992] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3636a2ee, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x3636a2ee, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x3636a2ee, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.993] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x3636a2ee, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x3636a2ee, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x36cf3cb6, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x875, dwReserved0=0x0, dwReserved1=0x0, cFileName="JSByteCodeCache_64", cAlternateFileName="JSBYTE~1")) returned 1
	[0198.993] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0198.993] FindClose (in: hFindFile=0x79fce8 | out: hFindFile=0x79fce8) returned 1
	[0198.993] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\JSByteCodeCache_64" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\autogen\\jsbytecodecache_64"), fInfoLevelId=0x0, lpFileInformation=0x12672af8 | out: lpFileInformation=0x12672af8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x3636a2ee, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x3636a2ee, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x36cf3cb6, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x875)) returned 1
	[0198.993] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\resources.pri"), fInfoLevelId=0x0, lpFileInformation=0x12672b48 | out: lpFileInformation=0x12672b48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f801cbe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f801cbe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f801cbe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xef8)) returned 1
	[0198.994] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe"), fInfoLevelId=0x0, lpFileInformation=0x12672b98 | out: lpFileInformation=0x12672b98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f316dd6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x942e23d9, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x942e23d9, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0198.994] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0198.994] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f316dd6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x942e23d9, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x942e23d9, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fa68
	[0198.998] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f316dd6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x942e23d9, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x942e23d9, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0198.998] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f52d085, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f52d085, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f52d085, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x154, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1
	[0198.998] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f316dd6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f316dd6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f316dd6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1
	[0198.998] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f52d085, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f52d085, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f552f8d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x296b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1
	[0198.998] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x942e23d9, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x942e23d9, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x942e23d9, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1
	[0198.998] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0198.998] FindClose (in: hFindFile=0x79fa68 | out: hFindFile=0x79fa68) returned 1
	[0199.000] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml"), fInfoLevelId=0x0, lpFileInformation=0x12672d28 | out: lpFileInformation=0x12672d28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f52d085, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f52d085, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f52d085, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x154)) returned 1
	[0199.104] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\appxmetadata"), fInfoLevelId=0x0, lpFileInformation=0x12672d78 | out: lpFileInformation=0x12672d78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f316dd6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f316dd6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f316dd6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0199.105] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\appxmetadata"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0199.105] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f316dd6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f316dd6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f316dd6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f968
	[0199.105] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f316dd6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f316dd6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f316dd6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.105] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f316dd6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f316dd6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f316dd6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x6b98, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBundleManifest.xml", cAlternateFileName="")) returned 1
	[0199.105] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0199.105] FindClose (in: hFindFile=0x79f968 | out: hFindFile=0x79f968) returned 1
	[0199.105] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\appxbundlemanifest.xml"), fInfoLevelId=0x0, lpFileInformation=0x12672e18 | out: lpFileInformation=0x12672e18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f316dd6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f316dd6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f316dd6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x6b98)) returned 1
	[0199.112] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x"), fInfoLevelId=0x0, lpFileInformation=0x12672e68 | out: lpFileInformation=0x12672e68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f52d085, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f52d085, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f552f8d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x296b)) returned 1
	[0199.112] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata"), fInfoLevelId=0x0, lpFileInformation=0x12672eb8 | out: lpFileInformation=0x12672eb8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x942e23d9, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x942e23d9, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x942e23d9, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0199.119] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" (normalized: "c:\\program files\\windowsapps\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0199.119] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x942e23d9, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x942e23d9, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x942e23d9, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f928
	[0199.119] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x942e23d9, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x942e23d9, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x942e23d9, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.120] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0199.120] FindClose (in: hFindFile=0x79f928 | out: hFindFile=0x79f928) returned 1
	[0199.120] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe"), fInfoLevelId=0x0, lpFileInformation=0x12672f08 | out: lpFileInformation=0x12672f08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcef23b4e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x950bde7a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x950bde7a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0199.143] SetEvent (hEvent=0x168) returned 1
	[0199.143] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0199.144] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcef23b4e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x950bde7a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x950bde7a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fd28
	[0199.194] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcef23b4e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x950bde7a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x950bde7a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.194] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcef23b4e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcef23b4e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcef23b4e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x154, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1
	[0199.194] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcef23b4e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcef23b4e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcef23b4e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1
	[0199.194] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcef23b4e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcef23b4e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcef23b4e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x296b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1
	[0199.194] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x950bde7a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x950bde7a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x950bde7a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1
	[0199.194] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0199.194] FindClose (in: hFindFile=0x79fd28 | out: hFindFile=0x79fd28) returned 1
	[0199.195] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml"), fInfoLevelId=0x0, lpFileInformation=0x12673098 | out: lpFileInformation=0x12673098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcef23b4e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcef23b4e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcef23b4e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x154)) returned 1
	[0199.202] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxmetadata"), fInfoLevelId=0x0, lpFileInformation=0x126730e8 | out: lpFileInformation=0x126730e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcef23b4e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcef23b4e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcef23b4e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0199.202] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxmetadata"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0199.202] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcef23b4e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcef23b4e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcef23b4e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0028
	[0199.202] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcef23b4e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcef23b4e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcef23b4e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.202] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcef23b4e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcef23b4e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcef23b4e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x65eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBundleManifest.xml", cAlternateFileName="")) returned 1
	[0199.202] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0199.202] FindClose (in: hFindFile=0x7a0028 | out: hFindFile=0x7a0028) returned 1
	[0199.203] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\appxbundlemanifest.xml"), fInfoLevelId=0x0, lpFileInformation=0x12673188 | out: lpFileInformation=0x12673188*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcef23b4e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcef23b4e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcef23b4e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x65eb)) returned 1
	[0199.203] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x"), fInfoLevelId=0x0, lpFileInformation=0x126731d8 | out: lpFileInformation=0x126731d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcef23b4e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcef23b4e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcef23b4e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x296b)) returned 1
	[0199.203] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata"), fInfoLevelId=0x0, lpFileInformation=0x12673228 | out: lpFileInformation=0x12673228*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x950bde7a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x950bde7a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x950bde7a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0199.207] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0199.207] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x950bde7a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x950bde7a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x950bde7a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fbe8
	[0199.207] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x950bde7a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x950bde7a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x950bde7a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.207] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0199.207] FindClose (in: hFindFile=0x79fbe8 | out: hFindFile=0x79fbe8) returned 1
	[0199.208] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe"), fInfoLevelId=0x0, lpFileInformation=0x12673278 | out: lpFileInformation=0x12673278*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcefbc21b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x950bde7a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x950bde7a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0199.208] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0199.208] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcefbc21b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x950bde7a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x950bde7a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9e8
	[0199.212] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcefbc21b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x950bde7a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x950bde7a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.215] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefbc21b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefbc21b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefbc21b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x7509, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConfiguration.xml", cAlternateFileName="")) returned 1
	[0199.215] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefbc21b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefbc21b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefbc21b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x7e84, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1
	[0199.215] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefbc21b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefbc21b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefbc21b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2072, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1
	[0199.215] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcefbc21b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefbc21b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefbc21b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1
	[0199.215] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefbc21b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefbc21b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefbc21b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x298e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1
	[0199.216] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefe25c9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefe25c9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1
	[0199.216] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xe958, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClrCompression.dll", cAlternateFileName="")) returned 1
	[0199.216] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Configuration", cAlternateFileName="CONFIG~1")) returned 1
	[0199.216] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf0a10a5, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf0a10a5, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JsonResources", cAlternateFileName="JSONRE~1")) returned 1
	[0199.216] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf0a10a5, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf0a10a5, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf0a10a5, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x211d, dwReserved0=0x0, dwReserved1=0x0, cFileName="MarketConfiguration.xml", cAlternateFileName="")) returned 1
	[0199.216] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf18613e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf18613e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf18613e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising", cAlternateFileName="MICROS~1.ADV")) returned 1
	[0199.216] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf0a10a5, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf0a10a5, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf18613e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x35acb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising.dll", cAlternateFileName="")) returned 1
	[0199.216] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf18613e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf18613e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf18613e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising.winmd", cAlternateFileName="")) returned 1
	[0199.216] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf18613e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf18613e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf1d25aa, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9d800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Aria.ClientTelemetry.dll", cAlternateFileName="")) returned 1
	[0199.216] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf1d25aa, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf1d25aa, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf1d25aa, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Aria.ClientTelemetry.winmd", cAlternateFileName="")) returned 1
	[0199.216] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf1d25aa, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf1d25aa, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xbda000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Msn.Money.dll", cAlternateFileName="")) returned 1
	[0199.216] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Msn.Money.exe", cAlternateFileName="")) returned 1
	[0199.216] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Msn.Services", cAlternateFileName="MICROS~1.SER")) returned 1
	[0199.216] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4f37d8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Msn.Shell", cAlternateFileName="MICROS~1.SHE")) returned 1
	[0199.216] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x950bde7a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x950bde7a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x950bde7a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1
	[0199.216] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf4f37d8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftAdvertising.ini", cAlternateFileName="")) returned 1
	[0199.216] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf519a56, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf519a56, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf519a56, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSAdvertisingJS", cAlternateFileName="MSADVE~1")) returned 1
	[0199.216] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf519a56, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf519a56, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf519a56, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x4413, dwReserved0=0x0, dwReserved1=0x0, cFileName="PlatformConfiguration.xml", cAlternateFileName="")) returned 1
	[0199.216] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf519a56, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf519a56, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf53fccb, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xdee88, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 1
	[0199.216] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf565f1f, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf565f1f, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf58c102, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xe5200, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQLite3Wrapper.dll", cAlternateFileName="")) returned 1
	[0199.216] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf5b2365, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf5b2365, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf5b2365, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQLiteWrapper.winmd", cAlternateFileName="")) returned 1
	[0199.217] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcefbc21b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefbc21b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefbc21b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 1
	[0199.217] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0199.217] FindClose (in: hFindFile=0x79f9e8 | out: hFindFile=0x79f9e8) returned 1
	[0199.218] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\appconfiguration.xml"), fInfoLevelId=0x0, lpFileInformation=0x12673b38 | out: lpFileInformation=0x12673b38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefbc21b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefbc21b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefbc21b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x7509)) returned 1
	[0199.222] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\appxblockmap.xml"), fInfoLevelId=0x0, lpFileInformation=0x12673b88 | out: lpFileInformation=0x12673b88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefbc21b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefbc21b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefbc21b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x7e84)) returned 1
	[0199.222] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\appxmanifest.xml"), fInfoLevelId=0x0, lpFileInformation=0x12673bd8 | out: lpFileInformation=0x12673bd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefbc21b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefbc21b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefbc21b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2072)) returned 1
	[0199.222] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\appxmetadata"), fInfoLevelId=0x0, lpFileInformation=0x12673c28 | out: lpFileInformation=0x12673c28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcefbc21b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefbc21b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefbc21b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0199.223] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\appxmetadata"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0199.223] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcefbc21b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefbc21b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefbc21b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f968
	[0199.223] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcefbc21b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefbc21b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefbc21b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.223] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefbc21b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefbc21b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefbc21b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2fe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 1
	[0199.223] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0199.224] FindClose (in: hFindFile=0x79f968 | out: hFindFile=0x79f968) returned 1
	[0199.224] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat"), fInfoLevelId=0x0, lpFileInformation=0x12673cc8 | out: lpFileInformation=0x12673cc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefbc21b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefbc21b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefbc21b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2fe7)) returned 1
	[0199.225] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\appxsignature.p7x"), fInfoLevelId=0x0, lpFileInformation=0x12673d18 | out: lpFileInformation=0x12673d18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefbc21b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefbc21b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefbc21b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x298e)) returned 1
	[0199.225] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets"), fInfoLevelId=0x0, lpFileInformation=0x12673d68 | out: lpFileInformation=0x12673d68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefe25c9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefe25c9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0199.229] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0199.229] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefe25c9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefe25c9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fe68
	[0199.230] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefe25c9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefe25c9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.230] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppTiles", cAlternateFileName="")) returned 1
	[0199.230] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0199.230] FindClose (in: hFindFile=0x79fe68 | out: hFindFile=0x79fe68) returned 1
	[0199.230] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles"), fInfoLevelId=0x0, lpFileInformation=0x12673e08 | out: lpFileInformation=0x12673e08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0199.230] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0199.231] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fd28
	[0199.242] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.242] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf00881c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf00881c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-black", cAlternateFileName="CONTRA~1")) returned 1
	[0199.242] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf00881c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 1
	[0199.242] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf02ebf4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_LogoSmall.scale-100.png", cAlternateFileName="")) returned 1
	[0199.243] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf02ebf4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_LogoSmall.targetsize-16.png", cAlternateFileName="")) returned 1
	[0199.243] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf02ebf4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_LogoSmall.targetsize-24.png", cAlternateFileName="")) returned 1
	[0199.243] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf02ebf4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x697, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_LogoSmall.targetsize-256.png", cAlternateFileName="")) returned 1
	[0199.243] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf02ebf4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_LogoSmall.targetsize-32.png", cAlternateFileName="")) returned 1
	[0199.243] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf02ebf4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_LogoSmall.targetsize-48.png", cAlternateFileName="")) returned 1
	[0199.243] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf02ebf4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x508, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_SplashScreen.scale-100.png", cAlternateFileName="")) returned 1
	[0199.244] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_TileLargeSquare.scale-100.png", cAlternateFileName="")) returned 1
	[0199.244] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_TileMediumSquare.scale-100.png", cAlternateFileName="")) returned 1
	[0199.244] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x129, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_TileSmallSquare.scale-100.png", cAlternateFileName="")) returned 1
	[0199.244] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x25a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_TileWide.scale-100.png", cAlternateFileName="")) returned 1
	[0199.244] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="StoreLogo.png", cAlternateFileName="")) returned 1
	[0199.244] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0199.244] FindClose (in: hFindFile=0x79fd28 | out: hFindFile=0x79fd28) returned 1
	[0199.246] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_logosmall.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x126a02d8 | out: lpFileInformation=0x126a02d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf02ebf4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xf4)) returned 1
	[0199.257] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_logosmall.targetsize-16.png"), fInfoLevelId=0x0, lpFileInformation=0x126a0328 | out: lpFileInformation=0x126a0328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf02ebf4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x90)) returned 1
	[0199.257] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_logosmall.targetsize-24.png"), fInfoLevelId=0x0, lpFileInformation=0x126a0378 | out: lpFileInformation=0x126a0378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf02ebf4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xb3)) returned 1
	[0199.257] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_logosmall.targetsize-256.png"), fInfoLevelId=0x0, lpFileInformation=0x126a03c8 | out: lpFileInformation=0x126a03c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf02ebf4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x697)) returned 1
	[0199.268] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_logosmall.targetsize-32.png"), fInfoLevelId=0x0, lpFileInformation=0x126a0418 | out: lpFileInformation=0x126a0418*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf02ebf4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xe8)) returned 1
	[0199.268] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_logosmall.targetsize-48.png"), fInfoLevelId=0x0, lpFileInformation=0x126a0468 | out: lpFileInformation=0x126a0468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf02ebf4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x12f)) returned 1
	[0199.271] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_splashscreen.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x126a04b8 | out: lpFileInformation=0x126a04b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf02ebf4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x508)) returned 1
	[0199.275] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_TileLargeSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_tilelargesquare.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x126a0508 | out: lpFileInformation=0x126a0508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x436)) returned 1
	[0199.276] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_TileMediumSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_tilemediumsquare.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x126a0558 | out: lpFileInformation=0x126a0558*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1d7)) returned 1
	[0199.281] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_TileSmallSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_tilesmallsquare.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x126a05a8 | out: lpFileInformation=0x126a05a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x129)) returned 1
	[0199.281] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Money_TileWide.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\money_tilewide.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x126a05f8 | out: lpFileInformation=0x126a05f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x25a)) returned 1
	[0199.283] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\StoreLogo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\storelogo.png"), fInfoLevelId=0x0, lpFileInformation=0x126a0648 | out: lpFileInformation=0x126a0648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xdf)) returned 1
	[0199.283] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black"), fInfoLevelId=0x0, lpFileInformation=0x126a0698 | out: lpFileInformation=0x126a0698*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf00881c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf00881c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0199.284] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0199.284] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf00881c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf00881c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fd68
	[0199.287] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf00881c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf00881c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.287] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefe25c9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefe25c9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_LogoSmall.scale-100.png", cAlternateFileName="")) returned 1
	[0199.287] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefe25c9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefe25c9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_LogoSmall.targetsize-16.png", cAlternateFileName="")) returned 1
	[0199.287] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefe25c9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefe25c9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_LogoSmall.targetsize-24.png", cAlternateFileName="")) returned 1
	[0199.287] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefe25c9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefe25c9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x697, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_LogoSmall.targetsize-256.png", cAlternateFileName="")) returned 1
	[0199.287] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefe25c9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefe25c9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_LogoSmall.targetsize-32.png", cAlternateFileName="")) returned 1
	[0199.287] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefe25c9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefe25c9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_LogoSmall.targetsize-48.png", cAlternateFileName="")) returned 1
	[0199.288] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefe25c9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefe25c9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x508, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_SplashScreen.scale-100.png", cAlternateFileName="")) returned 1
	[0199.288] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefe25c9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf00881c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_TileLargeSquare.scale-100.png", cAlternateFileName="")) returned 1
	[0199.288] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf00881c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf00881c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf00881c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_TileMediumSquare.scale-100.png", cAlternateFileName="")) returned 1
	[0199.288] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf00881c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf00881c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf00881c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x129, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_TileSmallSquare.scale-100.png", cAlternateFileName="")) returned 1
	[0199.288] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf00881c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf00881c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf00881c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x25a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_TileWide.scale-100.png", cAlternateFileName="")) returned 1
	[0199.288] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0199.288] FindClose (in: hFindFile=0x79fd68 | out: hFindFile=0x79fd68) returned 1
	[0199.289] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_logosmall.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x126a0a58 | out: lpFileInformation=0x126a0a58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefe25c9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefe25c9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xf4)) returned 1
	[0199.291] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_logosmall.targetsize-16.png"), fInfoLevelId=0x0, lpFileInformation=0x126a0aa8 | out: lpFileInformation=0x126a0aa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefe25c9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefe25c9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x90)) returned 1
	[0199.291] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_logosmall.targetsize-24.png"), fInfoLevelId=0x0, lpFileInformation=0x126a0af8 | out: lpFileInformation=0x126a0af8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefe25c9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefe25c9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xb3)) returned 1
	[0199.291] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_logosmall.targetsize-256.png"), fInfoLevelId=0x0, lpFileInformation=0x126a0b48 | out: lpFileInformation=0x126a0b48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefe25c9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefe25c9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x697)) returned 1
	[0199.292] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_logosmall.targetsize-32.png"), fInfoLevelId=0x0, lpFileInformation=0x126a0b98 | out: lpFileInformation=0x126a0b98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefe25c9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefe25c9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xe8)) returned 1
	[0199.292] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_logosmall.targetsize-48.png"), fInfoLevelId=0x0, lpFileInformation=0x126a0be8 | out: lpFileInformation=0x126a0be8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefe25c9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefe25c9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x12f)) returned 1
	[0199.292] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_splashscreen.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x126a0c38 | out: lpFileInformation=0x126a0c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefe25c9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefe25c9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x508)) returned 1
	[0199.293] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileLargeSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_tilelargesquare.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x126a0c88 | out: lpFileInformation=0x126a0c88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefe25c9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefe25c9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf00881c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x436)) returned 1
	[0199.293] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileMediumSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_tilemediumsquare.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x126a0cd8 | out: lpFileInformation=0x126a0cd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf00881c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf00881c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf00881c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1d7)) returned 1
	[0199.293] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileSmallSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_tilesmallsquare.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x126a0d28 | out: lpFileInformation=0x126a0d28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf00881c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf00881c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf00881c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x129)) returned 1
	[0199.293] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileWide.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_tilewide.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x126a0d78 | out: lpFileInformation=0x126a0d78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf00881c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf00881c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf00881c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x25a)) returned 1
	[0199.293] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white"), fInfoLevelId=0x0, lpFileInformation=0x126a0dc8 | out: lpFileInformation=0x126a0dc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf00881c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0199.294] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0199.294] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf00881c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ff28
	[0199.356] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf00881c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.356] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf00881c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf00881c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf00881c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_LogoSmall.scale-100.png", cAlternateFileName="")) returned 1
	[0199.356] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf00881c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf00881c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf00881c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_LogoSmall.targetsize-16.png", cAlternateFileName="")) returned 1
	[0199.356] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf00881c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf00881c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf00881c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_LogoSmall.targetsize-24.png", cAlternateFileName="")) returned 1
	[0199.356] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf00881c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf00881c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf00881c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x65d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_LogoSmall.targetsize-256.png", cAlternateFileName="")) returned 1
	[0199.357] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf00881c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf00881c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf00881c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_LogoSmall.targetsize-32.png", cAlternateFileName="")) returned 1
	[0199.357] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf00881c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf00881c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf00881c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_LogoSmall.targetsize-48.png", cAlternateFileName="")) returned 1
	[0199.357] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf00881c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf00881c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x4f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_SplashScreen.scale-100.png", cAlternateFileName="")) returned 1
	[0199.357] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf02ebf4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x423, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_TileLargeSquare.scale-100.png", cAlternateFileName="")) returned 1
	[0199.357] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf02ebf4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_TileMediumSquare.scale-100.png", cAlternateFileName="")) returned 1
	[0199.357] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf02ebf4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_TileSmallSquare.scale-100.png", cAlternateFileName="")) returned 1
	[0199.357] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf02ebf4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_TileWide.scale-100.png", cAlternateFileName="")) returned 1
	[0199.357] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0199.357] FindClose (in: hFindFile=0x79ff28 | out: hFindFile=0x79ff28) returned 1
	[0199.358] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_logosmall.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x126a1188 | out: lpFileInformation=0x126a1188*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf00881c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf00881c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf00881c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xea)) returned 1
	[0199.360] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_logosmall.targetsize-16.png"), fInfoLevelId=0x0, lpFileInformation=0x126a11d8 | out: lpFileInformation=0x126a11d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf00881c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf00881c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf00881c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x91)) returned 1
	[0199.360] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_logosmall.targetsize-24.png"), fInfoLevelId=0x0, lpFileInformation=0x126a1228 | out: lpFileInformation=0x126a1228*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf00881c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf00881c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf00881c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xaf)) returned 1
	[0199.363] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_logosmall.targetsize-256.png"), fInfoLevelId=0x0, lpFileInformation=0x126a1278 | out: lpFileInformation=0x126a1278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf00881c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf00881c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf00881c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x65d)) returned 1
	[0199.364] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_logosmall.targetsize-32.png"), fInfoLevelId=0x0, lpFileInformation=0x126a12c8 | out: lpFileInformation=0x126a12c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf00881c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf00881c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf00881c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xde)) returned 1
	[0199.364] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_logosmall.targetsize-48.png"), fInfoLevelId=0x0, lpFileInformation=0x126a1318 | out: lpFileInformation=0x126a1318*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf00881c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf00881c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf00881c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x122)) returned 1
	[0199.364] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_splashscreen.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x126a1368 | out: lpFileInformation=0x126a1368*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf00881c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf00881c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x4f7)) returned 1
	[0199.368] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileLargeSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_tilelargesquare.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x126a13b8 | out: lpFileInformation=0x126a13b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf02ebf4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x423)) returned 1
	[0199.370] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileMediumSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_tilemediumsquare.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x126a1408 | out: lpFileInformation=0x126a1408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf02ebf4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1ce)) returned 1
	[0199.370] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileSmallSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_tilesmallsquare.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x126a1458 | out: lpFileInformation=0x126a1458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf02ebf4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x122)) returned 1
	[0199.370] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileWide.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_tilewide.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x126a14a8 | out: lpFileInformation=0x126a14a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf02ebf4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf02ebf4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf02ebf4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x24f)) returned 1
	[0199.371] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\ClrCompression.dll" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\clrcompression.dll"), fInfoLevelId=0x0, lpFileInformation=0x126a14f8 | out: lpFileInformation=0x126a14f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xe958)) returned 1
	[0199.374] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\configuration"), fInfoLevelId=0x0, lpFileInformation=0x126a1548 | out: lpFileInformation=0x126a1548*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0199.376] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\configuration"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0199.376] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f8e8
	[0199.377] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.377] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x15800, dwReserved0=0x0, dwReserved1=0x0, cFileName="configuration.sqlite", cAlternateFileName="")) returned 1
	[0199.377] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0199.377] FindClose (in: hFindFile=0x79f8e8 | out: hFindFile=0x79f8e8) returned 1
	[0199.377] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite"), fInfoLevelId=0x0, lpFileInformation=0x126a15e8 | out: lpFileInformation=0x126a15e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x15800)) returned 1
	[0199.378] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources"), fInfoLevelId=0x0, lpFileInformation=0x126a1638 | out: lpFileInformation=0x126a1638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf0a10a5, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf0a10a5, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0199.379] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0199.379] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf0a10a5, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf0a10a5, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fc68
	[0199.394] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf0a10a5, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf0a10a5, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.394] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1a52, dwReserved0=0x0, dwReserved1=0x0, cFileName="AboutLinks.json", cAlternateFileName="")) returned 1
	[0199.394] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf07b033, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x4b1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="CurrencyInfo.json", cAlternateFileName="")) returned 1
	[0199.394] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf07b033, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf07b033, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf07b033, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x32a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DefaultCurrencyLoc.json", cAlternateFileName="")) returned 1
	[0199.394] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf07b033, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf07b033, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf07b033, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x8ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="DefaultFromToCurrency.json", cAlternateFileName="")) returned 1
	[0199.394] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf07b033, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf07b033, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf07b033, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x3b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExchangeDetails.json", cAlternateFileName="")) returned 1
	[0199.394] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf07b033, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf07b033, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf07b033, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x36cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExchangesInfo.json", cAlternateFileName="")) returned 1
	[0199.394] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf07b033, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf07b033, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf07b033, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1d73, dwReserved0=0x0, dwReserved1=0x0, cFileName="MarketsInfo.json", cAlternateFileName="")) returned 1
	[0199.394] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf07b033, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf07b033, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf07b033, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2ba2, dwReserved0=0x0, dwReserved1=0x0, cFileName="NumberFormattingInfo.json", cAlternateFileName="")) returned 1
	[0199.394] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf07b033, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf07b033, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf07b033, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2f34, dwReserved0=0x0, dwReserved1=0x0, cFileName="ToolsDefaultData.json", cAlternateFileName="")) returned 1
	[0199.394] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf0a10a5, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf0a10a5, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf0a10a5, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="WorldMarketMajorInfo.json", cAlternateFileName="")) returned 1
	[0199.394] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0199.394] FindClose (in: hFindFile=0x79fc68 | out: hFindFile=0x79fc68) returned 1
	[0199.395] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\AboutLinks.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\aboutlinks.json"), fInfoLevelId=0x0, lpFileInformation=0x126a19f8 | out: lpFileInformation=0x126a19f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf054e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1a52)) returned 1
	[0199.396] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\CurrencyInfo.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\currencyinfo.json"), fInfoLevelId=0x0, lpFileInformation=0x126a1a48 | out: lpFileInformation=0x126a1a48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf054e30, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf054e30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf07b033, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x4b1c)) returned 1
	[0199.406] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\DefaultCurrencyLoc.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\defaultcurrencyloc.json"), fInfoLevelId=0x0, lpFileInformation=0x126a1a98 | out: lpFileInformation=0x126a1a98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf07b033, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf07b033, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf07b033, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x32a6)) returned 1
	[0199.406] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\DefaultFromToCurrency.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\defaultfromtocurrency.json"), fInfoLevelId=0x0, lpFileInformation=0x126a1ae8 | out: lpFileInformation=0x126a1ae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf07b033, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf07b033, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf07b033, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x8ea)) returned 1
	[0199.406] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\ExchangeDetails.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\exchangedetails.json"), fInfoLevelId=0x0, lpFileInformation=0x126a1b38 | out: lpFileInformation=0x126a1b38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf07b033, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf07b033, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf07b033, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x3b60)) returned 1
	[0199.406] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\ExchangesInfo.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\exchangesinfo.json"), fInfoLevelId=0x0, lpFileInformation=0x126a1b88 | out: lpFileInformation=0x126a1b88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf07b033, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf07b033, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf07b033, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x36cd)) returned 1
	[0199.407] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\MarketsInfo.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\marketsinfo.json"), fInfoLevelId=0x0, lpFileInformation=0x126a1bd8 | out: lpFileInformation=0x126a1bd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf07b033, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf07b033, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf07b033, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1d73)) returned 1
	[0199.407] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\NumberFormattingInfo.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\numberformattinginfo.json"), fInfoLevelId=0x0, lpFileInformation=0x126a1c28 | out: lpFileInformation=0x126a1c28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf07b033, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf07b033, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf07b033, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2ba2)) returned 1
	[0199.410] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\ToolsDefaultData.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\toolsdefaultdata.json"), fInfoLevelId=0x0, lpFileInformation=0x126a1c78 | out: lpFileInformation=0x126a1c78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf07b033, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf07b033, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf07b033, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2f34)) returned 1
	[0199.412] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\WorldMarketMajorInfo.json" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\jsonresources\\worldmarketmajorinfo.json"), fInfoLevelId=0x0, lpFileInformation=0x126a1cc8 | out: lpFileInformation=0x126a1cc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf0a10a5, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf0a10a5, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf0a10a5, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e)) returned 1
	[0199.565] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\msadvertisingjs"), fInfoLevelId=0x0, lpFileInformation=0x12455908 | out: lpFileInformation=0x12455908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf519a56, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf519a56, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf519a56, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0199.616] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\msadvertisingjs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0199.617] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf519a56, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf519a56, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf519a56, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fb68
	[0199.617] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf519a56, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf519a56, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf519a56, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.617] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf519a56, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf519a56, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf519a56, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x4be9, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootstrap.js", cAlternateFileName="")) returned 1
	[0199.617] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf519a56, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf519a56, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf519a56, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x73d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ormma.js", cAlternateFileName="")) returned 1
	[0199.617] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0199.617] FindClose (in: hFindFile=0x79fb68 | out: hFindFile=0x79fb68) returned 1
	[0199.618] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\bootstrap.js" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\msadvertisingjs\\bootstrap.js"), fInfoLevelId=0x0, lpFileInformation=0x124559f8 | out: lpFileInformation=0x124559f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf519a56, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf519a56, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf519a56, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x4be9)) returned 1
	[0199.668] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\ormma.js" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\msadvertisingjs\\ormma.js"), fInfoLevelId=0x0, lpFileInformation=0x12455a48 | out: lpFileInformation=0x12455a48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf519a56, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf519a56, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf519a56, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x73d8)) returned 1
	[0199.676] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MarketConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\marketconfiguration.xml"), fInfoLevelId=0x0, lpFileInformation=0x12455a98 | out: lpFileInformation=0x12455a98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf0a10a5, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf0a10a5, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf0a10a5, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x211d)) returned 1
	[0199.676] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising"), fInfoLevelId=0x0, lpFileInformation=0x12455ae8 | out: lpFileInformation=0x12455ae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf18613e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf18613e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf18613e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0199.676] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0199.677] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf18613e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf18613e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf18613e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fc68
	[0199.677] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf18613e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf18613e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf18613e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.677] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf18613e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf18613e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf18613e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x62f, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootstrap.html", cAlternateFileName="")) returned 1
	[0199.677] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf18613e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf18613e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf18613e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1
	[0199.677] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0199.677] FindClose (in: hFindFile=0x79fc68 | out: hFindFile=0x79fc68) returned 1
	[0199.677] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising\\themes"), fInfoLevelId=0x0, lpFileInformation=0x12455bd8 | out: lpFileInformation=0x12455bd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf18613e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf18613e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf18613e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0199.678] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising\\themes"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0199.678] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf18613e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf18613e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf18613e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fbe8
	[0199.678] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf18613e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf18613e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf18613e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.678] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf18613e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf18613e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf18613e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Generic.xbf", cAlternateFileName="")) returned 1
	[0199.678] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0199.678] FindClose (in: hFindFile=0x79fbe8 | out: hFindFile=0x79fbe8) returned 1
	[0199.678] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\Generic.xbf" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising\\themes\\generic.xbf"), fInfoLevelId=0x0, lpFileInformation=0x12455c78 | out: lpFileInformation=0x12455c78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf18613e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf18613e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf18613e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2ef)) returned 1
	[0199.683] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising\\bootstrap.html"), fInfoLevelId=0x0, lpFileInformation=0x12455cc8 | out: lpFileInformation=0x12455cc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf18613e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf18613e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf18613e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x62f)) returned 1
	[0199.683] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.dll" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising.dll"), fInfoLevelId=0x0, lpFileInformation=0x12455d18 | out: lpFileInformation=0x12455d18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf0a10a5, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf0a10a5, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf18613e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x35acb0)) returned 1
	[0199.686] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising.winmd"), fInfoLevelId=0x0, lpFileInformation=0x12455d68 | out: lpFileInformation=0x12455d68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf18613e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf18613e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf18613e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa4b0)) returned 1
	[0199.694] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Aria.ClientTelemetry.dll" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.aria.clienttelemetry.dll"), fInfoLevelId=0x0, lpFileInformation=0x12455db8 | out: lpFileInformation=0x12455db8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf18613e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf18613e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf1d25aa, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9d800)) returned 1
	[0199.694] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Aria.ClientTelemetry.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.aria.clienttelemetry.winmd"), fInfoLevelId=0x0, lpFileInformation=0x12455e08 | out: lpFileInformation=0x12455e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf1d25aa, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf1d25aa, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf1d25aa, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2a00)) returned 1
	[0199.694] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Money.dll" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.money.dll"), fInfoLevelId=0x0, lpFileInformation=0x12455e58 | out: lpFileInformation=0x12455e58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf1d25aa, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf1d25aa, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xbda000)) returned 1
	[0199.696] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Money.exe" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.money.exe"), fInfoLevelId=0x0, lpFileInformation=0x12455ea8 | out: lpFileInformation=0x12455ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x3e00)) returned 1
	[0199.703] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services"), fInfoLevelId=0x0, lpFileInformation=0x12455ef8 | out: lpFileInformation=0x12455ef8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0199.705] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0199.705] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0068
	[0199.705] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.705] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Personalization", cAlternateFileName="PERSON~1")) returned 1
	[0199.705] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0199.705] FindClose (in: hFindFile=0x7a0068 | out: hFindFile=0x7a0068) returned 1
	[0199.705] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization"), fInfoLevelId=0x0, lpFileInformation=0x12455f98 | out: lpFileInformation=0x12455f98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0199.706] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0199.706] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0028
	[0199.706] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.706] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataModels", cAlternateFileName="DATAMO~1")) returned 1
	[0199.706] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0199.706] FindClose (in: hFindFile=0x7a0028 | out: hFindFile=0x7a0028) returned 1
	[0199.706] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels"), fInfoLevelId=0x0, lpFileInformation=0x126cc058 | out: lpFileInformation=0x126cc058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0199.707] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0199.707] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fca8
	[0199.710] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.710] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Finance", cAlternateFileName="")) returned 1
	[0199.710] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FoodAndDrink", cAlternateFileName="FOODAN~1")) returned 1
	[0199.710] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Health", cAlternateFileName="")) returned 1
	[0199.710] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4f37d8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="News", cAlternateFileName="")) returned 1
	[0199.710] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4f37d8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports", cAlternateFileName="")) returned 1
	[0199.710] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4f37d8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather", cAlternateFileName="")) returned 1
	[0199.710] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0199.710] FindClose (in: hFindFile=0x79fca8 | out: hFindFile=0x79fca8) returned 1
	[0199.713] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Finance" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\finance"), fInfoLevelId=0x0, lpFileInformation=0x126cc288 | out: lpFileInformation=0x126cc288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0199.714] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Finance" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\finance"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0199.714] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Finance\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fd28
	[0199.714] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.714] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xdde, dwReserved0=0x0, dwReserved1=0x0, cFileName="Finance.xml", cAlternateFileName="")) returned 1
	[0199.714] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0199.715] FindClose (in: hFindFile=0x79fd28 | out: hFindFile=0x79fd28) returned 1
	[0199.715] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Finance\\Finance.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\finance\\finance.xml"), fInfoLevelId=0x0, lpFileInformation=0x126cc328 | out: lpFileInformation=0x126cc328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xdde)) returned 1
	[0199.717] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\FoodAndDrink" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\foodanddrink"), fInfoLevelId=0x0, lpFileInformation=0x126cc378 | out: lpFileInformation=0x126cc378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0199.718] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\FoodAndDrink" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\foodanddrink"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0199.718] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\FoodAndDrink\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fda8
	[0199.719] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.719] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xefe, dwReserved0=0x0, dwReserved1=0x0, cFileName="FoodAndDrink.xml", cAlternateFileName="")) returned 1
	[0199.719] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0199.719] FindClose (in: hFindFile=0x79fda8 | out: hFindFile=0x79fda8) returned 1
	[0199.719] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\FoodAndDrink\\FoodAndDrink.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\foodanddrink\\foodanddrink.xml"), fInfoLevelId=0x0, lpFileInformation=0x126cc418 | out: lpFileInformation=0x126cc418*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xefe)) returned 1
	[0199.724] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Health" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\health"), fInfoLevelId=0x0, lpFileInformation=0x126cc468 | out: lpFileInformation=0x126cc468*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0199.725] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Health" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\health"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0199.725] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Health\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fe68
	[0199.726] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.726] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x928, dwReserved0=0x0, dwReserved1=0x0, cFileName="Health.xml", cAlternateFileName="")) returned 1
	[0199.726] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0199.726] FindClose (in: hFindFile=0x79fe68 | out: hFindFile=0x79fe68) returned 1
	[0199.726] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Health\\Health.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\health\\health.xml"), fInfoLevelId=0x0, lpFileInformation=0x126cc508 | out: lpFileInformation=0x126cc508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf4cd598, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4cd598, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4cd598, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x928)) returned 1
	[0199.730] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\News" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\news"), fInfoLevelId=0x0, lpFileInformation=0x126cc558 | out: lpFileInformation=0x126cc558*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4f37d8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0199.731] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\News" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\news"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0199.731] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\News\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4f37d8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fa68
	[0199.731] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4f37d8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.731] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf4f37d8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="News.xml", cAlternateFileName="")) returned 1
	[0199.732] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0199.732] FindClose (in: hFindFile=0x79fa68 | out: hFindFile=0x79fa68) returned 1
	[0199.732] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\News\\News.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\news\\news.xml"), fInfoLevelId=0x0, lpFileInformation=0x126cc5f8 | out: lpFileInformation=0x126cc5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf4f37d8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x800)) returned 1
	[0199.736] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Sports" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\sports"), fInfoLevelId=0x0, lpFileInformation=0x126cc648 | out: lpFileInformation=0x126cc648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4f37d8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0199.736] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Sports" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\sports"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0199.736] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Sports\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4f37d8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffe8
	[0199.737] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4f37d8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.737] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf4f37d8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2249e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports.xml", cAlternateFileName="")) returned 1
	[0199.737] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0199.737] FindClose (in: hFindFile=0x79ffe8 | out: hFindFile=0x79ffe8) returned 1
	[0199.737] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Sports\\Sports.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\sports\\sports.xml"), fInfoLevelId=0x0, lpFileInformation=0x126cc6e8 | out: lpFileInformation=0x126cc6e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf4f37d8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2249e)) returned 1
	[0199.745] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Weather" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\weather"), fInfoLevelId=0x0, lpFileInformation=0x126cc738 | out: lpFileInformation=0x126cc738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4f37d8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0199.751] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Weather" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\weather"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0199.751] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Weather\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4f37d8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fd68
	[0199.751] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4f37d8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.752] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf4f37d8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xb19, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather.xml", cAlternateFileName="")) returned 1
	[0199.752] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0199.752] FindClose (in: hFindFile=0x79fd68 | out: hFindFile=0x79fd68) returned 1
	[0199.752] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Weather\\Weather.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\weather\\weather.xml"), fInfoLevelId=0x0, lpFileInformation=0x126cc7d8 | out: lpFileInformation=0x126cc7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf4f37d8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xb19)) returned 1
	[0199.756] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.shell"), fInfoLevelId=0x0, lpFileInformation=0x126cc828 | out: lpFileInformation=0x126cc828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4f37d8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0199.756] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.shell"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0199.756] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4f37d8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fde8
	[0199.756] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4f37d8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.756] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4f37d8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1
	[0199.756] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0199.757] FindClose (in: hFindFile=0x79fde8 | out: hFindFile=0x79fde8) returned 1
	[0199.757] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.shell\\themes"), fInfoLevelId=0x0, lpFileInformation=0x126cc8c8 | out: lpFileInformation=0x126cc8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4f37d8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0199.757] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.shell\\themes"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0199.757] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4f37d8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fc28
	[0199.757] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4f37d8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.757] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4f37d8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Glyphs", cAlternateFileName="")) returned 1
	[0199.757] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0199.757] FindClose (in: hFindFile=0x79fc28 | out: hFindFile=0x79fc28) returned 1
	[0199.758] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.shell\\themes\\glyphs"), fInfoLevelId=0x0, lpFileInformation=0x126cc968 | out: lpFileInformation=0x126cc968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4f37d8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0199.758] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.shell\\themes\\glyphs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0199.758] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4f37d8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fc68
	[0199.758] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4f37d8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.758] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4f37d8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Font", cAlternateFileName="")) returned 1
	[0199.758] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0199.758] FindClose (in: hFindFile=0x79fc68 | out: hFindFile=0x79fc68) returned 1
	[0199.759] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.shell\\themes\\glyphs\\font"), fInfoLevelId=0x0, lpFileInformation=0x126cca08 | out: lpFileInformation=0x126cca08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4f37d8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0199.759] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.shell\\themes\\glyphs\\font"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0199.759] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4f37d8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fea8
	[0199.759] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf4f37d8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.759] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf4f37d8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xcdcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNMDL2.ttf", cAlternateFileName="")) returned 1
	[0199.759] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf4f37d8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xf530, dwReserved0=0x0, dwReserved1=0x0, cFileName="WeatherColorIcons.ttf", cAlternateFileName="")) returned 1
	[0199.759] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0199.760] FindClose (in: hFindFile=0x79fea8 | out: hFindFile=0x79fea8) returned 1
	[0199.760] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\MSNMDL2.ttf" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.shell\\themes\\glyphs\\font\\msnmdl2.ttf"), fInfoLevelId=0x0, lpFileInformation=0x126ccaf8 | out: lpFileInformation=0x126ccaf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf4f37d8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xcdcc)) returned 1
	[0199.765] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\WeatherColorIcons.ttf" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.shell\\themes\\glyphs\\font\\weathercoloricons.ttf"), fInfoLevelId=0x0, lpFileInformation=0x126ccb48 | out: lpFileInformation=0x126ccb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf4f37d8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xf530)) returned 1
	[0199.771] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MicrosoftAdvertising.ini" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoftadvertising.ini"), fInfoLevelId=0x0, lpFileInformation=0x126ccb98 | out: lpFileInformation=0x126ccb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf4f37d8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf4f37d8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf4f37d8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xd)) returned 1
	[0199.772] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\PlatformConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\platformconfiguration.xml"), fInfoLevelId=0x0, lpFileInformation=0x126ccbe8 | out: lpFileInformation=0x126ccbe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf519a56, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf519a56, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf519a56, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x4413)) returned 1
	[0199.776] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\SQLite3Wrapper.dll" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\sqlite3wrapper.dll"), fInfoLevelId=0x0, lpFileInformation=0x126ccc38 | out: lpFileInformation=0x126ccc38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf565f1f, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf565f1f, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf58c102, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xe5200)) returned 1
	[0199.787] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\SQLiteWrapper.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\sqlitewrapper.winmd"), fInfoLevelId=0x0, lpFileInformation=0x126a1d18 | out: lpFileInformation=0x126a1d18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf5b2365, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf5b2365, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf5b2365, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1a00)) returned 1
	[0199.788] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\_resources"), fInfoLevelId=0x0, lpFileInformation=0x126a1d68 | out: lpFileInformation=0x126a1d68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcefbc21b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefbc21b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefbc21b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0199.788] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\_resources"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0199.789] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcefbc21b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefbc21b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefbc21b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fbe8
	[0199.789] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcefbc21b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefbc21b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefbc21b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.789] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefbc21b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefbc21b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefbc21b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2985, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.rsrc", cAlternateFileName="")) returned 1
	[0199.789] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefbc21b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefbc21b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefbc21b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa3, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.txt", cAlternateFileName="")) returned 1
	[0199.789] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0199.789] FindClose (in: hFindFile=0x79fbe8 | out: hFindFile=0x79fbe8) returned 1
	[0199.789] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\0.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\_resources\\0.rsrc"), fInfoLevelId=0x0, lpFileInformation=0x126a1e58 | out: lpFileInformation=0x126a1e58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefbc21b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefbc21b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefbc21b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2985)) returned 1
	[0199.791] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\index.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\_resources\\index.txt"), fInfoLevelId=0x0, lpFileInformation=0x126a1ea8 | out: lpFileInformation=0x126a1ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcefbc21b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcefbc21b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcefbc21b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa3)) returned 1
	[0199.793] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata"), fInfoLevelId=0x0, lpFileInformation=0x126a1ef8 | out: lpFileInformation=0x126a1ef8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x950bde7a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x950bde7a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x950bde7a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0199.795] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0199.795] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x950bde7a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x950bde7a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x950bde7a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fa28
	[0199.796] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x950bde7a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x950bde7a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x950bde7a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.796] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0199.796] FindClose (in: hFindFile=0x79fa28 | out: hFindFile=0x79fa28) returned 1
	[0199.796] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri"), fInfoLevelId=0x0, lpFileInformation=0x126a1f48 | out: lpFileInformation=0x126a1f48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf519a56, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcf519a56, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcf53fccb, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xdee88)) returned 1
	[0199.798] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_neutral_~_8wekyb3d8bbwe"), fInfoLevelId=0x0, lpFileInformation=0x126a1f98 | out: lpFileInformation=0x126a1f98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc825b3ce, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x95ddaedf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x95ddaedf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0199.799] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_neutral_~_8wekyb3d8bbwe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0199.799] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc825b3ce, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x95ddaedf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x95ddaedf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fe68
	[0199.808] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc825b3ce, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x95ddaedf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x95ddaedf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.808] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc825b3ce, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc825b3ce, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc825b3ce, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x154, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1
	[0199.808] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc825b3ce, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc825b3ce, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc825b3ce, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1
	[0199.808] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc825b3ce, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc825b3ce, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc828161d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2967, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1
	[0199.809] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x95ddaedf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x95ddaedf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x95ddaedf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1
	[0199.809] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0199.809] FindClose (in: hFindFile=0x79fe68 | out: hFindFile=0x79fe68) returned 1
	[0199.810] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml"), fInfoLevelId=0x0, lpFileInformation=0x12702148 | out: lpFileInformation=0x12702148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc825b3ce, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc825b3ce, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc825b3ce, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x154)) returned 1
	[0199.865] SetEvent (hEvent=0x168) returned 1
	[0199.865] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxmetadata"), fInfoLevelId=0x0, lpFileInformation=0x12702198 | out: lpFileInformation=0x12702198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc825b3ce, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc825b3ce, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc825b3ce, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0199.865] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxmetadata"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0199.865] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc825b3ce, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc825b3ce, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc825b3ce, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fde8
	[0199.866] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc825b3ce, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc825b3ce, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc825b3ce, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.866] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc825b3ce, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc825b3ce, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc825b3ce, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x643a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBundleManifest.xml", cAlternateFileName="")) returned 1
	[0199.866] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0199.866] FindClose (in: hFindFile=0x79fde8 | out: hFindFile=0x79fde8) returned 1
	[0199.866] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\appxbundlemanifest.xml"), fInfoLevelId=0x0, lpFileInformation=0x12702238 | out: lpFileInformation=0x12702238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc825b3ce, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc825b3ce, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc825b3ce, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x643a)) returned 1
	[0199.902] SetEvent (hEvent=0x168) returned 1
	[0199.903] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x"), fInfoLevelId=0x0, lpFileInformation=0x12702288 | out: lpFileInformation=0x12702288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc825b3ce, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc825b3ce, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc828161d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2967)) returned 1
	[0199.903] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata"), fInfoLevelId=0x0, lpFileInformation=0x127022d8 | out: lpFileInformation=0x127022d8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x95ddaedf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x95ddaedf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x95ddaedf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0199.913] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0199.914] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x95ddaedf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x95ddaedf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x95ddaedf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fbe8
	[0199.914] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x95ddaedf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x95ddaedf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x95ddaedf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.914] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0199.914] FindClose (in: hFindFile=0x79fbe8 | out: hFindFile=0x79fbe8) returned 1
	[0199.914] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe"), fInfoLevelId=0x0, lpFileInformation=0x12702328 | out: lpFileInformation=0x12702328*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc82cd965, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x95ddaedf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x95ddaedf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0199.915] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0199.915] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc82cd965, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x95ddaedf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x95ddaedf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fca8
	[0199.917] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc82cd965, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x95ddaedf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x95ddaedf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.919] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82f3dcc, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82f3dcc, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82f3dcc, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x502d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConfiguration.xml", cAlternateFileName="")) returned 1
	[0199.920] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82cd965, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82cd965, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82cd965, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x6eb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1
	[0199.920] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82cd965, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82cd965, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82cd965, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2092, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1
	[0199.920] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc82cd965, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82cd965, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82cd965, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1
	[0199.920] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82cd965, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82cd965, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82cd965, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2992, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1
	[0199.920] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc82f3dcc, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82f3dcc, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82f3dcc, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1
	[0199.920] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc838c6b4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc838c6b4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc838c6b4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xe958, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClrCompression.dll", cAlternateFileName="")) returned 1
	[0199.920] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc838c6b4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc838c6b4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc838c6b4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Configuration", cAlternateFileName="CONFIG~1")) returned 1
	[0199.920] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc838c6b4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc838c6b4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc838c6b4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9572, dwReserved0=0x0, dwReserved1=0x0, cFileName="MarketConfiguration.xml", cAlternateFileName="")) returned 1
	[0199.920] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc84714f8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc84714f8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc84714f8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising", cAlternateFileName="MICROS~1.ADV")) returned 1
	[0199.920] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc838c6b4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc838c6b4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc84714f8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x35acb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising.dll", cAlternateFileName="")) returned 1
	[0199.920] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84714f8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc84714f8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc84714f8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising.winmd", cAlternateFileName="")) returned 1
	[0199.920] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8497748, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8497748, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc84bd9c1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9d800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Aria.ClientTelemetry.dll", cAlternateFileName="")) returned 1
	[0199.920] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84bd9c1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc84bd9c1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc84bd9c1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Aria.ClientTelemetry.winmd", cAlternateFileName="")) returned 1
	[0199.920] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84bd9c1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc84bd9c1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc876c47a, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa20e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Msn.News.dll", cAlternateFileName="")) returned 1
	[0199.920] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc876c47a, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc876c47a, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc879270b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Msn.News.exe", cAlternateFileName="")) returned 1
	[0199.920] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc879270b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc879270b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Msn.Services", cAlternateFileName="MICROS~1.SER")) returned 1
	[0199.920] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc87b89af, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87b89af, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87b89af, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Msn.Shell", cAlternateFileName="MICROS~1.SHE")) returned 1
	[0199.920] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x95ddaedf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x95ddaedf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x95ddaedf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1
	[0199.921] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87b89af, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87b89af, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87b89af, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftAdvertising.ini", cAlternateFileName="")) returned 1
	[0199.921] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc87b89af, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87dec1a, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87dec1a, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSAdvertisingJS", cAlternateFileName="MSADVE~1")) returned 1
	[0199.921] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87dec1a, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87dec1a, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87dec1a, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x4413, dwReserved0=0x0, dwReserved1=0x0, cFileName="PlatformConfiguration.xml", cAlternateFileName="")) returned 1
	[0199.921] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87dec1a, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87dec1a, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8804e2b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x6c528, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 1
	[0199.921] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8804e2b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8804e2b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc88512d9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xe5200, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQLite3Wrapper.dll", cAlternateFileName="")) returned 1
	[0199.921] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc88512d9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc88512d9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc88512d9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQLiteWrapper.winmd", cAlternateFileName="")) returned 1
	[0199.921] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc82cd965, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82cd965, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82cd965, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 1
	[0199.921] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0199.921] FindClose (in: hFindFile=0x79fca8 | out: hFindFile=0x79fca8) returned 1
	[0199.922] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\appconfiguration.xml"), fInfoLevelId=0x0, lpFileInformation=0x12702b98 | out: lpFileInformation=0x12702b98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82f3dcc, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82f3dcc, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82f3dcc, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x502d)) returned 1
	[0199.924] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\appxblockmap.xml"), fInfoLevelId=0x0, lpFileInformation=0x12702be8 | out: lpFileInformation=0x12702be8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82cd965, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82cd965, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82cd965, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x6eb3)) returned 1
	[0199.924] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\appxmanifest.xml"), fInfoLevelId=0x0, lpFileInformation=0x12702c38 | out: lpFileInformation=0x12702c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82cd965, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82cd965, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82cd965, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2092)) returned 1
	[0199.924] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\appxmetadata"), fInfoLevelId=0x0, lpFileInformation=0x12702c88 | out: lpFileInformation=0x12702c88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc82cd965, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82cd965, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82cd965, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0199.924] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\appxmetadata"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0199.924] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc82cd965, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82cd965, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82cd965, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fc28
	[0199.925] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc82cd965, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82cd965, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82cd965, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.925] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82cd965, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82cd965, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82cd965, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2fe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 1
	[0199.925] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0199.925] FindClose (in: hFindFile=0x79fc28 | out: hFindFile=0x79fc28) returned 1
	[0199.925] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat"), fInfoLevelId=0x0, lpFileInformation=0x12702d28 | out: lpFileInformation=0x12702d28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82cd965, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82cd965, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82cd965, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2fe3)) returned 1
	[0199.929] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\appxsignature.p7x"), fInfoLevelId=0x0, lpFileInformation=0x12702d78 | out: lpFileInformation=0x12702d78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82cd965, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82cd965, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82cd965, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2992)) returned 1
	[0199.929] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets"), fInfoLevelId=0x0, lpFileInformation=0x12702dc8 | out: lpFileInformation=0x12702dc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc82f3dcc, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82f3dcc, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82f3dcc, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0199.931] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0199.931] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc82f3dcc, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82f3dcc, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82f3dcc, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0068
	[0199.931] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc82f3dcc, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82f3dcc, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82f3dcc, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.931] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc82f3dcc, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc83663cb, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc83663cb, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppTiles", cAlternateFileName="")) returned 1
	[0199.931] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0199.931] FindClose (in: hFindFile=0x7a0068 | out: hFindFile=0x7a0068) returned 1
	[0199.931] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles"), fInfoLevelId=0x0, lpFileInformation=0x12702e68 | out: lpFileInformation=0x12702e68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc82f3dcc, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc83663cb, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc83663cb, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0199.932] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0199.932] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc82f3dcc, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc83663cb, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc83663cb, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fda8
	[0199.966] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc82f3dcc, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc83663cb, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc83663cb, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0199.966] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc82f3dcc, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8319f90, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8319f90, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-black", cAlternateFileName="CONTRA~1")) returned 1
	[0199.966] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc8319f90, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8340221, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8340221, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 1
	[0199.966] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8340221, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8340221, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8340221, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.scale-100.png", cAlternateFileName="")) returned 1
	[0199.966] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8340221, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8340221, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8340221, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-16.png", cAlternateFileName="")) returned 1
	[0199.966] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8340221, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8340221, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8340221, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-24.png", cAlternateFileName="")) returned 1
	[0199.966] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8340221, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8340221, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8340221, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x386, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-256.png", cAlternateFileName="")) returned 1
	[0199.966] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc83663cb, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc83663cb, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc83663cb, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-32.png", cAlternateFileName="")) returned 1
	[0199.967] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc83663cb, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc83663cb, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc83663cb, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-48.png", cAlternateFileName="")) returned 1
	[0199.967] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc83663cb, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc83663cb, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc83663cb, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x428, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_SplashScreen.scale-100.png", cAlternateFileName="")) returned 1
	[0199.967] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc83663cb, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc83663cb, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc83663cb, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x355, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_TileLargeSquare.scale-100.png", cAlternateFileName="")) returned 1
	[0199.967] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc83663cb, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc83663cb, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc83663cb, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x167, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_TileMediumSquare.scale-100.png", cAlternateFileName="")) returned 1
	[0199.967] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc83663cb, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc83663cb, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc83663cb, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_TileSmallSquare.scale-100.png", cAlternateFileName="")) returned 1
	[0199.967] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc83663cb, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc83663cb, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc83663cb, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_TileWide.scale-100.png", cAlternateFileName="")) returned 1
	[0199.967] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc83663cb, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc83663cb, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc83663cb, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa4, dwReserved0=0x0, dwReserved1=0x0, cFileName="StoreLogo.png", cAlternateFileName="")) returned 1
	[0199.967] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0199.967] FindClose (in: hFindFile=0x79fda8 | out: hFindFile=0x79fda8) returned 1
	[0199.968] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_logosmall.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x126cd0e8 | out: lpFileInformation=0x126cd0e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8340221, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8340221, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8340221, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa7)) returned 1
	[0199.971] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_logosmall.targetsize-16.png"), fInfoLevelId=0x0, lpFileInformation=0x126cd138 | out: lpFileInformation=0x126cd138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8340221, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8340221, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8340221, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x80)) returned 1
	[0199.974] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_logosmall.targetsize-24.png"), fInfoLevelId=0x0, lpFileInformation=0x126cd188 | out: lpFileInformation=0x126cd188*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8340221, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8340221, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8340221, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x96)) returned 1
	[0199.974] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_logosmall.targetsize-256.png"), fInfoLevelId=0x0, lpFileInformation=0x126cd1d8 | out: lpFileInformation=0x126cd1d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8340221, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8340221, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8340221, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x386)) returned 1
	[0199.975] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_logosmall.targetsize-32.png"), fInfoLevelId=0x0, lpFileInformation=0x126cd228 | out: lpFileInformation=0x126cd228*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc83663cb, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc83663cb, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc83663cb, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xad)) returned 1
	[0199.982] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_LogoSmall.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_logosmall.targetsize-48.png"), fInfoLevelId=0x0, lpFileInformation=0x126cd278 | out: lpFileInformation=0x126cd278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc83663cb, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc83663cb, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc83663cb, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xb6)) returned 1
	[0199.982] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_splashscreen.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x126cd2c8 | out: lpFileInformation=0x126cd2c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc83663cb, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc83663cb, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc83663cb, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x428)) returned 1
	[0199.986] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_TileLargeSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_tilelargesquare.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x126cd318 | out: lpFileInformation=0x126cd318*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc83663cb, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc83663cb, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc83663cb, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x355)) returned 1
	[0199.989] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_TileMediumSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_tilemediumsquare.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x126cd368 | out: lpFileInformation=0x126cd368*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc83663cb, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc83663cb, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc83663cb, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x167)) returned 1
	[0199.990] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_TileSmallSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_tilesmallsquare.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x126cd3b8 | out: lpFileInformation=0x126cd3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc83663cb, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc83663cb, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc83663cb, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xd6)) returned 1
	[0199.991] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\News_TileWide.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\news_tilewide.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x126cd408 | out: lpFileInformation=0x126cd408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc83663cb, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc83663cb, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc83663cb, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1e5)) returned 1
	[0200.017] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\StoreLogo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\storelogo.png"), fInfoLevelId=0x0, lpFileInformation=0x126cd458 | out: lpFileInformation=0x126cd458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc83663cb, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc83663cb, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc83663cb, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa4)) returned 1
	[0200.018] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black"), fInfoLevelId=0x0, lpFileInformation=0x126cd4a8 | out: lpFileInformation=0x126cd4a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc82f3dcc, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8319f90, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8319f90, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.018] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.018] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc82f3dcc, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8319f90, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8319f90, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0068
	[0200.044] SetEvent (hEvent=0x168) returned 1
	[0200.045] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc82f3dcc, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8319f90, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8319f90, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.045] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82f3dcc, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82f3dcc, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82f3dcc, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.scale-100.png", cAlternateFileName="")) returned 1
	[0200.045] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82f3dcc, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82f3dcc, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82f3dcc, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-16.png", cAlternateFileName="")) returned 1
	[0200.045] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82f3dcc, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82f3dcc, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82f3dcc, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-24.png", cAlternateFileName="")) returned 1
	[0200.045] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82f3dcc, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82f3dcc, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82f3dcc, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x386, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-256.png", cAlternateFileName="")) returned 1
	[0200.045] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82f3dcc, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82f3dcc, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82f3dcc, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-32.png", cAlternateFileName="")) returned 1
	[0200.045] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82f3dcc, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82f3dcc, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82f3dcc, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-48.png", cAlternateFileName="")) returned 1
	[0200.045] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82f3dcc, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82f3dcc, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82f3dcc, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x428, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_SplashScreen.scale-100.png", cAlternateFileName="")) returned 1
	[0200.045] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82f3dcc, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82f3dcc, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82f3dcc, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x355, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_TileLargeSquare.scale-100.png", cAlternateFileName="")) returned 1
	[0200.045] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82f3dcc, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82f3dcc, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82f3dcc, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x167, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_TileMediumSquare.scale-100.png", cAlternateFileName="")) returned 1
	[0200.045] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8319f90, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8319f90, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8319f90, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_TileSmallSquare.scale-100.png", cAlternateFileName="")) returned 1
	[0200.045] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8319f90, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8319f90, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8319f90, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_TileWide.scale-100.png", cAlternateFileName="")) returned 1
	[0200.045] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.045] FindClose (in: hFindFile=0x7a0068 | out: hFindFile=0x7a0068) returned 1
	[0200.046] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_logosmall.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x126cd868 | out: lpFileInformation=0x126cd868*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82f3dcc, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82f3dcc, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82f3dcc, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa7)) returned 1
	[0200.048] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_logosmall.targetsize-16.png"), fInfoLevelId=0x0, lpFileInformation=0x126cd8b8 | out: lpFileInformation=0x126cd8b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82f3dcc, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82f3dcc, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82f3dcc, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x80)) returned 1
	[0200.048] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_logosmall.targetsize-24.png"), fInfoLevelId=0x0, lpFileInformation=0x126cd908 | out: lpFileInformation=0x126cd908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82f3dcc, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82f3dcc, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82f3dcc, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x96)) returned 1
	[0200.048] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_logosmall.targetsize-256.png"), fInfoLevelId=0x0, lpFileInformation=0x126cd958 | out: lpFileInformation=0x126cd958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82f3dcc, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82f3dcc, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82f3dcc, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x386)) returned 1
	[0200.049] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_logosmall.targetsize-32.png"), fInfoLevelId=0x0, lpFileInformation=0x126cd9a8 | out: lpFileInformation=0x126cd9a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82f3dcc, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82f3dcc, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82f3dcc, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xad)) returned 1
	[0200.049] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_LogoSmall.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_logosmall.targetsize-48.png"), fInfoLevelId=0x0, lpFileInformation=0x126cd9f8 | out: lpFileInformation=0x126cd9f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82f3dcc, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82f3dcc, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82f3dcc, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xb6)) returned 1
	[0200.049] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_splashscreen.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x126cda48 | out: lpFileInformation=0x126cda48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82f3dcc, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82f3dcc, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82f3dcc, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x428)) returned 1
	[0200.049] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_TileLargeSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_tilelargesquare.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x126cda98 | out: lpFileInformation=0x126cda98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82f3dcc, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82f3dcc, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82f3dcc, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x355)) returned 1
	[0200.050] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_TileMediumSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_tilemediumsquare.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x126cdae8 | out: lpFileInformation=0x126cdae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82f3dcc, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82f3dcc, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82f3dcc, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x167)) returned 1
	[0200.050] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_TileSmallSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_tilesmallsquare.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x126cdb38 | out: lpFileInformation=0x126cdb38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8319f90, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8319f90, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8319f90, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xd6)) returned 1
	[0200.050] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\News_TileWide.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\news_tilewide.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x126cdb88 | out: lpFileInformation=0x126cdb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8319f90, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8319f90, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8319f90, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1e5)) returned 1
	[0200.050] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white"), fInfoLevelId=0x0, lpFileInformation=0x126cdbd8 | out: lpFileInformation=0x126cdbd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc8319f90, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8340221, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8340221, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.050] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.051] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc8319f90, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8340221, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8340221, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fd28
	[0200.073] SetEvent (hEvent=0x168) returned 1
	[0200.073] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc8319f90, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8340221, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8340221, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.073] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8319f90, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8319f90, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8319f90, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.scale-100.png", cAlternateFileName="")) returned 1
	[0200.074] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8319f90, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8319f90, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8319f90, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-16.png", cAlternateFileName="")) returned 1
	[0200.074] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8319f90, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8319f90, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8319f90, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-24.png", cAlternateFileName="")) returned 1
	[0200.074] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8319f90, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8319f90, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8319f90, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x372, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-256.png", cAlternateFileName="")) returned 1
	[0200.074] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8319f90, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8319f90, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8319f90, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-32.png", cAlternateFileName="")) returned 1
	[0200.075] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8319f90, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8319f90, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8319f90, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_LogoSmall.targetsize-48.png", cAlternateFileName="")) returned 1
	[0200.075] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8319f90, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8319f90, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8319f90, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x412, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_SplashScreen.scale-100.png", cAlternateFileName="")) returned 1
	[0200.075] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8340221, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8340221, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8340221, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x341, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_TileLargeSquare.scale-100.png", cAlternateFileName="")) returned 1
	[0200.075] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8340221, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8340221, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8340221, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_TileMediumSquare.scale-100.png", cAlternateFileName="")) returned 1
	[0200.075] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8340221, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8340221, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8340221, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_TileSmallSquare.scale-100.png", cAlternateFileName="")) returned 1
	[0200.075] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8340221, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8340221, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8340221, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="News_TileWide.scale-100.png", cAlternateFileName="")) returned 1
	[0200.075] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.075] FindClose (in: hFindFile=0x79fd28 | out: hFindFile=0x79fd28) returned 1
	[0200.077] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\news_logosmall.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x126cdf98 | out: lpFileInformation=0x126cdf98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8319f90, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8319f90, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8319f90, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa0)) returned 1
	[0200.079] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\news_logosmall.targetsize-16.png"), fInfoLevelId=0x0, lpFileInformation=0x12722008 | out: lpFileInformation=0x12722008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8319f90, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8319f90, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8319f90, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x7b)) returned 1
	[0200.080] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\news_logosmall.targetsize-24.png"), fInfoLevelId=0x0, lpFileInformation=0x12722058 | out: lpFileInformation=0x12722058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8319f90, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8319f90, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8319f90, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x8e)) returned 1
	[0200.080] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\news_logosmall.targetsize-256.png"), fInfoLevelId=0x0, lpFileInformation=0x127220a8 | out: lpFileInformation=0x127220a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8319f90, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8319f90, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8319f90, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x372)) returned 1
	[0200.081] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\news_logosmall.targetsize-32.png"), fInfoLevelId=0x0, lpFileInformation=0x127220f8 | out: lpFileInformation=0x127220f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8319f90, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8319f90, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8319f90, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa7)) returned 1
	[0200.082] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_LogoSmall.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\news_logosmall.targetsize-48.png"), fInfoLevelId=0x0, lpFileInformation=0x12722148 | out: lpFileInformation=0x12722148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8319f90, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8319f90, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8319f90, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xaf)) returned 1
	[0200.082] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\news_splashscreen.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x12722198 | out: lpFileInformation=0x12722198*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8319f90, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8319f90, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8319f90, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x412)) returned 1
	[0200.086] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_TileLargeSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\news_tilelargesquare.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x127221e8 | out: lpFileInformation=0x127221e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8340221, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8340221, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8340221, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x341)) returned 1
	[0200.087] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_TileMediumSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\news_tilemediumsquare.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x12722238 | out: lpFileInformation=0x12722238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8340221, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8340221, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8340221, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x15e)) returned 1
	[0200.089] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_TileSmallSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\news_tilesmallsquare.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x12722288 | out: lpFileInformation=0x12722288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8340221, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8340221, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8340221, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xd5)) returned 1
	[0200.089] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\News_TileWide.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\news_tilewide.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x127222d8 | out: lpFileInformation=0x127222d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8340221, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8340221, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8340221, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1d8)) returned 1
	[0200.089] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\ClrCompression.dll" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\clrcompression.dll"), fInfoLevelId=0x0, lpFileInformation=0x12722328 | out: lpFileInformation=0x12722328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc838c6b4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc838c6b4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc838c6b4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xe958)) returned 1
	[0200.089] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\configuration"), fInfoLevelId=0x0, lpFileInformation=0x12722378 | out: lpFileInformation=0x12722378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc838c6b4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc838c6b4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc838c6b4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.091] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\configuration"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.091] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc838c6b4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc838c6b4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc838c6b4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fc28
	[0200.091] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc838c6b4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc838c6b4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc838c6b4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.092] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc838c6b4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc838c6b4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc838c6b4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="configuration.sqlite", cAlternateFileName="")) returned 1
	[0200.092] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.092] FindClose (in: hFindFile=0x79fc28 | out: hFindFile=0x79fc28) returned 1
	[0200.092] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite"), fInfoLevelId=0x0, lpFileInformation=0x12722418 | out: lpFileInformation=0x12722418*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc838c6b4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc838c6b4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc838c6b4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1b000)) returned 1
	[0200.092] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\msadvertisingjs"), fInfoLevelId=0x0, lpFileInformation=0x12722468 | out: lpFileInformation=0x12722468*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc87b89af, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87dec1a, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87dec1a, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.095] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\msadvertisingjs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.095] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc87b89af, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87dec1a, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87dec1a, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fc28
	[0200.096] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc87b89af, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87dec1a, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87dec1a, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.096] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87b89af, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87b89af, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87b89af, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x4be9, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootstrap.js", cAlternateFileName="")) returned 1
	[0200.096] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87dec1a, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87dec1a, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87dec1a, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x73d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ormma.js", cAlternateFileName="")) returned 1
	[0200.096] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.096] FindClose (in: hFindFile=0x79fc28 | out: hFindFile=0x79fc28) returned 1
	[0200.096] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\bootstrap.js" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\msadvertisingjs\\bootstrap.js"), fInfoLevelId=0x0, lpFileInformation=0x12722558 | out: lpFileInformation=0x12722558*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87b89af, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87b89af, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87b89af, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x4be9)) returned 1
	[0200.096] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\ormma.js" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\msadvertisingjs\\ormma.js"), fInfoLevelId=0x0, lpFileInformation=0x127225a8 | out: lpFileInformation=0x127225a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87dec1a, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87dec1a, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87dec1a, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x73d8)) returned 1
	[0200.098] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MarketConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\marketconfiguration.xml"), fInfoLevelId=0x0, lpFileInformation=0x127225f8 | out: lpFileInformation=0x127225f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc838c6b4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc838c6b4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc838c6b4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9572)) returned 1
	[0200.098] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising"), fInfoLevelId=0x0, lpFileInformation=0x12722648 | out: lpFileInformation=0x12722648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc84714f8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc84714f8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc84714f8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.098] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.099] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc84714f8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc84714f8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc84714f8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fee8
	[0200.099] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc84714f8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc84714f8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc84714f8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.099] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84714f8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc84714f8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc84714f8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x62f, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootstrap.html", cAlternateFileName="")) returned 1
	[0200.099] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc84714f8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8497748, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8497748, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1
	[0200.099] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.099] FindClose (in: hFindFile=0x79fee8 | out: hFindFile=0x79fee8) returned 1
	[0200.099] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising\\themes"), fInfoLevelId=0x0, lpFileInformation=0x12722738 | out: lpFileInformation=0x12722738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc84714f8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8497748, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8497748, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.099] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising\\themes"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.099] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc84714f8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8497748, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8497748, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79faa8
	[0200.100] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc84714f8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8497748, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8497748, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.100] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8497748, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8497748, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8497748, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Generic.xbf", cAlternateFileName="")) returned 1
	[0200.100] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.100] FindClose (in: hFindFile=0x79faa8 | out: hFindFile=0x79faa8) returned 1
	[0200.100] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\Generic.xbf" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising\\themes\\generic.xbf"), fInfoLevelId=0x0, lpFileInformation=0x127227d8 | out: lpFileInformation=0x127227d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8497748, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8497748, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8497748, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2ef)) returned 1
	[0200.100] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising\\bootstrap.html"), fInfoLevelId=0x0, lpFileInformation=0x12722828 | out: lpFileInformation=0x12722828*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84714f8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc84714f8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc84714f8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x62f)) returned 1
	[0200.100] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.dll" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising.dll"), fInfoLevelId=0x0, lpFileInformation=0x12722878 | out: lpFileInformation=0x12722878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc838c6b4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc838c6b4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc84714f8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x35acb0)) returned 1
	[0200.101] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising.winmd"), fInfoLevelId=0x0, lpFileInformation=0x127228c8 | out: lpFileInformation=0x127228c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84714f8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc84714f8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc84714f8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa4b0)) returned 1
	[0200.101] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Aria.ClientTelemetry.dll" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.aria.clienttelemetry.dll"), fInfoLevelId=0x0, lpFileInformation=0x12722918 | out: lpFileInformation=0x12722918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8497748, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8497748, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc84bd9c1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9d800)) returned 1
	[0200.101] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Aria.ClientTelemetry.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.aria.clienttelemetry.winmd"), fInfoLevelId=0x0, lpFileInformation=0x12722968 | out: lpFileInformation=0x12722968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84bd9c1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc84bd9c1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc84bd9c1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2a00)) returned 1
	[0200.101] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.News.dll" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.news.dll"), fInfoLevelId=0x0, lpFileInformation=0x127229b8 | out: lpFileInformation=0x127229b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84bd9c1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc84bd9c1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc876c47a, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa20e00)) returned 1
	[0200.113] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.News.exe" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.news.exe"), fInfoLevelId=0x0, lpFileInformation=0x12722a08 | out: lpFileInformation=0x12722a08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc876c47a, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc876c47a, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc879270b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x3e00)) returned 1
	[0200.113] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services"), fInfoLevelId=0x0, lpFileInformation=0x12722a58 | out: lpFileInformation=0x12722a58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc879270b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc879270b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.113] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.114] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc879270b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc879270b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ff68
	[0200.114] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc879270b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc879270b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.114] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc879270b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc879270b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Personalization", cAlternateFileName="PERSON~1")) returned 1
	[0200.114] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.114] FindClose (in: hFindFile=0x79ff68 | out: hFindFile=0x79ff68) returned 1
	[0200.114] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization"), fInfoLevelId=0x0, lpFileInformation=0x12722af8 | out: lpFileInformation=0x12722af8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc879270b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc879270b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.115] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.115] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc879270b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc879270b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fa28
	[0200.115] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc879270b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc879270b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.116] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87b89af, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87b89af, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataModels", cAlternateFileName="DATAMO~1")) returned 1
	[0200.116] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.116] FindClose (in: hFindFile=0x79fa28 | out: hFindFile=0x79fa28) returned 1
	[0200.116] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels"), fInfoLevelId=0x0, lpFileInformation=0x12722b98 | out: lpFileInformation=0x12722b98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87b89af, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87b89af, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.116] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.116] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87b89af, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87b89af, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ff68
	[0200.118] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87b89af, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87b89af, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.118] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc879270b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc879270b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Finance", cAlternateFileName="")) returned 1
	[0200.118] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc879270b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc879270b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FoodAndDrink", cAlternateFileName="FOODAN~1")) returned 1
	[0200.118] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc879270b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc879270b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Health", cAlternateFileName="")) returned 1
	[0200.118] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc879270b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc879270b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="News", cAlternateFileName="")) returned 1
	[0200.118] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc879270b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc879270b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports", cAlternateFileName="")) returned 1
	[0200.118] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc87b89af, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87b89af, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87b89af, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather", cAlternateFileName="")) returned 1
	[0200.118] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.119] FindClose (in: hFindFile=0x79ff68 | out: hFindFile=0x79ff68) returned 1
	[0200.119] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Finance" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\finance"), fInfoLevelId=0x0, lpFileInformation=0x12722dc8 | out: lpFileInformation=0x12722dc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc879270b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc879270b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.120] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Finance" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\finance"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.120] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Finance\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc879270b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc879270b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9a8
	[0200.121] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc879270b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc879270b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.121] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc879270b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc879270b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xdde, dwReserved0=0x0, dwReserved1=0x0, cFileName="Finance.xml", cAlternateFileName="")) returned 1
	[0200.121] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.121] FindClose (in: hFindFile=0x79f9a8 | out: hFindFile=0x79f9a8) returned 1
	[0200.121] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Finance\\Finance.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\finance\\finance.xml"), fInfoLevelId=0x0, lpFileInformation=0x12722e68 | out: lpFileInformation=0x12722e68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc879270b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc879270b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xdde)) returned 1
	[0200.121] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\FoodAndDrink" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\foodanddrink"), fInfoLevelId=0x0, lpFileInformation=0x12722eb8 | out: lpFileInformation=0x12722eb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc879270b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc879270b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.121] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\FoodAndDrink" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\foodanddrink"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.121] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\FoodAndDrink\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc879270b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc879270b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fea8
	[0200.121] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc879270b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc879270b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.121] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc879270b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc879270b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xefe, dwReserved0=0x0, dwReserved1=0x0, cFileName="FoodAndDrink.xml", cAlternateFileName="")) returned 1
	[0200.121] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.122] FindClose (in: hFindFile=0x79fea8 | out: hFindFile=0x79fea8) returned 1
	[0200.122] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\FoodAndDrink\\FoodAndDrink.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\foodanddrink\\foodanddrink.xml"), fInfoLevelId=0x0, lpFileInformation=0x12722f58 | out: lpFileInformation=0x12722f58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc879270b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc879270b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xefe)) returned 1
	[0200.122] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Health" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\health"), fInfoLevelId=0x0, lpFileInformation=0x12722fa8 | out: lpFileInformation=0x12722fa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc879270b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc879270b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.123] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Health" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\health"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.123] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Health\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc879270b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc879270b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fd68
	[0200.123] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc879270b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc879270b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.124] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc879270b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc879270b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x928, dwReserved0=0x0, dwReserved1=0x0, cFileName="Health.xml", cAlternateFileName="")) returned 1
	[0200.124] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.124] FindClose (in: hFindFile=0x79fd68 | out: hFindFile=0x79fd68) returned 1
	[0200.124] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Health\\Health.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\health\\health.xml"), fInfoLevelId=0x0, lpFileInformation=0x12723048 | out: lpFileInformation=0x12723048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc879270b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc879270b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x928)) returned 1
	[0200.124] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\News" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\news"), fInfoLevelId=0x0, lpFileInformation=0x12723098 | out: lpFileInformation=0x12723098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc879270b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc879270b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.124] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\News" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\news"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.124] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\News\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc879270b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc879270b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fae8
	[0200.124] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc879270b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc879270b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.124] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc879270b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc879270b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="News.xml", cAlternateFileName="")) returned 1
	[0200.124] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.124] FindClose (in: hFindFile=0x79fae8 | out: hFindFile=0x79fae8) returned 1
	[0200.125] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\News\\News.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\news\\news.xml"), fInfoLevelId=0x0, lpFileInformation=0x12723138 | out: lpFileInformation=0x12723138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc879270b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc879270b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x800)) returned 1
	[0200.125] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Sports" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\sports"), fInfoLevelId=0x0, lpFileInformation=0x12723188 | out: lpFileInformation=0x12723188*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc879270b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc879270b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.125] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Sports" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\sports"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.125] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Sports\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc879270b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc879270b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9a8
	[0200.125] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc879270b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc879270b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.125] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc879270b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc879270b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2249e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports.xml", cAlternateFileName="")) returned 1
	[0200.126] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.126] FindClose (in: hFindFile=0x79f9a8 | out: hFindFile=0x79f9a8) returned 1
	[0200.126] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Sports\\Sports.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\sports\\sports.xml"), fInfoLevelId=0x0, lpFileInformation=0x12723228 | out: lpFileInformation=0x12723228*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc879270b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc879270b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc879270b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2249e)) returned 1
	[0200.126] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Weather" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\weather"), fInfoLevelId=0x0, lpFileInformation=0x12723278 | out: lpFileInformation=0x12723278*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc87b89af, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87b89af, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87b89af, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.126] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Weather" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\weather"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.126] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Weather\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc87b89af, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87b89af, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87b89af, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79faa8
	[0200.126] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc87b89af, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87b89af, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87b89af, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.126] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87b89af, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87b89af, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87b89af, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xb19, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather.xml", cAlternateFileName="")) returned 1
	[0200.126] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.127] FindClose (in: hFindFile=0x79faa8 | out: hFindFile=0x79faa8) returned 1
	[0200.127] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Weather\\Weather.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\weather\\weather.xml"), fInfoLevelId=0x0, lpFileInformation=0x12723318 | out: lpFileInformation=0x12723318*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87b89af, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87b89af, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87b89af, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xb19)) returned 1
	[0200.127] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.shell"), fInfoLevelId=0x0, lpFileInformation=0x12723368 | out: lpFileInformation=0x12723368*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc87b89af, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87b89af, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87b89af, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.130] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.shell"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.130] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc87b89af, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87b89af, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87b89af, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fe28
	[0200.130] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc87b89af, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87b89af, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87b89af, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.130] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc87b89af, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87b89af, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87b89af, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1
	[0200.130] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.130] FindClose (in: hFindFile=0x79fe28 | out: hFindFile=0x79fe28) returned 1
	[0200.130] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.shell\\themes"), fInfoLevelId=0x0, lpFileInformation=0x12723408 | out: lpFileInformation=0x12723408*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc87b89af, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87b89af, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87b89af, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.130] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.shell\\themes"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.130] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc87b89af, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87b89af, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87b89af, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9e8
	[0200.131] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc87b89af, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87b89af, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87b89af, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.131] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc87b89af, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87b89af, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87b89af, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Glyphs", cAlternateFileName="")) returned 1
	[0200.131] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.131] FindClose (in: hFindFile=0x79f9e8 | out: hFindFile=0x79f9e8) returned 1
	[0200.131] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.shell\\themes\\glyphs"), fInfoLevelId=0x0, lpFileInformation=0x127234a8 | out: lpFileInformation=0x127234a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc87b89af, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87b89af, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87b89af, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.131] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.shell\\themes\\glyphs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.131] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc87b89af, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87b89af, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87b89af, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fba8
	[0200.131] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc87b89af, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87b89af, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87b89af, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.131] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc87b89af, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87b89af, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87b89af, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Font", cAlternateFileName="")) returned 1
	[0200.131] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.131] FindClose (in: hFindFile=0x79fba8 | out: hFindFile=0x79fba8) returned 1
	[0200.131] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.shell\\themes\\glyphs\\font"), fInfoLevelId=0x0, lpFileInformation=0x12723548 | out: lpFileInformation=0x12723548*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc87b89af, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87b89af, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87b89af, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.132] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.shell\\themes\\glyphs\\font"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.132] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc87b89af, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87b89af, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87b89af, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fe68
	[0200.132] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc87b89af, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87b89af, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87b89af, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.132] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87b89af, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87b89af, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87b89af, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xcdcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNMDL2.ttf", cAlternateFileName="")) returned 1
	[0200.132] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87b89af, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87b89af, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87b89af, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xf530, dwReserved0=0x0, dwReserved1=0x0, cFileName="WeatherColorIcons.ttf", cAlternateFileName="")) returned 1
	[0200.132] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.132] FindClose (in: hFindFile=0x79fe68 | out: hFindFile=0x79fe68) returned 1
	[0200.132] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\MSNMDL2.ttf" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.shell\\themes\\glyphs\\font\\msnmdl2.ttf"), fInfoLevelId=0x0, lpFileInformation=0x12723638 | out: lpFileInformation=0x12723638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87b89af, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87b89af, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87b89af, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xcdcc)) returned 1
	[0200.132] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\WeatherColorIcons.ttf" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.shell\\themes\\glyphs\\font\\weathercoloricons.ttf"), fInfoLevelId=0x0, lpFileInformation=0x12723688 | out: lpFileInformation=0x12723688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87b89af, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87b89af, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87b89af, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xf530)) returned 1
	[0200.132] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MicrosoftAdvertising.ini" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoftadvertising.ini"), fInfoLevelId=0x0, lpFileInformation=0x127236d8 | out: lpFileInformation=0x127236d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87b89af, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87b89af, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87b89af, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xd)) returned 1
	[0200.133] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\PlatformConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\platformconfiguration.xml"), fInfoLevelId=0x0, lpFileInformation=0x12723728 | out: lpFileInformation=0x12723728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87dec1a, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87dec1a, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc87dec1a, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x4413)) returned 1
	[0200.133] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\SQLite3Wrapper.dll" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\sqlite3wrapper.dll"), fInfoLevelId=0x0, lpFileInformation=0x12723778 | out: lpFileInformation=0x12723778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8804e2b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc8804e2b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc88512d9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xe5200)) returned 1
	[0200.137] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\SQLiteWrapper.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\sqlitewrapper.winmd"), fInfoLevelId=0x0, lpFileInformation=0x127237c8 | out: lpFileInformation=0x127237c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc88512d9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc88512d9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc88512d9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1a00)) returned 1
	[0200.138] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\_resources"), fInfoLevelId=0x0, lpFileInformation=0x12723818 | out: lpFileInformation=0x12723818*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc82cd965, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82cd965, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82cd965, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.138] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\_resources"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.138] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc82cd965, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82cd965, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82cd965, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fce8
	[0200.138] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc82cd965, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82cd965, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82cd965, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.138] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82cd965, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82cd965, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82cd965, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2985, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.rsrc", cAlternateFileName="")) returned 1
	[0200.138] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82cd965, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82cd965, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82cd965, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa3, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.txt", cAlternateFileName="")) returned 1
	[0200.138] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.138] FindClose (in: hFindFile=0x79fce8 | out: hFindFile=0x79fce8) returned 1
	[0200.138] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\0.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\_resources\\0.rsrc"), fInfoLevelId=0x0, lpFileInformation=0x12723908 | out: lpFileInformation=0x12723908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82cd965, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82cd965, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82cd965, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2985)) returned 1
	[0200.139] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\index.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\_resources\\index.txt"), fInfoLevelId=0x0, lpFileInformation=0x12723958 | out: lpFileInformation=0x12723958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82cd965, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc82cd965, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc82cd965, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa3)) returned 1
	[0200.139] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata"), fInfoLevelId=0x0, lpFileInformation=0x127239a8 | out: lpFileInformation=0x127239a8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x95ddaedf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x95ddaedf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x95ddaedf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.140] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.140] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x95ddaedf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x95ddaedf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x95ddaedf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f8e8
	[0200.140] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x95ddaedf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x95ddaedf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x95ddaedf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.140] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.140] FindClose (in: hFindFile=0x79f8e8 | out: hFindFile=0x79f8e8) returned 1
	[0200.140] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri"), fInfoLevelId=0x0, lpFileInformation=0x127239f8 | out: lpFileInformation=0x127239f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87dec1a, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc87dec1a, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc8804e2b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x6c528)) returned 1
	[0200.140] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_neutral_~_8wekyb3d8bbwe"), fInfoLevelId=0x0, lpFileInformation=0x12723a48 | out: lpFileInformation=0x12723a48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4188a18, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x96bb6961, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x96bb6961, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.141] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_neutral_~_8wekyb3d8bbwe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.141] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4188a18, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x96bb6961, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x96bb6961, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fce8
	[0200.143] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4188a18, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x96bb6961, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x96bb6961, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.143] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc41aec7e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc41aec7e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc41aec7e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x154, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1
	[0200.143] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4188a18, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4188a18, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4188a18, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1
	[0200.143] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc41aec7e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc41aec7e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc41aec7e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x296b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1
	[0200.144] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x96bb6961, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x96bb6961, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x96bb6961, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1
	[0200.144] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.144] FindClose (in: hFindFile=0x79fce8 | out: hFindFile=0x79fce8) returned 1
	[0200.145] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml"), fInfoLevelId=0x0, lpFileInformation=0x12723bd8 | out: lpFileInformation=0x12723bd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc41aec7e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc41aec7e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc41aec7e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x154)) returned 1
	[0200.149] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxmetadata"), fInfoLevelId=0x0, lpFileInformation=0x12723c28 | out: lpFileInformation=0x12723c28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4188a18, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4188a18, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4188a18, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.152] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxmetadata"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.152] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4188a18, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4188a18, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4188a18, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fa28
	[0200.152] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4188a18, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4188a18, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4188a18, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.152] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4188a18, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4188a18, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4188a18, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x650b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBundleManifest.xml", cAlternateFileName="")) returned 1
	[0200.152] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.152] FindClose (in: hFindFile=0x79fa28 | out: hFindFile=0x79fa28) returned 1
	[0200.152] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\appxbundlemanifest.xml"), fInfoLevelId=0x0, lpFileInformation=0x12723cc8 | out: lpFileInformation=0x12723cc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4188a18, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4188a18, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4188a18, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x650b)) returned 1
	[0200.152] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x"), fInfoLevelId=0x0, lpFileInformation=0x12723d18 | out: lpFileInformation=0x12723d18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc41aec7e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc41aec7e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc41aec7e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x296b)) returned 1
	[0200.152] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata"), fInfoLevelId=0x0, lpFileInformation=0x12723d68 | out: lpFileInformation=0x12723d68*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x96bb6961, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x96bb6961, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x96bb6961, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.154] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.154] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x96bb6961, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x96bb6961, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x96bb6961, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f8e8
	[0200.154] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x96bb6961, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x96bb6961, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x96bb6961, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.154] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.154] FindClose (in: hFindFile=0x79f8e8 | out: hFindFile=0x79f8e8) returned 1
	[0200.154] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe"), fInfoLevelId=0x0, lpFileInformation=0x12723db8 | out: lpFileInformation=0x12723db8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc41fb14b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x96bb6961, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x96bb6961, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.155] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.155] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc41fb14b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x96bb6961, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x96bb6961, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fb68
	[0200.157] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc41fb14b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x96bb6961, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x96bb6961, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.158] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4221349, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4221349, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4221349, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x11251, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConfiguration.xml", cAlternateFileName="")) returned 1
	[0200.158] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4221349, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4221349, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4221349, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x7730, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1
	[0200.158] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc41fb14b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc41fb14b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc41fb14b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2088, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1
	[0200.158] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4221349, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4221349, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4221349, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1
	[0200.158] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4221349, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4221349, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4221349, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2991, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1
	[0200.158] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4221349, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42b9c49, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42b9c49, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1
	[0200.158] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc42b9c49, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42b9c49, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42b9c49, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xe958, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClrCompression.dll", cAlternateFileName="")) returned 1
	[0200.158] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc42b9c49, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42b9c49, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42b9c49, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Configuration", cAlternateFileName="CONFIG~1")) returned 1
	[0200.158] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc42b9c49, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42b9c49, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42dff46, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x5ab7, dwReserved0=0x0, dwReserved1=0x0, cFileName="MarketConfiguration.xml", cAlternateFileName="")) returned 1
	[0200.158] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc43c4db8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc43eb01b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc43eb01b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising", cAlternateFileName="MICROS~1.ADV")) returned 1
	[0200.158] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc42dff46, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42dff46, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc43c4db8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x35acb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising.dll", cAlternateFileName="")) returned 1
	[0200.158] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc43c4db8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc43c4db8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc43c4db8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising.winmd", cAlternateFileName="")) returned 1
	[0200.158] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc43eb01b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc43eb01b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4411276, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9d800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Aria.ClientTelemetry.dll", cAlternateFileName="")) returned 1
	[0200.158] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4411276, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4411276, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Aria.ClientTelemetry.winmd", cAlternateFileName="")) returned 1
	[0200.158] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4411276, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4411276, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Msn.Services", cAlternateFileName="MICROS~1.SER")) returned 1
	[0200.158] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc443748b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc443748b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc443748b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Msn.Shell", cAlternateFileName="MICROS~1.SHE")) returned 1
	[0200.158] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc443748b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc443748b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc47f106a, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xb8da00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Msn.Sports.dll", cAlternateFileName="")) returned 1
	[0200.158] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b5e768, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4b5e768, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4b84a9b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Msn.Sports.exe", cAlternateFileName="")) returned 1
	[0200.159] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x96bb6961, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x96bb6961, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x96bb6961, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1
	[0200.159] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4e0cfb9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4e0cfb9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4e0cfb9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftAdvertising.ini", cAlternateFileName="")) returned 1
	[0200.159] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4e33209, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4e33209, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4e33209, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSAdvertisingJS", cAlternateFileName="MSADVE~1")) returned 1
	[0200.159] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4e33209, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4e33209, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4e33209, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x4413, dwReserved0=0x0, dwReserved1=0x0, cFileName="PlatformConfiguration.xml", cAlternateFileName="")) returned 1
	[0200.159] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4e59435, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4e59435, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4e59435, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x7f760, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 1
	[0200.159] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4e7f6f4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4e7f6f4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4ef1dcf, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xe5200, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQLite3Wrapper.dll", cAlternateFileName="")) returned 1
	[0200.159] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ef1dcf, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4ef1dcf, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4ef1dcf, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQLiteWrapper.winmd", cAlternateFileName="")) returned 1
	[0200.159] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4ef1dcf, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4ef1dcf, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4ef1dcf, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1
	[0200.159] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4221349, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4221349, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4221349, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 1
	[0200.159] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.159] FindClose (in: hFindFile=0x79fb68 | out: hFindFile=0x79fb68) returned 1
	[0200.160] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\appconfiguration.xml"), fInfoLevelId=0x0, lpFileInformation=0x125fa698 | out: lpFileInformation=0x125fa698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4221349, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4221349, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4221349, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x11251)) returned 1
	[0200.162] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\appxblockmap.xml"), fInfoLevelId=0x0, lpFileInformation=0x125fa6e8 | out: lpFileInformation=0x125fa6e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4221349, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4221349, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4221349, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x7730)) returned 1
	[0200.163] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\appxmanifest.xml"), fInfoLevelId=0x0, lpFileInformation=0x125fa738 | out: lpFileInformation=0x125fa738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc41fb14b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc41fb14b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc41fb14b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2088)) returned 1
	[0200.163] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\appxmetadata"), fInfoLevelId=0x0, lpFileInformation=0x125fa788 | out: lpFileInformation=0x125fa788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4221349, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4221349, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4221349, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.163] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\appxmetadata"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.163] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4221349, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4221349, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4221349, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ff68
	[0200.163] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4221349, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4221349, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4221349, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.164] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4221349, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4221349, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4221349, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2fe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 1
	[0200.164] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.164] FindClose (in: hFindFile=0x79ff68 | out: hFindFile=0x79ff68) returned 1
	[0200.164] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat"), fInfoLevelId=0x0, lpFileInformation=0x125fa828 | out: lpFileInformation=0x125fa828*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4221349, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4221349, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4221349, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2fe7)) returned 1
	[0200.169] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\appxsignature.p7x"), fInfoLevelId=0x0, lpFileInformation=0x125fa878 | out: lpFileInformation=0x125fa878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4221349, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4221349, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4221349, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2991)) returned 1
	[0200.169] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets"), fInfoLevelId=0x0, lpFileInformation=0x125fa8c8 | out: lpFileInformation=0x125fa8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4221349, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42b9c49, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42b9c49, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.169] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.170] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4221349, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42b9c49, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42b9c49, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fca8
	[0200.170] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4221349, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42b9c49, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42b9c49, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.170] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4221349, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42b9c49, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42b9c49, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppTiles", cAlternateFileName="")) returned 1
	[0200.170] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc42b9c49, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42b9c49, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42b9c49, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x120f, dwReserved0=0x0, dwReserved1=0x0, cFileName="StatsLogo.png", cAlternateFileName="")) returned 1
	[0200.170] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.170] FindClose (in: hFindFile=0x79fca8 | out: hFindFile=0x79fca8) returned 1
	[0200.170] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles"), fInfoLevelId=0x0, lpFileInformation=0x125fa9b8 | out: lpFileInformation=0x125fa9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4221349, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42b9c49, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42b9c49, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.171] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.171] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4221349, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42b9c49, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42b9c49, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fb28
	[0200.175] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4221349, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42b9c49, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42b9c49, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.175] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4221349, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42475ac, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42475ac, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-black", cAlternateFileName="CONTRA~1")) returned 1
	[0200.175] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc42475ac, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc426d813, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc426d813, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 1
	[0200.175] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4293a66, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4293a66, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4293a66, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x13f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_LogoSmall.scale-100.png", cAlternateFileName="")) returned 1
	[0200.175] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4293a66, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4293a66, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4293a66, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_LogoSmall.targetsize-16.png", cAlternateFileName="")) returned 1
	[0200.175] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4293a66, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4293a66, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4293a66, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_LogoSmall.targetsize-24.png", cAlternateFileName="")) returned 1
	[0200.175] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4293a66, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4293a66, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4293a66, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x990, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_LogoSmall.targetsize-256.png", cAlternateFileName="")) returned 1
	[0200.175] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4293a66, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4293a66, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4293a66, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x132, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_LogoSmall.targetsize-32.png", cAlternateFileName="")) returned 1
	[0200.175] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4293a66, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4293a66, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4293a66, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x19d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_LogoSmall.targetsize-48.png", cAlternateFileName="")) returned 1
	[0200.175] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4293a66, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4293a66, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4293a66, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x669, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_SplashScreen.scale-100.png", cAlternateFileName="")) returned 1
	[0200.175] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4293a66, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4293a66, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4293a66, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x577, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_TileLargeSquare.scale-100.png", cAlternateFileName="")) returned 1
	[0200.175] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4293a66, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4293a66, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4293a66, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_TileMediumSquare.scale-100.png", cAlternateFileName="")) returned 1
	[0200.175] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4293a66, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4293a66, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4293a66, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x183, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_TileSmallSquare.scale-100.png", cAlternateFileName="")) returned 1
	[0200.176] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4293a66, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4293a66, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42b9c49, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_TileWide.scale-100.png", cAlternateFileName="")) returned 1
	[0200.176] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc42b9c49, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42b9c49, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42b9c49, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="StoreLogo.png", cAlternateFileName="")) returned 1
	[0200.176] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.176] FindClose (in: hFindFile=0x79fb28 | out: hFindFile=0x79fb28) returned 1
	[0200.176] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\sports_logosmall.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x125fae68 | out: lpFileInformation=0x125fae68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4293a66, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4293a66, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4293a66, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x13f)) returned 1
	[0200.184] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_LogoSmall.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\sports_logosmall.targetsize-16.png"), fInfoLevelId=0x0, lpFileInformation=0x125faeb8 | out: lpFileInformation=0x125faeb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4293a66, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4293a66, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4293a66, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xbe)) returned 1
	[0200.184] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_LogoSmall.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\sports_logosmall.targetsize-24.png"), fInfoLevelId=0x0, lpFileInformation=0x125faf08 | out: lpFileInformation=0x125faf08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4293a66, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4293a66, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4293a66, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xf7)) returned 1
	[0200.184] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_LogoSmall.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\sports_logosmall.targetsize-256.png"), fInfoLevelId=0x0, lpFileInformation=0x125faf58 | out: lpFileInformation=0x125faf58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4293a66, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4293a66, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4293a66, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x990)) returned 1
	[0200.184] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_LogoSmall.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\sports_logosmall.targetsize-32.png"), fInfoLevelId=0x0, lpFileInformation=0x125fafa8 | out: lpFileInformation=0x125fafa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4293a66, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4293a66, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4293a66, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x132)) returned 1
	[0200.187] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_LogoSmall.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\sports_logosmall.targetsize-48.png"), fInfoLevelId=0x0, lpFileInformation=0x125faff8 | out: lpFileInformation=0x125faff8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4293a66, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4293a66, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4293a66, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x19d)) returned 1
	[0200.187] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\sports_splashscreen.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x125fb048 | out: lpFileInformation=0x125fb048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4293a66, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4293a66, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4293a66, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x669)) returned 1
	[0200.188] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_TileLargeSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\sports_tilelargesquare.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x125fb098 | out: lpFileInformation=0x125fb098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4293a66, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4293a66, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4293a66, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x577)) returned 1
	[0200.189] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_TileMediumSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\sports_tilemediumsquare.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x125fb0e8 | out: lpFileInformation=0x125fb0e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4293a66, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4293a66, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4293a66, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x265)) returned 1
	[0200.189] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_TileSmallSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\sports_tilesmallsquare.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x125fb138 | out: lpFileInformation=0x125fb138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4293a66, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4293a66, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4293a66, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x183)) returned 1
	[0200.190] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Sports_TileWide.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\sports_tilewide.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x125fb188 | out: lpFileInformation=0x125fb188*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4293a66, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4293a66, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42b9c49, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2d8)) returned 1
	[0200.190] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\StoreLogo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\storelogo.png"), fInfoLevelId=0x0, lpFileInformation=0x125fb1d8 | out: lpFileInformation=0x125fb1d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc42b9c49, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42b9c49, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42b9c49, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1fe)) returned 1
	[0200.194] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black"), fInfoLevelId=0x0, lpFileInformation=0x125fb228 | out: lpFileInformation=0x125fb228*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4221349, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42475ac, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42475ac, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.194] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.194] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4221349, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42475ac, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42475ac, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fa68
	[0200.201] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4221349, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42475ac, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42475ac, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.201] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4221349, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4221349, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4221349, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x13f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_LogoSmall.scale-100.png", cAlternateFileName="")) returned 1
	[0200.201] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4221349, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4221349, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4221349, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_LogoSmall.targetsize-16.png", cAlternateFileName="")) returned 1
	[0200.201] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc42475ac, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42475ac, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42475ac, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_LogoSmall.targetsize-24.png", cAlternateFileName="")) returned 1
	[0200.201] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc42475ac, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42475ac, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42475ac, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x990, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_LogoSmall.targetsize-256.png", cAlternateFileName="")) returned 1
	[0200.201] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc42475ac, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42475ac, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42475ac, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x132, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_LogoSmall.targetsize-32.png", cAlternateFileName="")) returned 1
	[0200.201] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc42475ac, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42475ac, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42475ac, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x19d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_LogoSmall.targetsize-48.png", cAlternateFileName="")) returned 1
	[0200.201] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc42475ac, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42475ac, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42475ac, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x669, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_SplashScreen.scale-100.png", cAlternateFileName="")) returned 1
	[0200.201] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc42475ac, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42475ac, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42475ac, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x577, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_TileLargeSquare.scale-100.png", cAlternateFileName="")) returned 1
	[0200.201] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc42475ac, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42475ac, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42475ac, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_TileMediumSquare.scale-100.png", cAlternateFileName="")) returned 1
	[0200.201] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc42475ac, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42475ac, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42475ac, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x183, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_TileSmallSquare.scale-100.png", cAlternateFileName="")) returned 1
	[0200.201] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc42475ac, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42475ac, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42475ac, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_TileWide.scale-100.png", cAlternateFileName="")) returned 1
	[0200.201] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.201] FindClose (in: hFindFile=0x79fa68 | out: hFindFile=0x79fa68) returned 1
	[0200.202] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\sports_logosmall.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x125fb5e8 | out: lpFileInformation=0x125fb5e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4221349, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4221349, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4221349, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x13f)) returned 1
	[0200.206] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_LogoSmall.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\sports_logosmall.targetsize-16.png"), fInfoLevelId=0x0, lpFileInformation=0x125fb638 | out: lpFileInformation=0x125fb638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4221349, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4221349, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4221349, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xbe)) returned 1
	[0200.206] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_LogoSmall.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\sports_logosmall.targetsize-24.png"), fInfoLevelId=0x0, lpFileInformation=0x125fb688 | out: lpFileInformation=0x125fb688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc42475ac, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42475ac, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42475ac, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xf7)) returned 1
	[0200.206] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_LogoSmall.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\sports_logosmall.targetsize-256.png"), fInfoLevelId=0x0, lpFileInformation=0x125fb6d8 | out: lpFileInformation=0x125fb6d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc42475ac, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42475ac, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42475ac, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x990)) returned 1
	[0200.206] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_LogoSmall.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\sports_logosmall.targetsize-32.png"), fInfoLevelId=0x0, lpFileInformation=0x125fb728 | out: lpFileInformation=0x125fb728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc42475ac, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42475ac, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42475ac, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x132)) returned 1
	[0200.206] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_LogoSmall.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\sports_logosmall.targetsize-48.png"), fInfoLevelId=0x0, lpFileInformation=0x125fb778 | out: lpFileInformation=0x125fb778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc42475ac, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42475ac, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42475ac, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x19d)) returned 1
	[0200.207] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\sports_splashscreen.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x125fb7c8 | out: lpFileInformation=0x125fb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc42475ac, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42475ac, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42475ac, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x669)) returned 1
	[0200.207] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_TileLargeSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\sports_tilelargesquare.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x125fb818 | out: lpFileInformation=0x125fb818*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc42475ac, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42475ac, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42475ac, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x577)) returned 1
	[0200.207] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_TileMediumSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\sports_tilemediumsquare.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x125fb868 | out: lpFileInformation=0x125fb868*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc42475ac, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42475ac, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42475ac, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x265)) returned 1
	[0200.207] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_TileSmallSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\sports_tilesmallsquare.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x125fb8b8 | out: lpFileInformation=0x125fb8b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc42475ac, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42475ac, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42475ac, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x183)) returned 1
	[0200.207] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Sports_TileWide.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\sports_tilewide.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x125fb908 | out: lpFileInformation=0x125fb908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc42475ac, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42475ac, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42475ac, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2d8)) returned 1
	[0200.207] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white"), fInfoLevelId=0x0, lpFileInformation=0x125fb958 | out: lpFileInformation=0x125fb958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc42475ac, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc426d813, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc426d813, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.207] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.208] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc42475ac, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc426d813, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc426d813, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0028
	[0200.211] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc42475ac, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc426d813, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc426d813, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.211] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc42475ac, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42475ac, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42475ac, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_LogoSmall.scale-100.png", cAlternateFileName="")) returned 1
	[0200.211] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc426d813, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc426d813, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc426d813, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_LogoSmall.targetsize-16.png", cAlternateFileName="")) returned 1
	[0200.211] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc426d813, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc426d813, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc426d813, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_LogoSmall.targetsize-24.png", cAlternateFileName="")) returned 1
	[0200.211] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc426d813, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc426d813, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc426d813, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_LogoSmall.targetsize-256.png", cAlternateFileName="")) returned 1
	[0200.211] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc426d813, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc426d813, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc426d813, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x139, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_LogoSmall.targetsize-32.png", cAlternateFileName="")) returned 1
	[0200.211] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc426d813, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc426d813, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc426d813, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_LogoSmall.targetsize-48.png", cAlternateFileName="")) returned 1
	[0200.211] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc426d813, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc426d813, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc426d813, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x714, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_SplashScreen.scale-100.png", cAlternateFileName="")) returned 1
	[0200.211] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc426d813, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc426d813, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc426d813, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x5c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_TileLargeSquare.scale-100.png", cAlternateFileName="")) returned 1
	[0200.211] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc426d813, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc426d813, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc426d813, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_TileMediumSquare.scale-100.png", cAlternateFileName="")) returned 1
	[0200.211] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc426d813, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc426d813, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc426d813, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x189, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_TileSmallSquare.scale-100.png", cAlternateFileName="")) returned 1
	[0200.211] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc426d813, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc426d813, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc426d813, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x315, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports_TileWide.scale-100.png", cAlternateFileName="")) returned 1
	[0200.211] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.211] FindClose (in: hFindFile=0x7a0028 | out: hFindFile=0x7a0028) returned 1
	[0200.212] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\sports_logosmall.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x125fbd18 | out: lpFileInformation=0x125fbd18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc42475ac, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42475ac, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42475ac, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x146)) returned 1
	[0200.213] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_LogoSmall.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\sports_logosmall.targetsize-16.png"), fInfoLevelId=0x0, lpFileInformation=0x125fbd68 | out: lpFileInformation=0x125fbd68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc426d813, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc426d813, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc426d813, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xbe)) returned 1
	[0200.213] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_LogoSmall.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\sports_logosmall.targetsize-24.png"), fInfoLevelId=0x0, lpFileInformation=0x125fbdb8 | out: lpFileInformation=0x125fbdb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc426d813, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc426d813, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc426d813, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xfc)) returned 1
	[0200.214] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_LogoSmall.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\sports_logosmall.targetsize-256.png"), fInfoLevelId=0x0, lpFileInformation=0x125fbe08 | out: lpFileInformation=0x125fbe08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc426d813, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc426d813, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc426d813, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9b7)) returned 1
	[0200.215] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_LogoSmall.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\sports_logosmall.targetsize-32.png"), fInfoLevelId=0x0, lpFileInformation=0x125fbe58 | out: lpFileInformation=0x125fbe58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc426d813, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc426d813, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc426d813, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x139)) returned 1
	[0200.215] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_LogoSmall.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\sports_logosmall.targetsize-48.png"), fInfoLevelId=0x0, lpFileInformation=0x125fbea8 | out: lpFileInformation=0x125fbea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc426d813, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc426d813, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc426d813, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1a4)) returned 1
	[0200.215] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\sports_splashscreen.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x125fbef8 | out: lpFileInformation=0x125fbef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc426d813, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc426d813, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc426d813, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x714)) returned 1
	[0200.216] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_TileLargeSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\sports_tilelargesquare.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x125fbf48 | out: lpFileInformation=0x125fbf48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc426d813, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc426d813, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc426d813, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x5c8)) returned 1
	[0200.217] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_TileMediumSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\sports_tilemediumsquare.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x125fbf98 | out: lpFileInformation=0x125fbf98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc426d813, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc426d813, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc426d813, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x260)) returned 1
	[0200.219] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_TileSmallSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\sports_tilesmallsquare.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x12614008 | out: lpFileInformation=0x12614008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc426d813, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc426d813, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc426d813, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x189)) returned 1
	[0200.219] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Sports_TileWide.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\sports_tilewide.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x12614058 | out: lpFileInformation=0x12614058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc426d813, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc426d813, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc426d813, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x315)) returned 1
	[0200.219] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\StatsLogo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\statslogo.png"), fInfoLevelId=0x0, lpFileInformation=0x126140a8 | out: lpFileInformation=0x126140a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc42b9c49, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42b9c49, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42b9c49, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x120f)) returned 1
	[0200.219] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\ClrCompression.dll" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\clrcompression.dll"), fInfoLevelId=0x0, lpFileInformation=0x126140f8 | out: lpFileInformation=0x126140f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc42b9c49, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42b9c49, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42b9c49, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xe958)) returned 1
	[0200.219] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\configuration"), fInfoLevelId=0x0, lpFileInformation=0x12614148 | out: lpFileInformation=0x12614148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc42b9c49, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42b9c49, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42b9c49, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.219] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\configuration"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.219] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc42b9c49, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42b9c49, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42b9c49, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0068
	[0200.220] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc42b9c49, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42b9c49, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42b9c49, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.220] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc42b9c49, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42b9c49, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42b9c49, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x23c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="configuration.sqlite", cAlternateFileName="")) returned 1
	[0200.220] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.220] FindClose (in: hFindFile=0x7a0068 | out: hFindFile=0x7a0068) returned 1
	[0200.220] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite"), fInfoLevelId=0x0, lpFileInformation=0x126141e8 | out: lpFileInformation=0x126141e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc42b9c49, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42b9c49, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42b9c49, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x23c00)) returned 1
	[0200.222] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\msadvertisingjs"), fInfoLevelId=0x0, lpFileInformation=0x12614238 | out: lpFileInformation=0x12614238*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4e33209, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4e33209, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4e33209, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.223] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\msadvertisingjs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.223] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4e33209, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4e33209, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4e33209, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fea8
	[0200.223] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4e33209, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4e33209, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4e33209, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.223] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4e33209, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4e33209, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4e33209, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x4be9, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootstrap.js", cAlternateFileName="")) returned 1
	[0200.224] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4e33209, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4e33209, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4e33209, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x73d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ormma.js", cAlternateFileName="")) returned 1
	[0200.224] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.224] FindClose (in: hFindFile=0x79fea8 | out: hFindFile=0x79fea8) returned 1
	[0200.224] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\bootstrap.js" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\msadvertisingjs\\bootstrap.js"), fInfoLevelId=0x0, lpFileInformation=0x12614328 | out: lpFileInformation=0x12614328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4e33209, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4e33209, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4e33209, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x4be9)) returned 1
	[0200.224] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\ormma.js" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\msadvertisingjs\\ormma.js"), fInfoLevelId=0x0, lpFileInformation=0x12614378 | out: lpFileInformation=0x12614378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4e33209, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4e33209, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4e33209, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x73d8)) returned 1
	[0200.224] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MarketConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\marketconfiguration.xml"), fInfoLevelId=0x0, lpFileInformation=0x126143c8 | out: lpFileInformation=0x126143c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc42b9c49, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42b9c49, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc42dff46, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x5ab7)) returned 1
	[0200.224] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising"), fInfoLevelId=0x0, lpFileInformation=0x12614418 | out: lpFileInformation=0x12614418*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc43c4db8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc43eb01b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc43eb01b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.226] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.226] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc43c4db8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc43eb01b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc43eb01b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fe68
	[0200.226] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc43c4db8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc43eb01b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc43eb01b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.226] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc43c4db8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc43c4db8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc43c4db8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x62f, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootstrap.html", cAlternateFileName="")) returned 1
	[0200.226] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc43eb01b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc43eb01b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc43eb01b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1
	[0200.226] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.226] FindClose (in: hFindFile=0x79fe68 | out: hFindFile=0x79fe68) returned 1
	[0200.226] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising\\themes"), fInfoLevelId=0x0, lpFileInformation=0x12614508 | out: lpFileInformation=0x12614508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc43eb01b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc43eb01b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc43eb01b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.226] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising\\themes"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.227] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc43eb01b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc43eb01b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc43eb01b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fce8
	[0200.227] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc43eb01b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc43eb01b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc43eb01b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.227] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc43eb01b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc43eb01b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc43eb01b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Generic.xbf", cAlternateFileName="")) returned 1
	[0200.227] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.227] FindClose (in: hFindFile=0x79fce8 | out: hFindFile=0x79fce8) returned 1
	[0200.227] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\Generic.xbf" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising\\themes\\generic.xbf"), fInfoLevelId=0x0, lpFileInformation=0x126145a8 | out: lpFileInformation=0x126145a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc43eb01b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc43eb01b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc43eb01b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2ef)) returned 1
	[0200.227] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\bootstrap.html" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising\\bootstrap.html"), fInfoLevelId=0x0, lpFileInformation=0x126145f8 | out: lpFileInformation=0x126145f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc43c4db8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc43c4db8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc43c4db8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x62f)) returned 1
	[0200.228] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.dll" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising.dll"), fInfoLevelId=0x0, lpFileInformation=0x12614648 | out: lpFileInformation=0x12614648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc42dff46, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc42dff46, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc43c4db8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x35acb0)) returned 1
	[0200.228] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.advertising.winmd"), fInfoLevelId=0x0, lpFileInformation=0x12614698 | out: lpFileInformation=0x12614698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc43c4db8, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc43c4db8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc43c4db8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa4b0)) returned 1
	[0200.231] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Aria.ClientTelemetry.dll" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.aria.clienttelemetry.dll"), fInfoLevelId=0x0, lpFileInformation=0x126146e8 | out: lpFileInformation=0x126146e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc43eb01b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc43eb01b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4411276, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9d800)) returned 1
	[0200.231] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Aria.ClientTelemetry.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.aria.clienttelemetry.winmd"), fInfoLevelId=0x0, lpFileInformation=0x12614738 | out: lpFileInformation=0x12614738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4411276, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4411276, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2a00)) returned 1
	[0200.231] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services"), fInfoLevelId=0x0, lpFileInformation=0x12614788 | out: lpFileInformation=0x12614788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4411276, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4411276, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.231] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.231] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4411276, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4411276, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fd28
	[0200.231] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4411276, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4411276, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.231] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4411276, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4411276, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Personalization", cAlternateFileName="PERSON~1")) returned 1
	[0200.231] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.231] FindClose (in: hFindFile=0x79fd28 | out: hFindFile=0x79fd28) returned 1
	[0200.232] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization"), fInfoLevelId=0x0, lpFileInformation=0x12614828 | out: lpFileInformation=0x12614828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4411276, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4411276, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.232] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.232] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4411276, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4411276, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0028
	[0200.232] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4411276, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4411276, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.232] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc443748b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc443748b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataModels", cAlternateFileName="DATAMO~1")) returned 1
	[0200.232] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.232] FindClose (in: hFindFile=0x7a0028 | out: hFindFile=0x7a0028) returned 1
	[0200.232] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels"), fInfoLevelId=0x0, lpFileInformation=0x126148c8 | out: lpFileInformation=0x126148c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc443748b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc443748b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.236] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.236] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc443748b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc443748b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fd28
	[0200.242] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc443748b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc443748b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.242] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4411276, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4411276, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Finance", cAlternateFileName="")) returned 1
	[0200.242] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4411276, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4411276, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FoodAndDrink", cAlternateFileName="FOODAN~1")) returned 1
	[0200.242] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4411276, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4411276, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Health", cAlternateFileName="")) returned 1
	[0200.242] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4411276, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4411276, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="News", cAlternateFileName="")) returned 1
	[0200.242] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc443748b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc443748b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports", cAlternateFileName="")) returned 1
	[0200.242] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc443748b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc443748b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc443748b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather", cAlternateFileName="")) returned 1
	[0200.242] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.242] FindClose (in: hFindFile=0x79fd28 | out: hFindFile=0x79fd28) returned 1
	[0200.244] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Finance" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\finance"), fInfoLevelId=0x0, lpFileInformation=0x12614af8 | out: lpFileInformation=0x12614af8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4411276, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4411276, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.244] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Finance" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\finance"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.245] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Finance\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4411276, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4411276, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fe68
	[0200.245] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4411276, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4411276, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.245] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4411276, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4411276, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xdde, dwReserved0=0x0, dwReserved1=0x0, cFileName="Finance.xml", cAlternateFileName="")) returned 1
	[0200.245] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.245] FindClose (in: hFindFile=0x79fe68 | out: hFindFile=0x79fe68) returned 1
	[0200.245] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Finance\\Finance.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\finance\\finance.xml"), fInfoLevelId=0x0, lpFileInformation=0x12614b98 | out: lpFileInformation=0x12614b98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4411276, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4411276, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xdde)) returned 1
	[0200.246] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\FoodAndDrink" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\foodanddrink"), fInfoLevelId=0x0, lpFileInformation=0x12614be8 | out: lpFileInformation=0x12614be8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4411276, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4411276, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.246] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\FoodAndDrink" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\foodanddrink"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.246] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\FoodAndDrink\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4411276, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4411276, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0028
	[0200.246] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4411276, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4411276, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.246] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4411276, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4411276, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xefe, dwReserved0=0x0, dwReserved1=0x0, cFileName="FoodAndDrink.xml", cAlternateFileName="")) returned 1
	[0200.246] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.246] FindClose (in: hFindFile=0x7a0028 | out: hFindFile=0x7a0028) returned 1
	[0200.246] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\FoodAndDrink\\FoodAndDrink.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\foodanddrink\\foodanddrink.xml"), fInfoLevelId=0x0, lpFileInformation=0x12614c88 | out: lpFileInformation=0x12614c88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4411276, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4411276, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xefe)) returned 1
	[0200.247] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Health" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\health"), fInfoLevelId=0x0, lpFileInformation=0x12614cd8 | out: lpFileInformation=0x12614cd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4411276, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4411276, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.247] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Health" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\health"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.247] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Health\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4411276, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4411276, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fd28
	[0200.247] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4411276, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4411276, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.247] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4411276, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4411276, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x928, dwReserved0=0x0, dwReserved1=0x0, cFileName="Health.xml", cAlternateFileName="")) returned 1
	[0200.247] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.248] FindClose (in: hFindFile=0x79fd28 | out: hFindFile=0x79fd28) returned 1
	[0200.248] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Health\\Health.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\health\\health.xml"), fInfoLevelId=0x0, lpFileInformation=0x12614d78 | out: lpFileInformation=0x12614d78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4411276, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4411276, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x928)) returned 1
	[0200.248] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\News" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\news"), fInfoLevelId=0x0, lpFileInformation=0x12614dc8 | out: lpFileInformation=0x12614dc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4411276, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4411276, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.250] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\News" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\news"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.250] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\News\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4411276, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4411276, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffa8
	[0200.250] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4411276, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4411276, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.250] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4411276, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4411276, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="News.xml", cAlternateFileName="")) returned 1
	[0200.250] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.250] FindClose (in: hFindFile=0x79ffa8 | out: hFindFile=0x79ffa8) returned 1
	[0200.251] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\News\\News.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\news\\news.xml"), fInfoLevelId=0x0, lpFileInformation=0x12614e68 | out: lpFileInformation=0x12614e68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4411276, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4411276, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x800)) returned 1
	[0200.251] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Sports" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\sports"), fInfoLevelId=0x0, lpFileInformation=0x12614eb8 | out: lpFileInformation=0x12614eb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc443748b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc443748b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.251] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Sports" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\sports"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.251] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Sports\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc443748b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc443748b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fee8
	[0200.251] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4411276, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc443748b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc443748b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.251] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc443748b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc443748b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc443748b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2249e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports.xml", cAlternateFileName="")) returned 1
	[0200.252] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.252] FindClose (in: hFindFile=0x79fee8 | out: hFindFile=0x79fee8) returned 1
	[0200.252] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Sports\\Sports.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\sports\\sports.xml"), fInfoLevelId=0x0, lpFileInformation=0x12614f58 | out: lpFileInformation=0x12614f58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc443748b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc443748b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc443748b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2249e)) returned 1
	[0200.252] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Weather" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\weather"), fInfoLevelId=0x0, lpFileInformation=0x12614fa8 | out: lpFileInformation=0x12614fa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc443748b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc443748b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc443748b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.252] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Weather" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\weather"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.252] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Weather\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc443748b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc443748b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc443748b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fea8
	[0200.253] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc443748b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc443748b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc443748b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.253] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc443748b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc443748b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc443748b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xb19, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather.xml", cAlternateFileName="")) returned 1
	[0200.253] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.253] FindClose (in: hFindFile=0x79fea8 | out: hFindFile=0x79fea8) returned 1
	[0200.253] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Weather\\Weather.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.services\\personalization\\datamodels\\weather\\weather.xml"), fInfoLevelId=0x0, lpFileInformation=0x12615048 | out: lpFileInformation=0x12615048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc443748b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc443748b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc443748b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xb19)) returned 1
	[0200.254] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.shell"), fInfoLevelId=0x0, lpFileInformation=0x12615098 | out: lpFileInformation=0x12615098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc443748b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc443748b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc443748b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.254] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.shell"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.254] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc443748b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc443748b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc443748b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f8e8
	[0200.254] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc443748b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc443748b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc443748b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.254] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc443748b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc443748b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc443748b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1
	[0200.254] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.254] FindClose (in: hFindFile=0x79f8e8 | out: hFindFile=0x79f8e8) returned 1
	[0200.255] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.shell\\themes"), fInfoLevelId=0x0, lpFileInformation=0x12615138 | out: lpFileInformation=0x12615138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc443748b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc443748b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc443748b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.255] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.shell\\themes"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.255] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc443748b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc443748b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc443748b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffe8
	[0200.256] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc443748b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc443748b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc443748b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.256] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc443748b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc443748b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc443748b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Glyphs", cAlternateFileName="")) returned 1
	[0200.256] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.256] FindClose (in: hFindFile=0x79ffe8 | out: hFindFile=0x79ffe8) returned 1
	[0200.256] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.shell\\themes\\glyphs"), fInfoLevelId=0x0, lpFileInformation=0x126151d8 | out: lpFileInformation=0x126151d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc443748b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc443748b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc443748b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.256] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.shell\\themes\\glyphs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.257] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc443748b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc443748b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc443748b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f968
	[0200.257] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc443748b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc443748b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc443748b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.257] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc443748b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc443748b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc443748b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Font", cAlternateFileName="")) returned 1
	[0200.257] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.257] FindClose (in: hFindFile=0x79f968 | out: hFindFile=0x79f968) returned 1
	[0200.258] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.shell\\themes\\glyphs\\font"), fInfoLevelId=0x0, lpFileInformation=0x12615278 | out: lpFileInformation=0x12615278*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc443748b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc443748b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc443748b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.258] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.shell\\themes\\glyphs\\font"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.258] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc443748b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc443748b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc443748b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9e8
	[0200.258] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc443748b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc443748b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc443748b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.258] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc443748b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc443748b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc443748b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xcdcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNMDL2.ttf", cAlternateFileName="")) returned 1
	[0200.258] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc443748b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc443748b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc443748b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xf530, dwReserved0=0x0, dwReserved1=0x0, cFileName="WeatherColorIcons.ttf", cAlternateFileName="")) returned 1
	[0200.258] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.258] FindClose (in: hFindFile=0x79f9e8 | out: hFindFile=0x79f9e8) returned 1
	[0200.259] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\MSNMDL2.ttf" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.shell\\themes\\glyphs\\font\\msnmdl2.ttf"), fInfoLevelId=0x0, lpFileInformation=0x12615368 | out: lpFileInformation=0x12615368*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc443748b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc443748b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc443748b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xcdcc)) returned 1
	[0200.259] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\WeatherColorIcons.ttf" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.shell\\themes\\glyphs\\font\\weathercoloricons.ttf"), fInfoLevelId=0x0, lpFileInformation=0x126153b8 | out: lpFileInformation=0x126153b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc443748b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc443748b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc443748b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xf530)) returned 1
	[0200.259] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Sports.dll" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.sports.dll"), fInfoLevelId=0x0, lpFileInformation=0x12615408 | out: lpFileInformation=0x12615408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc443748b, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc443748b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc47f106a, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xb8da00)) returned 1
	[0200.263] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Sports.exe" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.msn.sports.exe"), fInfoLevelId=0x0, lpFileInformation=0x12615458 | out: lpFileInformation=0x12615458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b5e768, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4b5e768, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4b84a9b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x3e00)) returned 1
	[0200.264] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MicrosoftAdvertising.ini" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoftadvertising.ini"), fInfoLevelId=0x0, lpFileInformation=0x126154a8 | out: lpFileInformation=0x126154a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4e0cfb9, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4e0cfb9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4e0cfb9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xd)) returned 1
	[0200.264] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\PlatformConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\platformconfiguration.xml"), fInfoLevelId=0x0, lpFileInformation=0x126154f8 | out: lpFileInformation=0x126154f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4e33209, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4e33209, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4e33209, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x4413)) returned 1
	[0200.264] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\SQLite3Wrapper.dll" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\sqlite3wrapper.dll"), fInfoLevelId=0x0, lpFileInformation=0x12615548 | out: lpFileInformation=0x12615548*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4e7f6f4, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4e7f6f4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4ef1dcf, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xe5200)) returned 1
	[0200.264] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\SQLiteWrapper.winmd" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\sqlitewrapper.winmd"), fInfoLevelId=0x0, lpFileInformation=0x12615598 | out: lpFileInformation=0x12615598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ef1dcf, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4ef1dcf, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4ef1dcf, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1a00)) returned 1
	[0200.265] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Themes" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\themes"), fInfoLevelId=0x0, lpFileInformation=0x126155e8 | out: lpFileInformation=0x126155e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4ef1dcf, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4ef1dcf, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4ef1dcf, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.267] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Themes" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\themes"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.267] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Themes\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4ef1dcf, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4ef1dcf, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4ef1dcf, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fb68
	[0200.267] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4ef1dcf, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4ef1dcf, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4ef1dcf, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.268] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4ef1dcf, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4ef1dcf, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4ef1dcf, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1
	[0200.268] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.268] FindClose (in: hFindFile=0x79fb68 | out: hFindFile=0x79fb68) returned 1
	[0200.268] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Themes\\Fonts" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\themes\\fonts"), fInfoLevelId=0x0, lpFileInformation=0x12615688 | out: lpFileInformation=0x12615688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4ef1dcf, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4ef1dcf, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4ef1dcf, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.268] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Themes\\Fonts" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\themes\\fonts"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.268] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Themes\\Fonts\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4ef1dcf, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4ef1dcf, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4ef1dcf, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f8e8
	[0200.268] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4ef1dcf, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4ef1dcf, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4ef1dcf, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.269] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ef1dcf, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4ef1dcf, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4ef1dcf, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x457c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DIN1451CLSHF.TTF", cAlternateFileName="")) returned 1
	[0200.269] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.269] FindClose (in: hFindFile=0x79f8e8 | out: hFindFile=0x79f8e8) returned 1
	[0200.269] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Themes\\Fonts\\DIN1451CLSHF.TTF" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\themes\\fonts\\din1451clshf.ttf"), fInfoLevelId=0x0, lpFileInformation=0x12615728 | out: lpFileInformation=0x12615728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ef1dcf, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4ef1dcf, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4ef1dcf, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x457c)) returned 1
	[0200.269] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\_resources"), fInfoLevelId=0x0, lpFileInformation=0x12615778 | out: lpFileInformation=0x12615778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4221349, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4221349, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4221349, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.269] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\_resources"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.269] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4221349, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4221349, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4221349, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fde8
	[0200.269] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4221349, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4221349, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4221349, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.270] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4221349, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4221349, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4221349, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2985, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.rsrc", cAlternateFileName="")) returned 1
	[0200.270] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4221349, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4221349, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4221349, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa3, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.txt", cAlternateFileName="")) returned 1
	[0200.270] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.270] FindClose (in: hFindFile=0x79fde8 | out: hFindFile=0x79fde8) returned 1
	[0200.270] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\0.rsrc" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\_resources\\0.rsrc"), fInfoLevelId=0x0, lpFileInformation=0x12615868 | out: lpFileInformation=0x12615868*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4221349, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4221349, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4221349, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2985)) returned 1
	[0200.270] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\index.txt" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\_resources\\index.txt"), fInfoLevelId=0x0, lpFileInformation=0x126158b8 | out: lpFileInformation=0x126158b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4221349, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4221349, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4221349, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa3)) returned 1
	[0200.279] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata"), fInfoLevelId=0x0, lpFileInformation=0x12615908 | out: lpFileInformation=0x12615908*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x96bb6961, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x96bb6961, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x96bb6961, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.280] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.280] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x96bb6961, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x96bb6961, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x96bb6961, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fb68
	[0200.280] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x96bb6961, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x96bb6961, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x96bb6961, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.280] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.280] FindClose (in: hFindFile=0x79fb68 | out: hFindFile=0x79fb68) returned 1
	[0200.280] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\resources.pri"), fInfoLevelId=0x0, lpFileInformation=0x12615958 | out: lpFileInformation=0x12615958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4e59435, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc4e59435, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xc4e59435, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x7f760)) returned 1
	[0200.281] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_neutral_~_8wekyb3d8bbwe"), fInfoLevelId=0x0, lpFileInformation=0x126159a8 | out: lpFileInformation=0x126159a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb6833b2, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x9796c1ac, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x9796c1ac, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.281] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_neutral_~_8wekyb3d8bbwe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.281] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb6833b2, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x9796c1ac, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x9796c1ac, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9a8
	[0200.285] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb6833b2, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x9796c1ac, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x9796c1ac, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.286] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb6a9609, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcb6a9609, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcb6a9609, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x154, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1
	[0200.286] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb6833b2, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcb6833b2, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcb6833b2, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1
	[0200.286] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb931ebf, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcb931ebf, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcb931ebf, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x296b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1
	[0200.286] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9796c1ac, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x9796c1ac, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x9796c1ac, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1
	[0200.286] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.286] FindClose (in: hFindFile=0x79f9a8 | out: hFindFile=0x79f9a8) returned 1
	[0200.287] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxblockmap.xml"), fInfoLevelId=0x0, lpFileInformation=0x12615b38 | out: lpFileInformation=0x12615b38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb6a9609, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcb6a9609, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcb6a9609, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x154)) returned 1
	[0200.289] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxmetadata"), fInfoLevelId=0x0, lpFileInformation=0x12615b88 | out: lpFileInformation=0x12615b88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb6833b2, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcb6833b2, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcb6833b2, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.289] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxmetadata"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.289] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb6833b2, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcb6833b2, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcb6833b2, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fb28
	[0200.290] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb6833b2, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcb6833b2, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcb6833b2, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.290] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb6833b2, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcb6833b2, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcb6a9609, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x6580, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBundleManifest.xml", cAlternateFileName="")) returned 1
	[0200.290] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.290] FindClose (in: hFindFile=0x79fb28 | out: hFindFile=0x79fb28) returned 1
	[0200.290] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\AppxBundleManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxmetadata\\appxbundlemanifest.xml"), fInfoLevelId=0x0, lpFileInformation=0x12615c28 | out: lpFileInformation=0x12615c28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb6833b2, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcb6833b2, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcb6a9609, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x6580)) returned 1
	[0200.290] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_neutral_~_8wekyb3d8bbwe\\appxsignature.p7x"), fInfoLevelId=0x0, lpFileInformation=0x12615c78 | out: lpFileInformation=0x12615c78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb931ebf, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcb931ebf, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcb931ebf, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x296b)) returned 1
	[0200.290] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata"), fInfoLevelId=0x0, lpFileInformation=0x12615cc8 | out: lpFileInformation=0x12615cc8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9796c1ac, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x9796c1ac, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x9796c1ac, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.291] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.291] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9796c1ac, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x9796c1ac, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x9796c1ac, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0068
	[0200.291] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9796c1ac, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x9796c1ac, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x9796c1ac, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.291] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.291] FindClose (in: hFindFile=0x7a0068 | out: hFindFile=0x7a0068) returned 1
	[0200.291] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe"), fInfoLevelId=0x0, lpFileInformation=0x12615d18 | out: lpFileInformation=0x12615d18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9ca7e5, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x97992404, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x97992404, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0200.291] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.292] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9ca7e5, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x97992404, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x97992404, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fc68
	[0200.294] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9ca7e5, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x97992404, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x97992404, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.294] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb9f0a67, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcb9f0a67, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcb9f0a67, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xbf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConfiguration.xml", cAlternateFileName="")) returned 1
	[0200.294] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb9ca7e5, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcb9ca7e5, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcb9ca7e5, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x7c9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1
	[0200.294] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb9ca7e5, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcb9ca7e5, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcb9ca7e5, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1
	[0200.294] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9ca7e5, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcb9ca7e5, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcb9ca7e5, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1
	[0200.294] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb9ca7e5, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcb9ca7e5, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcb9ca7e5, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x298e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1
	[0200.294] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9f0a67, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbad58c2, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbad58c2, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1
	[0200.294] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbafbb15, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbafbb15, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbafbb15, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xe958, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClrCompression.dll", cAlternateFileName="")) returned 1
	[0200.294] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbafbb15, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbafbb15, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbafbb15, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Configuration", cAlternateFileName="CONFIG~1")) returned 1
	[0200.294] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbafbb15, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbafbb15, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbafbb15, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Images", cAlternateFileName="")) returned 1
	[0200.294] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb21dcd, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbb21dcd, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbb21dcd, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x11f23, dwReserved0=0x0, dwReserved1=0x0, cFileName="MarketConfiguration.xml", cAlternateFileName="")) returned 1
	[0200.294] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbc2ce00, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbc2ce00, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbc2ce00, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising", cAlternateFileName="MICROS~1.ADV")) returned 1
	[0200.294] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb21dcd, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbb21dcd, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbc06bb0, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x35acb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising.dll", cAlternateFileName="")) returned 1
	[0200.294] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbc06bb0, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbc06bb0, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbc06bb0, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising.winmd", cAlternateFileName="")) returned 1
	[0200.295] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbc2ce00, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbc2ce00, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbc5305e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9d800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Aria.ClientTelemetry.dll", cAlternateFileName="")) returned 1
	[0200.295] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbc5305e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbc5305e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbc5305e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Aria.ClientTelemetry.winmd", cAlternateFileName="")) returned 1
	[0200.295] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbc5305e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbc5305e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbc5305e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Msn.Services", cAlternateFileName="MICROS~1.SER")) returned 1
	[0200.295] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbc792dc, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbc792dc, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbc792dc, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Msn.Shell", cAlternateFileName="MICROS~1.SHE")) returned 1
	[0200.295] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbc9f50d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbc9f50d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbf7425a, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa20600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Msn.Weather.dll", cAlternateFileName="")) returned 1
	[0200.295] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbf9a496, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbf9a496, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbf9a496, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Msn.Weather.exe", cAlternateFileName="")) returned 1
	[0200.295] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x97992404, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x97992404, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x97992404, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1
	[0200.295] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbf9a496, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbf9a496, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbf9a496, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftAdvertising.ini", cAlternateFileName="")) returned 1
	[0200.295] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbf9a496, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbf9a496, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbf9a496, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSAdvertisingJS", cAlternateFileName="MSADVE~1")) returned 1
	[0200.295] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbf9a496, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbf9a496, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbf9a496, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x4413, dwReserved0=0x0, dwReserved1=0x0, cFileName="PlatformConfiguration.xml", cAlternateFileName="")) returned 1
	[0200.295] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbf9a496, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbf9a496, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbfe696f, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xa0850, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 1
	[0200.295] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbfe696f, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbfe696f, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcc032e3f, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xe5200, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQLite3Wrapper.dll", cAlternateFileName="")) returned 1
	[0200.295] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc032e3f, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcc032e3f, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcc032e3f, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQLiteWrapper.winmd", cAlternateFileName="")) returned 1
	[0200.295] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9ca7e5, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcb9ca7e5, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcb9ca7e5, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 1
	[0200.295] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.295] FindClose (in: hFindFile=0x79fc68 | out: hFindFile=0x79fc68) returned 1
	[0200.296] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\AppConfiguration.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\appconfiguration.xml"), fInfoLevelId=0x0, lpFileInformation=0x127325f8 | out: lpFileInformation=0x127325f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb9f0a67, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcb9f0a67, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcb9f0a67, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xbf58)) returned 1
	[0200.298] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\appxblockmap.xml"), fInfoLevelId=0x0, lpFileInformation=0x12732648 | out: lpFileInformation=0x12732648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb9ca7e5, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcb9ca7e5, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcb9ca7e5, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x7c9d)) returned 1
	[0200.299] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\appxmanifest.xml"), fInfoLevelId=0x0, lpFileInformation=0x12732698 | out: lpFileInformation=0x12732698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb9ca7e5, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcb9ca7e5, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcb9ca7e5, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2213)) returned 1
	[0200.299] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\appxmetadata"), fInfoLevelId=0x0, lpFileInformation=0x127326e8 | out: lpFileInformation=0x127326e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9ca7e5, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcb9ca7e5, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcb9ca7e5, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.299] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\appxmetadata"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.299] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9ca7e5, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcb9ca7e5, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcb9ca7e5, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fca8
	[0200.299] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9ca7e5, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcb9ca7e5, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcb9ca7e5, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.299] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb9ca7e5, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcb9ca7e5, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcb9ca7e5, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2fe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 1
	[0200.299] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.299] FindClose (in: hFindFile=0x79fca8 | out: hFindFile=0x79fca8) returned 1
	[0200.300] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat"), fInfoLevelId=0x0, lpFileInformation=0x12732788 | out: lpFileInformation=0x12732788*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb9ca7e5, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcb9ca7e5, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcb9ca7e5, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2fe3)) returned 1
	[0200.301] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\appxsignature.p7x"), fInfoLevelId=0x0, lpFileInformation=0x127327d8 | out: lpFileInformation=0x127327d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb9ca7e5, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcb9ca7e5, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcb9ca7e5, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x298e)) returned 1
	[0200.317] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets"), fInfoLevelId=0x0, lpFileInformation=0x12732828 | out: lpFileInformation=0x12732828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9f0a67, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbad58c2, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbad58c2, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.320] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.320] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9f0a67, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbad58c2, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbad58c2, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fee8
	[0200.320] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9f0a67, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbad58c2, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbad58c2, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.320] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9f0a67, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbad58c2, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbad58c2, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppTiles", cAlternateFileName="")) returned 1
	[0200.320] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbad58c2, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbafbb15, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbafbb15, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Attribution", cAlternateFileName="ATTRIB~1")) returned 1
	[0200.320] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.320] FindClose (in: hFindFile=0x79fee8 | out: hFindFile=0x79fee8) returned 1
	[0200.320] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles"), fInfoLevelId=0x0, lpFileInformation=0x12732918 | out: lpFileInformation=0x12732918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9f0a67, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbad58c2, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbad58c2, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.321] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.321] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9f0a67, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbad58c2, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbad58c2, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fda8
	[0200.323] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9f0a67, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbad58c2, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbad58c2, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.323] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9f0a67, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba16d03, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba16d03, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-black", cAlternateFileName="CONTRA~1")) returned 1
	[0200.323] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcba16d03, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba632bf, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba632bf, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 1
	[0200.323] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcba632bf, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba89401, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba89401, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spacer", cAlternateFileName="")) returned 1
	[0200.323] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba89401, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba89401, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba89401, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="StoreLogo.png", cAlternateFileName="")) returned 1
	[0200.323] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba89401, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba89401, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba89401, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_BadgeLogo.scale-100.png", cAlternateFileName="")) returned 1
	[0200.323] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbaaf701, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbaaf701, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbaaf701, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_LogoSmall.scale-100.png", cAlternateFileName="")) returned 1
	[0200.323] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbaaf701, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbaaf701, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbaaf701, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_LogoSmall.targetsize-16.png", cAlternateFileName="")) returned 1
	[0200.323] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbaaf701, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbaaf701, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbaaf701, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_LogoSmall.targetsize-24.png", cAlternateFileName="")) returned 1
	[0200.323] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbaaf701, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbaaf701, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbaaf701, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x597, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_LogoSmall.targetsize-256.png", cAlternateFileName="")) returned 1
	[0200.323] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbaaf701, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbaaf701, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbaaf701, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_LogoSmall.targetsize-32.png", cAlternateFileName="")) returned 1
	[0200.323] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbaaf701, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbaaf701, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbaaf701, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_LogoSmall.targetsize-48.png", cAlternateFileName="")) returned 1
	[0200.324] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbaaf701, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbaaf701, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbaaf701, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_SplashScreen.scale-100.png", cAlternateFileName="")) returned 1
	[0200.324] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbaaf701, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbaaf701, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbaaf701, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x4f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_TileLargeSquare.scale-100.png", cAlternateFileName="")) returned 1
	[0200.324] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbad58c2, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbad58c2, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbad58c2, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_TileMediumSquare.scale-100.png", cAlternateFileName="")) returned 1
	[0200.324] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbad58c2, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbad58c2, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbad58c2, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_TileSmallSquare.scale-100.png", cAlternateFileName="")) returned 1
	[0200.324] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbad58c2, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbad58c2, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbad58c2, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x25f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_TileWide.scale-100.png", cAlternateFileName="")) returned 1
	[0200.324] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.324] FindClose (in: hFindFile=0x79fda8 | out: hFindFile=0x79fda8) returned 1
	[0200.325] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\spacer"), fInfoLevelId=0x0, lpFileInformation=0x12732e68 | out: lpFileInformation=0x12732e68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcba632bf, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba89401, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba89401, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.327] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\spacer"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.327] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcba632bf, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba89401, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba89401, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fea8
	[0200.334] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcba632bf, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba89401, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba89401, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.334] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba632bf, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba632bf, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba632bf, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="10px.png", cAlternateFileName="")) returned 1
	[0200.334] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba632bf, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba632bf, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba632bf, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="1px.png", cAlternateFileName="")) returned 1
	[0200.334] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba632bf, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba632bf, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba632bf, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x0, cFileName="2px.png", cAlternateFileName="")) returned 1
	[0200.334] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba632bf, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba632bf, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba632bf, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="3px.png", cAlternateFileName="")) returned 1
	[0200.334] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba632bf, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba632bf, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba632bf, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="4px.png", cAlternateFileName="")) returned 1
	[0200.334] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba89401, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba89401, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba89401, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="5px.png", cAlternateFileName="")) returned 1
	[0200.334] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba89401, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba89401, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba89401, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="6px.png", cAlternateFileName="")) returned 1
	[0200.334] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba89401, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba89401, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba89401, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="7px.png", cAlternateFileName="")) returned 1
	[0200.334] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba89401, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba89401, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba89401, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="8px.png", cAlternateFileName="")) returned 1
	[0200.334] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba89401, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba89401, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba89401, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="9px.png", cAlternateFileName="")) returned 1
	[0200.334] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.334] FindClose (in: hFindFile=0x79fea8 | out: hFindFile=0x79fea8) returned 1
	[0200.335] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\10px.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\spacer\\10px.png"), fInfoLevelId=0x0, lpFileInformation=0x12733228 | out: lpFileInformation=0x12733228*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba632bf, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba632bf, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba632bf, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x8d)) returned 1
	[0200.342] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\1px.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\spacer\\1px.png"), fInfoLevelId=0x0, lpFileInformation=0x12733278 | out: lpFileInformation=0x12733278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba632bf, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba632bf, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba632bf, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9c)) returned 1
	[0200.342] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\2px.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\spacer\\2px.png"), fInfoLevelId=0x0, lpFileInformation=0x127332c8 | out: lpFileInformation=0x127332c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba632bf, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba632bf, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba632bf, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x88)) returned 1
	[0200.344] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\3px.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\spacer\\3px.png"), fInfoLevelId=0x0, lpFileInformation=0x12733318 | out: lpFileInformation=0x12733318*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba632bf, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba632bf, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba632bf, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9c)) returned 1
	[0200.345] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\4px.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\spacer\\4px.png"), fInfoLevelId=0x0, lpFileInformation=0x12733368 | out: lpFileInformation=0x12733368*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba632bf, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba632bf, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba632bf, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x8a)) returned 1
	[0200.345] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\5px.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\spacer\\5px.png"), fInfoLevelId=0x0, lpFileInformation=0x127333b8 | out: lpFileInformation=0x127333b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba89401, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba89401, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba89401, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9c)) returned 1
	[0200.345] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\6px.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\spacer\\6px.png"), fInfoLevelId=0x0, lpFileInformation=0x12733408 | out: lpFileInformation=0x12733408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba89401, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba89401, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba89401, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x8a)) returned 1
	[0200.350] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\7px.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\spacer\\7px.png"), fInfoLevelId=0x0, lpFileInformation=0x12733458 | out: lpFileInformation=0x12733458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba89401, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba89401, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba89401, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9c)) returned 1
	[0200.350] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\8px.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\spacer\\8px.png"), fInfoLevelId=0x0, lpFileInformation=0x127334a8 | out: lpFileInformation=0x127334a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba89401, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba89401, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba89401, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x8b)) returned 1
	[0200.350] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\9px.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\spacer\\9px.png"), fInfoLevelId=0x0, lpFileInformation=0x127334f8 | out: lpFileInformation=0x127334f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba89401, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba89401, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba89401, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9d)) returned 1
	[0200.350] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\StoreLogo.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\storelogo.png"), fInfoLevelId=0x0, lpFileInformation=0x12733548 | out: lpFileInformation=0x12733548*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba89401, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba89401, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba89401, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xc3)) returned 1
	[0200.351] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_BadgeLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\weather_badgelogo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x12733598 | out: lpFileInformation=0x12733598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba89401, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba89401, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba89401, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9f)) returned 1
	[0200.353] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\weather_logosmall.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x127335e8 | out: lpFileInformation=0x127335e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbaaf701, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbaaf701, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbaaf701, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x109)) returned 1
	[0200.356] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_LogoSmall.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\weather_logosmall.targetsize-16.png"), fInfoLevelId=0x0, lpFileInformation=0x12733638 | out: lpFileInformation=0x12733638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbaaf701, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbaaf701, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbaaf701, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x88)) returned 1
	[0200.356] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_LogoSmall.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\weather_logosmall.targetsize-24.png"), fInfoLevelId=0x0, lpFileInformation=0x12733688 | out: lpFileInformation=0x12733688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbaaf701, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbaaf701, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbaaf701, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9f)) returned 1
	[0200.356] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_LogoSmall.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\weather_logosmall.targetsize-256.png"), fInfoLevelId=0x0, lpFileInformation=0x127336d8 | out: lpFileInformation=0x127336d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbaaf701, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbaaf701, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbaaf701, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x597)) returned 1
	[0200.359] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_LogoSmall.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\weather_logosmall.targetsize-32.png"), fInfoLevelId=0x0, lpFileInformation=0x12733728 | out: lpFileInformation=0x12733728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbaaf701, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbaaf701, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbaaf701, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xc5)) returned 1
	[0200.359] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_LogoSmall.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\weather_logosmall.targetsize-48.png"), fInfoLevelId=0x0, lpFileInformation=0x12733778 | out: lpFileInformation=0x12733778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbaaf701, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbaaf701, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbaaf701, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x108)) returned 1
	[0200.360] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\weather_splashscreen.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x127337c8 | out: lpFileInformation=0x127337c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbaaf701, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbaaf701, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbaaf701, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x634)) returned 1
	[0200.362] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_TileLargeSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\weather_tilelargesquare.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x12733818 | out: lpFileInformation=0x12733818*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbaaf701, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbaaf701, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbaaf701, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x4f6)) returned 1
	[0200.364] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_TileMediumSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\weather_tilemediumsquare.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x12733868 | out: lpFileInformation=0x12733868*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbad58c2, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbad58c2, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbad58c2, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1aa)) returned 1
	[0200.365] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_TileSmallSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\weather_tilesmallsquare.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x127338b8 | out: lpFileInformation=0x127338b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbad58c2, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbad58c2, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbad58c2, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x10a)) returned 1
	[0200.368] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\Weather_TileWide.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\weather_tilewide.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x12733908 | out: lpFileInformation=0x12733908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbad58c2, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcbad58c2, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcbad58c2, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x25f)) returned 1
	[0200.368] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black"), fInfoLevelId=0x0, lpFileInformation=0x12733958 | out: lpFileInformation=0x12733958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9f0a67, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba16d03, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba16d03, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.368] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.368] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9f0a67, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba16d03, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba16d03, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffa8
	[0200.372] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9f0a67, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba16d03, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba16d03, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.373] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb9f0a67, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcb9f0a67, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcb9f0a67, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_BadgeLogo.scale-100.png", cAlternateFileName="")) returned 1
	[0200.373] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb9f0a67, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcb9f0a67, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcb9f0a67, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_LogoSmall.scale-100.png", cAlternateFileName="")) returned 1
	[0200.373] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb9f0a67, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcb9f0a67, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcb9f0a67, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_LogoSmall.targetsize-16.png", cAlternateFileName="")) returned 1
	[0200.373] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb9f0a67, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcb9f0a67, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcb9f0a67, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_LogoSmall.targetsize-24.png", cAlternateFileName="")) returned 1
	[0200.373] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb9f0a67, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcb9f0a67, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcb9f0a67, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x597, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_LogoSmall.targetsize-256.png", cAlternateFileName="")) returned 1
	[0200.373] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba16d03, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba16d03, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba16d03, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_LogoSmall.targetsize-32.png", cAlternateFileName="")) returned 1
	[0200.373] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba16d03, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba16d03, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba16d03, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_LogoSmall.targetsize-48.png", cAlternateFileName="")) returned 1
	[0200.373] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba16d03, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba16d03, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba16d03, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_SplashScreen.scale-100.png", cAlternateFileName="")) returned 1
	[0200.373] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba16d03, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba16d03, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba16d03, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x4f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_TileLargeSquare.scale-100.png", cAlternateFileName="")) returned 1
	[0200.373] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba16d03, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba16d03, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba16d03, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_TileMediumSquare.scale-100.png", cAlternateFileName="")) returned 1
	[0200.373] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba16d03, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba16d03, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba16d03, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_TileSmallSquare.scale-100.png", cAlternateFileName="")) returned 1
	[0200.373] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba16d03, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba16d03, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba16d03, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x25f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_TileWide.scale-100.png", cAlternateFileName="")) returned 1
	[0200.373] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.373] FindClose (in: hFindFile=0x79ffa8 | out: hFindFile=0x79ffa8) returned 1
	[0200.374] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_BadgeLogo.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\weather_badgelogo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x12733d68 | out: lpFileInformation=0x12733d68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb9f0a67, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcb9f0a67, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcb9f0a67, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9f)) returned 1
	[0200.375] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_LogoSmall.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\weather_logosmall.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x12733db8 | out: lpFileInformation=0x12733db8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb9f0a67, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcb9f0a67, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcb9f0a67, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x109)) returned 1
	[0200.376] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_LogoSmall.targetsize-16.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\weather_logosmall.targetsize-16.png"), fInfoLevelId=0x0, lpFileInformation=0x12733e08 | out: lpFileInformation=0x12733e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb9f0a67, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcb9f0a67, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcb9f0a67, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x88)) returned 1
	[0200.376] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_LogoSmall.targetsize-24.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\weather_logosmall.targetsize-24.png"), fInfoLevelId=0x0, lpFileInformation=0x12733e58 | out: lpFileInformation=0x12733e58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb9f0a67, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcb9f0a67, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcb9f0a67, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9f)) returned 1
	[0200.377] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_LogoSmall.targetsize-256.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\weather_logosmall.targetsize-256.png"), fInfoLevelId=0x0, lpFileInformation=0x12733ea8 | out: lpFileInformation=0x12733ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb9f0a67, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcb9f0a67, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcb9f0a67, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x597)) returned 1
	[0200.377] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_LogoSmall.targetsize-32.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\weather_logosmall.targetsize-32.png"), fInfoLevelId=0x0, lpFileInformation=0x12733ef8 | out: lpFileInformation=0x12733ef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba16d03, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba16d03, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba16d03, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xc5)) returned 1
	[0200.377] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_LogoSmall.targetsize-48.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\weather_logosmall.targetsize-48.png"), fInfoLevelId=0x0, lpFileInformation=0x12733f48 | out: lpFileInformation=0x12733f48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba16d03, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba16d03, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba16d03, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x108)) returned 1
	[0200.377] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_SplashScreen.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\weather_splashscreen.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x12733f98 | out: lpFileInformation=0x12733f98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba16d03, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba16d03, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba16d03, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x634)) returned 1
	[0200.379] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_TileLargeSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\weather_tilelargesquare.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x1274e008 | out: lpFileInformation=0x1274e008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba16d03, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba16d03, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba16d03, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x4f6)) returned 1
	[0200.379] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_TileMediumSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\weather_tilemediumsquare.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x1274e058 | out: lpFileInformation=0x1274e058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba16d03, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba16d03, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba16d03, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1aa)) returned 1
	[0200.379] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_TileSmallSquare.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\weather_tilesmallsquare.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x1274e0a8 | out: lpFileInformation=0x1274e0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba16d03, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba16d03, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba16d03, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x10a)) returned 1
	[0200.380] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Weather_TileWide.scale-100.png" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\weather_tilewide.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x1274e0f8 | out: lpFileInformation=0x1274e0f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba16d03, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba16d03, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba16d03, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x25f)) returned 1
	[0200.380] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white"), fInfoLevelId=0x0, lpFileInformation=0x1274e148 | out: lpFileInformation=0x1274e148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcba16d03, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba632bf, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba632bf, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0200.380] CreateFileW (lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.6.169.0_x86__8wekyb3d8bbwe\\assets\\apptiles\\contrast-white"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0200.380] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcba16d03, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba632bf, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba632bf, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fda8
	[0200.382] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcba16d03, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba632bf, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba632bf, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0200.382] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba16d03, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba16d03, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba16d03, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_BadgeLogo.scale-100.png", cAlternateFileName="")) returned 1
	[0200.382] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba3cfd2, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba3cfd2, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba3cfd2, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_LogoSmall.scale-100.png", cAlternateFileName="")) returned 1
	[0200.382] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba3cfd2, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba3cfd2, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba3cfd2, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_LogoSmall.targetsize-16.png", cAlternateFileName="")) returned 1
	[0200.382] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba3cfd2, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba3cfd2, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba3cfd2, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_LogoSmall.targetsize-24.png", cAlternateFileName="")) returned 1
	[0200.383] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba3cfd2, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba3cfd2, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba3cfd2, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x572, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_LogoSmall.targetsize-256.png", cAlternateFileName="")) returned 1
	[0200.383] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba3cfd2, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba3cfd2, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba3cfd2, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_LogoSmall.targetsize-32.png", cAlternateFileName="")) returned 1
	[0200.383] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba3cfd2, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba3cfd2, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba3cfd2, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x107, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_LogoSmall.targetsize-48.png", cAlternateFileName="")) returned 1
	[0200.383] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba3cfd2, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba3cfd2, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba3cfd2, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x5ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_SplashScreen.scale-100.png", cAlternateFileName="")) returned 1
	[0200.383] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba3cfd2, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba3cfd2, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba3cfd2, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x4e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_TileLargeSquare.scale-100.png", cAlternateFileName="")) returned 1
	[0200.383] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba632bf, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba632bf, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba632bf, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_TileMediumSquare.scale-100.png", cAlternateFileName="")) returned 1
	[0200.383] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba632bf, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba632bf, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba632bf, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_TileSmallSquare.scale-100.png", cAlternateFileName="")) returned 1
	[0200.383] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba632bf, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcba632bf, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcba632bf, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_TileWide.scale-100.png", cAlternateFileName="")) returned 1
	[0200.383] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0200.383] FindClose (in: hFindFile=0x79fda8 | out: hFindFile=0x79fda8) returned 1
	[0202.473] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x3000, flProtect=0x4) returned 0x332e0000
	[0202.474] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1251580c | out: lpFindFileData=0x1251580c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbc8ae007, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xbc8ae007, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xbc8ae007, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0202.474] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1251580c | out: lpFindFileData=0x1251580c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc8ae007, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xbc8ae007, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xbc8ae007, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x395, dwReserved0=0x0, dwReserved1=0x0, cFileName="win10_20", cAlternateFileName="")) returned 1
	[0202.474] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1251580c | out: lpFindFileData=0x1251580c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc8ae007, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xbc8ae007, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xbc8ae007, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="win10_60", cAlternateFileName="")) returned 1
	[0202.474] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1251580c | out: lpFindFileData=0x1251580c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0202.474] FindClose (in: hFindFile=0x79ffa8 | out: hFindFile=0x79ffa8) returned 1
	[0221.228] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\DESIGNER" (normalized: "c:\\program files (x86)\\common files\\designer"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0221.230] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\DESIGNER\\*", lpFindFileData=0x125c397c | out: lpFindFileData=0x125c397c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x55499555, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x55499555, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x55499555, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fca8
	[0221.230] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x125c399c | out: lpFindFileData=0x125c399c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x55499555, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x55499555, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x55499555, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0221.230] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x125c399c | out: lpFindFileData=0x125c399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8db7800, ftCreationTime.dwHighDateTime=0x1d0d7cc, ftLastAccessTime.dwLowDateTime=0x5549a78f, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa8db7800, ftLastWriteTime.dwHighDateTime=0x1d0d7cc, nFileSizeHigh=0x0, nFileSizeLow=0x3e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.OLB", cAlternateFileName="")) returned 1
	[0221.230] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x125c399c | out: lpFindFileData=0x125c399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0221.231] FindClose (in: hFindFile=0x79fca8 | out: hFindFile=0x79fca8) returned 1
	[0231.343] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x125cc460*, nNumberOfCharsToWrite=0x26, lpNumberOfCharsWritten=0x124229dc, lpReserved=0x0 | out: lpBuffer=0x125cc460*, lpNumberOfCharsWritten=0x124229dc*=0x26) returned 1
	[0231.346] GetFileAttributesExW (in: lpFileName="C:\\Recovery\\WindowsRE" (normalized: "c:\\recovery\\windowsre"), fInfoLevelId=0x0, lpFileInformation=0x125db778 | out: lpFileInformation=0x125db778*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbaa998b0, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x5feba6e9, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5feba6e9, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.346] CreateFileW (lpFileName="C:\\Recovery\\WindowsRE" (normalized: "c:\\recovery\\windowsre"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.347] FindFirstFileW (in: lpFileName="C:\\Recovery\\WindowsRE\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbaa998b0, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x5feba6e9, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5feba6e9, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fce8
	[0231.347] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbaa998b0, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x5feba6e9, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5feba6e9, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.347] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xbaa998b0, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbaa998b0, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x136e0f4d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x306000, dwReserved0=0x0, dwReserved1=0x0, cFileName="boot.sdi", cAlternateFileName="")) returned 1
	[0231.347] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xbadba904, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x5feba6e9, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5feba6e9, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x415, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReAgent.xml", cAlternateFileName="")) returned 1
	[0231.347] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xe1aeb488, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xe1aeb488, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x1f0b6c28, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x11b68298, dwReserved0=0x0, dwReserved1=0x0, cFileName="Winre.wim", cAlternateFileName="")) returned 1
	[0231.347] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.347] FindClose (in: hFindFile=0x79fce8 | out: hFindFile=0x79fce8) returned 1
	[0231.347] GetFileAttributesExW (in: lpFileName="C:\\Recovery\\WindowsRE\\ReAgent.xml" (normalized: "c:\\recovery\\windowsre\\reagent.xml"), fInfoLevelId=0x0, lpFileInformation=0x125db8b8 | out: lpFileInformation=0x125db8b8*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xbadba904, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x5feba6e9, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5feba6e9, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x415)) returned 1
	[0231.348] GetFileAttributesExW (in: lpFileName="C:\\Recovery\\WindowsRE\\Winre.wim" (normalized: "c:\\recovery\\windowsre\\winre.wim"), fInfoLevelId=0x0, lpFileInformation=0x125db908 | out: lpFileInformation=0x125db908*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xe1aeb488, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xe1aeb488, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x1f0b6c28, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x11b68298)) returned 1
	[0231.353] GetFileAttributesExW (in: lpFileName="C:\\Recovery\\WindowsRE\\boot.sdi" (normalized: "c:\\recovery\\windowsre\\boot.sdi"), fInfoLevelId=0x0, lpFileInformation=0x125db958 | out: lpFileInformation=0x125db958*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xbaa998b0, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbaa998b0, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x136e0f4d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x306000)) returned 1
	[0231.353] GetFileAttributesExW (in: lpFileName="C:\\System Volume Information" (normalized: "c:\\system volume information"), fInfoLevelId=0x0, lpFileInformation=0x125db9a8 | out: lpFileInformation=0x125db9a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x85289733, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x2dbfc137, ftLastAccessTime.dwHighDateTime=0x1d70505, ftLastWriteTime.dwLowDateTime=0x2dbfc137, ftLastWriteTime.dwHighDateTime=0x1d70505, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0231.353] CreateFileW (lpFileName="C:\\System Volume Information" (normalized: "c:\\system volume information"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.353] FindFirstFileW (in: lpFileName="C:\\System Volume Information\\*", lpFindFileData=0x12423a44 | out: lpFindFileData=0x12423a44*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0231.354] GetFileAttributesExW (in: lpFileName="C:\\Users" (normalized: "c:\\users"), fInfoLevelId=0x0, lpFileInformation=0x125db9f8 | out: lpFileInformation=0x125db9f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0231.354] CreateFileW (lpFileName="C:\\Users" (normalized: "c:\\users"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.354] FindFirstFileW (in: lpFileName="C:\\Users\\*", lpFindFileData=0x12423a44 | out: lpFindFileData=0x12423a44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffa8
	[0231.354] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.354] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x4f6643a1, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0x4f6643a1, ftLastAccessTime.dwHighDateTime=0x1d112ea, ftLastWriteTime.dwLowDateTime=0x4f6643a1, ftLastWriteTime.dwHighDateTime=0x1d112ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1
	[0231.354] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1
	[0231.354] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x4f6643a1, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0x4f6643a1, ftLastAccessTime.dwHighDateTime=0x1d112ea, ftLastWriteTime.dwLowDateTime=0x4f6643a1, ftLastWriteTime.dwHighDateTime=0x1d112ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1
	[0231.354] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3757c8c, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973af366, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x973af366, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0231.354] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 1
	[0231.354] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xeb7c536d, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xeb7c536d, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 1
	[0231.354] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.354] FindClose (in: hFindFile=0x79ffa8 | out: hFindFile=0x79ffa8) returned 1
	[0231.355] CreateFileW (lpFileName="C:\\Users\\README.html" (normalized: "c:\\users\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0231.357] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422e5c | out: lpMode=0x12422e5c) returned 0
	[0231.357] WriteFile (in: hFile=0x178, lpBuffer=0x12694d80*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422e4c, lpOverlapped=0x0 | out: lpBuffer=0x12694d80*, lpNumberOfBytesWritten=0x12422e4c*=0xc85, lpOverlapped=0x0) returned 1
	[0231.358] CloseHandle (hObject=0x178) returned 1
	[0231.360] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x125cc500*, nNumberOfCharsToWrite=0x23, lpNumberOfCharsWritten=0x124229dc, lpReserved=0x0 | out: lpBuffer=0x125cc500*, lpNumberOfCharsWritten=0x124229dc*=0x23) returned 1
	[0231.362] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users" (normalized: "c:\\users\\all users"), fInfoLevelId=0x0, lpFileInformation=0x125dbc28 | out: lpFileInformation=0x125dbc28*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x4f6643a1, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0x4f6643a1, ftLastAccessTime.dwHighDateTime=0x1d112ea, ftLastWriteTime.dwLowDateTime=0x4f6643a1, ftLastWriteTime.dwHighDateTime=0x1d112ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.362] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default" (normalized: "c:\\users\\default"), fInfoLevelId=0x0, lpFileInformation=0x125dbc78 | out: lpFileInformation=0x125dbc78*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.362] CreateFileW (lpFileName="C:\\Users\\Default" (normalized: "c:\\users\\default"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.362] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9a8
	[0231.366] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.367] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1
	[0231.367] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d54d8a8, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d54d8a8, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d54d8a8, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0231.367] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1
	[0231.367] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1
	[0231.367] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d527734, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d527734, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1
	[0231.367] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1
	[0231.367] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1
	[0231.367] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1
	[0231.367] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1
	[0231.367] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1
	[0231.367] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d527734, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d527734, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d527734, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1
	[0231.367] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1
	[0231.368] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x31bfa5a5, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xea64ab63, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xea64ab63, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1
	[0231.368] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x31cb9166, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x31cb9166, ftLastAccessTime.dwHighDateTime=0x1d112dc, ftLastWriteTime.dwLowDateTime=0x31cb9166, ftLastWriteTime.dwHighDateTime=0x1d112dc, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1
	[0231.368] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x31cb9166, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x31cb9166, ftLastAccessTime.dwHighDateTime=0x1d112dc, ftLastWriteTime.dwLowDateTime=0x31cb9166, ftLastWriteTime.dwHighDateTime=0x1d112dc, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1
	[0231.368] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8d5f4e96, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x8d5f4e96, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x8d61ae52, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{62e13464-7ee5-11e5-80c4-a4badb40df56}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1
	[0231.368] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8d5f4e96, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x8d5f4e96, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x8d61ae52, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{62e13464-7ee5-11e5-80c4-a4badb40df56}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1
	[0231.368] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8d61ae52, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x8d61ae52, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x8d61ae52, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{62e13464-7ee5-11e5-80c4-a4badb40df56}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1
	[0231.368] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1
	[0231.368] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1
	[0231.368] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1
	[0231.368] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1
	[0231.368] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1
	[0231.368] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1
	[0231.368] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1
	[0231.368] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1
	[0231.368] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.368] FindClose (in: hFindFile=0x79f9a8 | out: hFindFile=0x79f9a8) returned 1
	[0231.369] CreateFileW (lpFileName="C:\\Users\\Default\\README.html" (normalized: "c:\\users\\default\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0231.370] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422df8 | out: lpMode=0x12422df8) returned 0
	[0231.370] WriteFile (in: hFile=0x178, lpBuffer=0x12696880*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422de8, lpOverlapped=0x0 | out: lpBuffer=0x12696880*, lpNumberOfBytesWritten=0x12422de8*=0xc85, lpOverlapped=0x0) returned 1
	[0231.371] CloseHandle (hObject=0x178) returned 1
	[0231.371] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x124f4a80*, nNumberOfCharsToWrite=0x2b, lpNumberOfCharsWritten=0x12422978, lpReserved=0x0 | out: lpBuffer=0x124f4a80*, lpNumberOfCharsWritten=0x12422978*=0x2b) returned 1
	[0231.373] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData" (normalized: "c:\\users\\default\\appdata"), fInfoLevelId=0x0, lpFileInformation=0x1281e508 | out: lpFileInformation=0x1281e508*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.373] CreateFileW (lpFileName="C:\\Users\\Default\\AppData" (normalized: "c:\\users\\default\\appdata"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.373] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79faa8
	[0231.373] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.373] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1
	[0231.373] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1
	[0231.373] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.373] FindClose (in: hFindFile=0x79faa8 | out: hFindFile=0x79faa8) returned 1
	[0231.373] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local" (normalized: "c:\\users\\default\\appdata\\local"), fInfoLevelId=0x0, lpFileInformation=0x1281e5f8 | out: lpFileInformation=0x1281e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.375] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local" (normalized: "c:\\users\\default\\appdata\\local"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.375] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ff68
	[0231.379] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.379] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0231.379] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1
	[0231.379] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6ec87d0d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0231.379] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0231.379] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1
	[0231.379] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.379] FindClose (in: hFindFile=0x79ff68 | out: hFindFile=0x79ff68) returned 1
	[0231.380] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Application Data" (normalized: "c:\\users\\default\\appdata\\local\\application data"), fInfoLevelId=0x0, lpFileInformation=0x1281e7d8 | out: lpFileInformation=0x1281e7d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.381] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\History" (normalized: "c:\\users\\default\\appdata\\local\\history"), fInfoLevelId=0x0, lpFileInformation=0x1281e828 | out: lpFileInformation=0x1281e828*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.381] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft" (normalized: "c:\\users\\default\\appdata\\local\\microsoft"), fInfoLevelId=0x0, lpFileInformation=0x1281e878 | out: lpFileInformation=0x1281e878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6ec87d0d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.381] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft" (normalized: "c:\\users\\default\\appdata\\local\\microsoft"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.382] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6ec87d0d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fce8
	[0231.382] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6ec87d0d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.382] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec87d0d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ec87d0d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization", cAlternateFileName="INPUTP~1")) returned 1
	[0231.382] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0231.382] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x377dee7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x377dee7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1
	[0231.382] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.382] FindClose (in: hFindFile=0x79fce8 | out: hFindFile=0x79fce8) returned 1
	[0231.382] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\InputPersonalization" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\inputpersonalization"), fInfoLevelId=0x0, lpFileInformation=0x1281e9b8 | out: lpFileInformation=0x1281e9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec87d0d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ec87d0d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.383] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\InputPersonalization" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\inputpersonalization"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.383] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\InputPersonalization\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec87d0d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ec87d0d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0028
	[0231.383] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec87d0d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ec87d0d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.383] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec87d0d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ec87d0d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TrainedDataStore", cAlternateFileName="TRAINE~1")) returned 1
	[0231.383] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.383] FindClose (in: hFindFile=0x7a0028 | out: hFindFile=0x7a0028) returned 1
	[0231.383] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\InputPersonalization\\TrainedDataStore" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\inputpersonalization\\traineddatastore"), fInfoLevelId=0x0, lpFileInformation=0x1281ea58 | out: lpFileInformation=0x1281ea58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec87d0d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ec87d0d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.383] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\InputPersonalization\\TrainedDataStore" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\inputpersonalization\\traineddatastore"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.383] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\InputPersonalization\\TrainedDataStore\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec87d0d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ec87d0d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fe28
	[0231.384] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec87d0d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ec87d0d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.384] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.384] FindClose (in: hFindFile=0x79fe28 | out: hFindFile=0x79fe28) returned 1
	[0231.384] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows"), fInfoLevelId=0x0, lpFileInformation=0x1281eaa8 | out: lpFileInformation=0x1281eaa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.384] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.384] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0068
	[0231.386] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.386] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameExplorer", cAlternateFileName="GAMEEX~1")) returned 1
	[0231.386] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1
	[0231.386] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1
	[0231.386] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1
	[0231.386] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3757c8c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3757c8c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shell", cAlternateFileName="")) returned 1
	[0231.386] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1
	[0231.386] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinX", cAlternateFileName="")) returned 1
	[0231.386] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.386] FindClose (in: hFindFile=0x7a0068 | out: hFindFile=0x7a0068) returned 1
	[0231.387] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\GameExplorer" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\gameexplorer"), fInfoLevelId=0x0, lpFileInformation=0x1281ed28 | out: lpFileInformation=0x1281ed28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.388] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\GameExplorer" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\gameexplorer"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.389] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0028
	[0231.389] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.389] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.389] FindClose (in: hFindFile=0x7a0028 | out: hFindFile=0x7a0028) returned 1
	[0231.389] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history"), fInfoLevelId=0x0, lpFileInformation=0x1281ed78 | out: lpFileInformation=0x1281ed78*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.390] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.390] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fda8
	[0231.390] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.390] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.390] FindClose (in: hFindFile=0x79fda8 | out: hFindFile=0x79fda8) returned 1
	[0231.390] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\INetCache" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\inetcache"), fInfoLevelId=0x0, lpFileInformation=0x1281edc8 | out: lpFileInformation=0x1281edc8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.390] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\INetCache" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\inetcache"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.391] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\INetCache\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fd28
	[0231.391] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.391] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.391] FindClose (in: hFindFile=0x79fd28 | out: hFindFile=0x79fd28) returned 1
	[0231.391] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\INetCookies" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\inetcookies"), fInfoLevelId=0x0, lpFileInformation=0x1281ee18 | out: lpFileInformation=0x1281ee18*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.391] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\INetCookies" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\inetcookies"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.391] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fe68
	[0231.393] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.393] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.393] FindClose (in: hFindFile=0x79fe68 | out: hFindFile=0x79fe68) returned 1
	[0231.393] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Shell" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\shell"), fInfoLevelId=0x0, lpFileInformation=0x1281ee68 | out: lpFileInformation=0x1281ee68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3757c8c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3757c8c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.393] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Shell" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\shell"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.394] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Shell\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3757c8c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3757c8c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fce8
	[0231.394] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3757c8c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3757c8c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.394] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3757c8c, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973af366, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x973d55c1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x18778, dwReserved0=0x0, dwReserved1=0x0, cFileName="DefaultLayouts.xml", cAlternateFileName="DEFAUL~1.XML")) returned 1
	[0231.394] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.394] FindClose (in: hFindFile=0x79fce8 | out: hFindFile=0x79fce8) returned 1
	[0231.394] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Shell\\DefaultLayouts.xml" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\shell\\defaultlayouts.xml"), fInfoLevelId=0x0, lpFileInformation=0x1281ef08 | out: lpFileInformation=0x1281ef08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3757c8c, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973af366, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x973d55c1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x18778)) returned 1
	[0231.394] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files"), fInfoLevelId=0x0, lpFileInformation=0x1281ef58 | out: lpFileInformation=0x1281ef58*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.394] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx"), fInfoLevelId=0x0, lpFileInformation=0x1281efa8 | out: lpFileInformation=0x1281efa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.395] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.395] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f8e8
	[0231.395] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.396] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf686326, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf686326, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Group1", cAlternateFileName="")) returned 1
	[0231.396] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf639e71, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Group2", cAlternateFileName="")) returned 1
	[0231.396] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf639e71, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Group3", cAlternateFileName="")) returned 1
	[0231.396] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.396] FindClose (in: hFindFile=0x79f8e8 | out: hFindFile=0x79f8e8) returned 1
	[0231.396] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group1"), fInfoLevelId=0x0, lpFileInformation=0x1281f0e8 | out: lpFileInformation=0x1281f0e8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf686326, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf686326, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.396] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.396] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf686326, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf686326, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f968
	[0231.396] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf686326, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf686326, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.396] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252726a6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252726a6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252726a6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x455, dwReserved0=0x0, dwReserved1=0x0, cFileName="1 - Desktop.lnk", cAlternateFileName="")) returned 1
	[0231.396] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf686326, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x9ee78381, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x9ee78381, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x51, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0231.396] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.397] FindClose (in: hFindFile=0x79f968 | out: hFindFile=0x79f968) returned 1
	[0231.397] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group1\\1 - desktop.lnk"), fInfoLevelId=0x0, lpFileInformation=0x1281f1d8 | out: lpFileInformation=0x1281f1d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252726a6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252726a6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252726a6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x455)) returned 1
	[0231.397] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group1\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x1281f228 | out: lpFileInformation=0x1281f228*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf686326, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x9ee78381, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x9ee78381, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x51)) returned 1
	[0231.397] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2"), fInfoLevelId=0x0, lpFileInformation=0x1281f278 | out: lpFileInformation=0x1281f278*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf639e71, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.397] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.397] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf639e71, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fb68
	[0231.399] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf639e71, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.399] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x455, dwReserved0=0x0, dwReserved1=0x0, cFileName="1 - Run.lnk", cAlternateFileName="")) returned 1
	[0231.399] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x455, dwReserved0=0x0, dwReserved1=0x0, cFileName="2 - Search.lnk", cAlternateFileName="")) returned 1
	[0231.400] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x455, dwReserved0=0x0, dwReserved1=0x0, cFileName="3 - Windows Explorer.lnk", cAlternateFileName="")) returned 1
	[0231.400] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x251fff9e, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x251fff9e, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x251fff9e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="4 - Control Panel.lnk", cAlternateFileName="")) returned 1
	[0231.400] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="5 - Task Manager.lnk", cAlternateFileName="")) returned 1
	[0231.400] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf639e71, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x9ee52126, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x9ee78381, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0231.400] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.400] FindClose (in: hFindFile=0x79fb68 | out: hFindFile=0x79fb68) returned 1
	[0231.401] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\1 - run.lnk"), fInfoLevelId=0x0, lpFileInformation=0x1281f4a8 | out: lpFileInformation=0x1281f4a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x455)) returned 1
	[0231.402] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\2 - search.lnk"), fInfoLevelId=0x0, lpFileInformation=0x1281f4f8 | out: lpFileInformation=0x1281f4f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x455)) returned 1
	[0231.402] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\3 - windows explorer.lnk"), fInfoLevelId=0x0, lpFileInformation=0x1281f548 | out: lpFileInformation=0x1281f548*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x455)) returned 1
	[0231.403] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\4 - control panel.lnk"), fInfoLevelId=0x0, lpFileInformation=0x1281f598 | out: lpFileInformation=0x1281f598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x251fff9e, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x251fff9e, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x251fff9e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f7)) returned 1
	[0231.403] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\5 - task manager.lnk"), fInfoLevelId=0x0, lpFileInformation=0x1281f5e8 | out: lpFileInformation=0x1281f5e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3fd)) returned 1
	[0231.403] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x1281f638 | out: lpFileInformation=0x1281f638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf639e71, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x9ee52126, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x9ee78381, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x14c)) returned 1
	[0231.403] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3"), fInfoLevelId=0x0, lpFileInformation=0x1281f688 | out: lpFileInformation=0x1281f688*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf639e71, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.403] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.403] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf639e71, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fb28
	[0231.407] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf639e71, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.407] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252988fc, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252988fc, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252988fc, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="01 - Command Prompt.lnk", cAlternateFileName="")) returned 1
	[0231.407] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x251fff9e, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x251fff9e, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x251fff9e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x467, dwReserved0=0x0, dwReserved1=0x0, cFileName="01a - Windows PowerShell.lnk", cAlternateFileName="")) returned 1
	[0231.407] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252988fc, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252988fc, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252988fc, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x423, dwReserved0=0x0, dwReserved1=0x0, cFileName="02 - Command Prompt.lnk", cAlternateFileName="")) returned 1
	[0231.407] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252726a6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252726a6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252726a6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0x0, dwReserved1=0x0, cFileName="02a - Windows PowerShell.lnk", cAlternateFileName="")) returned 1
	[0231.407] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="03 - Computer Management.lnk", cAlternateFileName="")) returned 1
	[0231.408] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="04 - Disk Management.lnk", cAlternateFileName="")) returned 1
	[0231.408] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252726a6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252726a6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252726a6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x449, dwReserved0=0x0, dwReserved1=0x0, cFileName="04-1 - Network Connections.lnk", cAlternateFileName="")) returned 1
	[0231.408] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252726a6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252726a6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252726a6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x433, dwReserved0=0x0, dwReserved1=0x0, cFileName="05 - Device Manager.lnk", cAlternateFileName="")) returned 1
	[0231.408] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252988fc, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252988fc, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252988fc, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0x0, dwReserved1=0x0, cFileName="06 - System.lnk", cAlternateFileName="")) returned 1
	[0231.408] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252726a6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252726a6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252726a6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="07 - Event Viewer.lnk", cAlternateFileName="")) returned 1
	[0231.408] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x431, dwReserved0=0x0, dwReserved1=0x0, cFileName="08 - Power Options.lnk", cAlternateFileName="")) returned 1
	[0231.408] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="09 - Mobility Center.lnk", cAlternateFileName="")) returned 1
	[0231.408] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x251fff9e, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x251fff9e, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x43f, dwReserved0=0x0, dwReserved1=0x0, cFileName="10 - Programs and Features.lnk", cAlternateFileName="")) returned 1
	[0231.408] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf639e71, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x9ee52126, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x9ee78381, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0231.408] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.409] FindClose (in: hFindFile=0x79fb28 | out: hFindFile=0x79fb28) returned 1
	[0231.409] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\01 - command prompt.lnk"), fInfoLevelId=0x0, lpFileInformation=0x1281fb38 | out: lpFileInformation=0x1281fb38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252988fc, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252988fc, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252988fc, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f7)) returned 1
	[0231.411] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\01a - windows powershell.lnk"), fInfoLevelId=0x0, lpFileInformation=0x1281fb88 | out: lpFileInformation=0x1281fb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x251fff9e, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x251fff9e, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x251fff9e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x467)) returned 1
	[0231.411] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\02 - command prompt.lnk"), fInfoLevelId=0x0, lpFileInformation=0x1281fbd8 | out: lpFileInformation=0x1281fbd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252988fc, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252988fc, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252988fc, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x423)) returned 1
	[0231.411] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\02a - windows powershell.lnk"), fInfoLevelId=0x0, lpFileInformation=0x1281fc28 | out: lpFileInformation=0x1281fc28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252726a6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252726a6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252726a6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x493)) returned 1
	[0231.412] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\03 - computer management.lnk"), fInfoLevelId=0x0, lpFileInformation=0x1281fc78 | out: lpFileInformation=0x1281fc78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f7)) returned 1
	[0231.413] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\04 - disk management.lnk"), fInfoLevelId=0x0, lpFileInformation=0x1281fcc8 | out: lpFileInformation=0x1281fcc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f7)) returned 1
	[0231.413] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - Network Connections.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - network connections.lnk"), fInfoLevelId=0x0, lpFileInformation=0x1281fd18 | out: lpFileInformation=0x1281fd18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252726a6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252726a6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252726a6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x449)) returned 1
	[0231.413] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\05 - device manager.lnk"), fInfoLevelId=0x0, lpFileInformation=0x1281fd68 | out: lpFileInformation=0x1281fd68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252726a6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252726a6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252726a6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x433)) returned 1
	[0231.413] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - System.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - system.lnk"), fInfoLevelId=0x0, lpFileInformation=0x1281fe08 | out: lpFileInformation=0x1281fe08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252988fc, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252988fc, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252988fc, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x425)) returned 1
	[0231.414] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\07 - event viewer.lnk"), fInfoLevelId=0x0, lpFileInformation=0x1281fe58 | out: lpFileInformation=0x1281fe58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252726a6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252726a6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252726a6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f7)) returned 1
	[0231.415] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - Power Options.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - power options.lnk"), fInfoLevelId=0x0, lpFileInformation=0x1281fea8 | out: lpFileInformation=0x1281fea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x431)) returned 1
	[0231.415] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\09 - mobility center.lnk"), fInfoLevelId=0x0, lpFileInformation=0x1281fef8 | out: lpFileInformation=0x1281fef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f7)) returned 1
	[0231.415] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - Programs and Features.lnk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - programs and features.lnk"), fInfoLevelId=0x0, lpFileInformation=0x1281ff48 | out: lpFileInformation=0x1281ff48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x251fff9e, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x251fff9e, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x43f)) returned 1
	[0231.416] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x1281ff98 | out: lpFileInformation=0x1281ff98*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf639e71, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x9ee52126, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x9ee78381, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3bb)) returned 1
	[0231.416] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar"), fInfoLevelId=0x0, lpFileInformation=0x12430058 | out: lpFileInformation=0x12430058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x377dee7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x377dee7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.419] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.419] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x377dee7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x377dee7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0068
	[0231.419] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x377dee7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x377dee7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.419] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadgets", cAlternateFileName="")) returned 1
	[0231.419] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x377dee7, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973d55c1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x973d55c1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.ini", cAlternateFileName="")) returned 1
	[0231.419] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.420] FindClose (in: hFindFile=0x7a0068 | out: hFindFile=0x7a0068) returned 1
	[0231.420] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\gadgets"), fInfoLevelId=0x0, lpFileInformation=0x12430148 | out: lpFileInformation=0x12430148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.420] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\gadgets"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.420] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9e8
	[0231.420] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.420] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.420] FindClose (in: hFindFile=0x79f9e8 | out: hFindFile=0x79f9e8) returned 1
	[0231.421] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\settings.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\settings.ini"), fInfoLevelId=0x0, lpFileInformation=0x12430198 | out: lpFileInformation=0x12430198*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x377dee7, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973d55c1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x973d55c1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x50)) returned 1
	[0231.421] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp" (normalized: "c:\\users\\default\\appdata\\local\\temp"), fInfoLevelId=0x0, lpFileInformation=0x124301e8 | out: lpFileInformation=0x124301e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.421] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp" (normalized: "c:\\users\\default\\appdata\\local\\temp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.421] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fca8
	[0231.421] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.421] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.422] FindClose (in: hFindFile=0x79fca8 | out: hFindFile=0x79fca8) returned 1
	[0231.422] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files" (normalized: "c:\\users\\default\\appdata\\local\\temporary internet files"), fInfoLevelId=0x0, lpFileInformation=0x12430238 | out: lpFileInformation=0x12430238*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.422] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming" (normalized: "c:\\users\\default\\appdata\\roaming"), fInfoLevelId=0x0, lpFileInformation=0x12430288 | out: lpFileInformation=0x12430288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.422] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming" (normalized: "c:\\users\\default\\appdata\\roaming"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.422] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fc28
	[0231.422] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.422] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0231.422] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.423] FindClose (in: hFindFile=0x79fc28 | out: hFindFile=0x79fc28) returned 1
	[0231.423] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft"), fInfoLevelId=0x0, lpFileInformation=0x12430328 | out: lpFileInformation=0x12430328*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.424] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.424] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fa68
	[0231.424] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.424] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1
	[0231.425] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0231.425] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.425] FindClose (in: hFindFile=0x79fa68 | out: hFindFile=0x79fa68) returned 1
	[0231.425] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer"), fInfoLevelId=0x0, lpFileInformation=0x12430418 | out: lpFileInformation=0x12430418*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.425] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.425] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f8e8
	[0231.425] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.426] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf6600cb, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf6600cb, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Quick Launch", cAlternateFileName="QUICKL~1")) returned 1
	[0231.426] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.426] FindClose (in: hFindFile=0x79f8e8 | out: hFindFile=0x79f8e8) returned 1
	[0231.426] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch"), fInfoLevelId=0x0, lpFileInformation=0x124304b8 | out: lpFileInformation=0x124304b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf6600cb, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf6600cb, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.426] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.426] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf6600cb, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf6600cb, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9e8
	[0231.427] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf6600cb, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf6600cb, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.427] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf6600cb, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x9ee52126, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x9ee78381, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x94, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0231.427] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x251fff9e, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x251fff9e, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x251fff9e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shows Desktop.lnk", cAlternateFileName="")) returned 1
	[0231.427] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x14e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Window Switcher.lnk", cAlternateFileName="")) returned 1
	[0231.427] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.427] FindClose (in: hFindFile=0x79f9e8 | out: hFindFile=0x79f9e8) returned 1
	[0231.427] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), fInfoLevelId=0x0, lpFileInformation=0x124305f8 | out: lpFileInformation=0x124305f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x251fff9e, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x251fff9e, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x251fff9e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x160)) returned 1
	[0231.428] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), fInfoLevelId=0x0, lpFileInformation=0x12430648 | out: lpFileInformation=0x12430648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x14e)) returned 1
	[0231.429] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x12430698 | out: lpFileInformation=0x12430698*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf6600cb, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x9ee52126, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x9ee78381, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x94)) returned 1
	[0231.429] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows"), fInfoLevelId=0x0, lpFileInformation=0x124306e8 | out: lpFileInformation=0x124306e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.429] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.430] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffa8
	[0231.432] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.432] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network Shortcuts", cAlternateFileName="NETWOR~1")) returned 1
	[0231.432] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Printer Shortcuts", cAlternateFileName="PRINTE~1")) returned 1
	[0231.432] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1
	[0231.432] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37a4145, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37a4145, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1
	[0231.432] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1
	[0231.432] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1
	[0231.432] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.432] FindClose (in: hFindFile=0x79ffa8 | out: hFindFile=0x79ffa8) returned 1
	[0231.433] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\network shortcuts"), fInfoLevelId=0x0, lpFileInformation=0x12430918 | out: lpFileInformation=0x12430918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.436] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\network shortcuts"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.436] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9e8
	[0231.437] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.437] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.437] FindClose (in: hFindFile=0x79f9e8 | out: hFindFile=0x79f9e8) returned 1
	[0231.437] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\printer shortcuts"), fInfoLevelId=0x0, lpFileInformation=0x12430968 | out: lpFileInformation=0x12430968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.437] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\printer shortcuts"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.437] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9e8
	[0231.437] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.438] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.438] FindClose (in: hFindFile=0x79f9e8 | out: hFindFile=0x79f9e8) returned 1
	[0231.438] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent"), fInfoLevelId=0x0, lpFileInformation=0x124309b8 | out: lpFileInformation=0x124309b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.438] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.438] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fda8
	[0231.438] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.438] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.438] FindClose (in: hFindFile=0x79fda8 | out: hFindFile=0x79fda8) returned 1
	[0231.438] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto"), fInfoLevelId=0x0, lpFileInformation=0x12430a08 | out: lpFileInformation=0x12430a08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37a4145, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37a4145, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.439] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.439] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37a4145, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37a4145, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0068
	[0231.441] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37a4145, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37a4145, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.441] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37a4145, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973d55c1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x973d55c1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Compressed (zipped) Folder.ZFSendToTarget", cAlternateFileName="COMPRE~1.ZFS")) returned 1
	[0231.441] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37a4145, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973d55c1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x973d55c1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop (create shortcut).DeskLink", cAlternateFileName="DESKTO~1.DES")) returned 1
	[0231.441] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x37a4145, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973d55c1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x9ee2becc, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0231.441] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x571e447b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x571e447b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x571e447b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x458, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fax Recipient.lnk", cAlternateFileName="")) returned 1
	[0231.441] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37a4145, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973fb817, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x973fb817, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mail Recipient.MAPIMail", cAlternateFileName="MAILRE~1.MAP")) returned 1
	[0231.441] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.441] FindClose (in: hFindFile=0x7a0068 | out: hFindFile=0x7a0068) returned 1
	[0231.442] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\compressed (zipped) folder.zfsendtotarget"), fInfoLevelId=0x0, lpFileInformation=0x12430be8 | out: lpFileInformation=0x12430be8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37a4145, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973d55c1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x973d55c1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3)) returned 1
	[0231.443] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop (create shortcut).desklink"), fInfoLevelId=0x0, lpFileInformation=0x12430c38 | out: lpFileInformation=0x12430c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37a4145, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973d55c1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x973d55c1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x7)) returned 1
	[0231.443] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x12430c88 | out: lpFileInformation=0x12430c88*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x37a4145, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973d55c1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x9ee2becc, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x22e)) returned 1
	[0231.443] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), fInfoLevelId=0x0, lpFileInformation=0x12430cd8 | out: lpFileInformation=0x12430cd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x571e447b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x571e447b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x571e447b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x458)) returned 1
	[0231.444] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\mail recipient.mapimail"), fInfoLevelId=0x0, lpFileInformation=0x12430d28 | out: lpFileInformation=0x12430d28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37a4145, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973fb817, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x973fb817, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4)) returned 1
	[0231.444] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu"), fInfoLevelId=0x0, lpFileInformation=0x12430d78 | out: lpFileInformation=0x12430d78*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.445] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.445] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fd68
	[0231.446] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.446] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 1
	[0231.446] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.446] FindClose (in: hFindFile=0x79fd68 | out: hFindFile=0x79fd68) returned 1
	[0231.446] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs"), fInfoLevelId=0x0, lpFileInformation=0x12430e18 | out: lpFileInformation=0x12430e18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.446] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.446] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fc68
	[0231.449] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.449] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37ca39c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37ca39c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility", cAlternateFileName="ACCESS~1")) returned 1
	[0231.449] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37ca39c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37ca39c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~2")) returned 1
	[0231.449] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37ca39c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37ca39c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1
	[0231.449] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37ca39c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37ca39c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1
	[0231.449] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf639e71, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell", cAlternateFileName="WINDOW~1")) returned 1
	[0231.449] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.449] FindClose (in: hFindFile=0x79fc68 | out: hFindFile=0x79fc68) returned 1
	[0231.450] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility"), fInfoLevelId=0x0, lpFileInformation=0x12430ff8 | out: lpFileInformation=0x12430ff8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37ca39c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37ca39c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.451] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.451] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\*", lpFindFileData=0x12423724 | out: lpFindFileData=0x12423724*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37ca39c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37ca39c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fea8
	[0231.452] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37ca39c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37ca39c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.452] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x37a4145, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973fb817, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x9ee2becc, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0231.452] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18863489, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x18863489, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x18863489, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x0, dwReserved1=0x0, cFileName="Magnify.lnk", cAlternateFileName="")) returned 1
	[0231.452] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x188896e8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x188896e8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x188896e8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x454, dwReserved0=0x0, dwReserved1=0x0, cFileName="Narrator.lnk", cAlternateFileName="")) returned 1
	[0231.452] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1870bf67, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1870bf67, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1870bf67, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x0, dwReserved1=0x0, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="")) returned 1
	[0231.452] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.452] FindClose (in: hFindFile=0x79fea8 | out: hFindFile=0x79fea8) returned 1
	[0231.452] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x12431188 | out: lpFileInformation=0x12431188*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x37a4145, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973fb817, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x9ee2becc, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x238)) returned 1
	[0231.452] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk"), fInfoLevelId=0x0, lpFileInformation=0x124311d8 | out: lpFileInformation=0x124311d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18863489, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x18863489, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x18863489, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x452)) returned 1
	[0231.454] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk"), fInfoLevelId=0x0, lpFileInformation=0x12431228 | out: lpFileInformation=0x12431228*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x188896e8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x188896e8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x188896e8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x454)) returned 1
	[0231.454] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk"), fInfoLevelId=0x0, lpFileInformation=0x12431278 | out: lpFileInformation=0x12431278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1870bf67, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1870bf67, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1870bf67, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x452)) returned 1
	[0231.454] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories"), fInfoLevelId=0x0, lpFileInformation=0x124312c8 | out: lpFileInformation=0x124312c8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37ca39c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37ca39c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.454] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.454] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x12423724 | out: lpFindFileData=0x12423724*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37ca39c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37ca39c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffe8
	[0231.455] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37ca39c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37ca39c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.455] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x37ca39c, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973fb817, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x9ee05c71, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x148, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0231.455] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2206112b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2206112b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2206112b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notepad.lnk", cAlternateFileName="")) returned 1
	[0231.455] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.455] FindClose (in: hFindFile=0x79ffe8 | out: hFindFile=0x79ffe8) returned 1
	[0231.455] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x124313b8 | out: lpFileInformation=0x124313b8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x37ca39c, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973fb817, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x9ee05c71, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x148)) returned 1
	[0231.481] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), fInfoLevelId=0x0, lpFileInformation=0x12431408 | out: lpFileInformation=0x12431408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2206112b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2206112b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2206112b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x486)) returned 1
	[0231.481] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance"), fInfoLevelId=0x0, lpFileInformation=0x12431458 | out: lpFileInformation=0x12431458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37ca39c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37ca39c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.484] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.484] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x12423724 | out: lpFindFileData=0x12423724*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37ca39c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37ca39c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0068
	[0231.484] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37ca39c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37ca39c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.484] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x37ca39c, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973fb817, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x973fb817, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0231.484] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.484] FindClose (in: hFindFile=0x7a0068 | out: hFindFile=0x7a0068) returned 1
	[0231.484] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x124314f8 | out: lpFileInformation=0x124314f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x37ca39c, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973fb817, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x973fb817, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaa)) returned 1
	[0231.485] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools"), fInfoLevelId=0x0, lpFileInformation=0x12431548 | out: lpFileInformation=0x12431548*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37ca39c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37ca39c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.485] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.485] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\*", lpFindFileData=0x12423724 | out: lpFindFileData=0x12423724*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37ca39c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37ca39c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fa68
	[0231.487] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37ca39c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37ca39c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.487] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14f9d556, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x14f9d556, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x14f9d556, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x476, dwReserved0=0x0, dwReserved1=0x0, cFileName="Command Prompt.lnk", cAlternateFileName="")) returned 1
	[0231.487] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252726a6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252726a6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252726a6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x14f, dwReserved0=0x0, dwReserved1=0x0, cFileName="computer.lnk", cAlternateFileName="")) returned 1
	[0231.487] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252726a6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252726a6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252726a6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x195, dwReserved0=0x0, dwReserved1=0x0, cFileName="Control Panel.lnk", cAlternateFileName="")) returned 1
	[0231.487] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x32f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default Apps.lnk", cAlternateFileName="")) returned 1
	[0231.487] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x37ca39c, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973fb817, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x9ee78381, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0231.487] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2524c44b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Devices.lnk", cAlternateFileName="")) returned 1
	[0231.487] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252988fc, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252988fc, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252988fc, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x0, dwReserved1=0x0, cFileName="File Explorer.lnk", cAlternateFileName="")) returned 1
	[0231.487] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252988fc, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252988fc, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252988fc, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x199, dwReserved0=0x0, dwReserved1=0x0, cFileName="Run.lnk", cAlternateFileName="")) returned 1
	[0231.487] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.488] FindClose (in: hFindFile=0x79fa68 | out: hFindFile=0x79fa68) returned 1
	[0231.488] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk"), fInfoLevelId=0x0, lpFileInformation=0x12431818 | out: lpFileInformation=0x12431818*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14f9d556, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x14f9d556, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x14f9d556, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x476)) returned 1
	[0231.490] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk"), fInfoLevelId=0x0, lpFileInformation=0x12431868 | out: lpFileInformation=0x12431868*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252726a6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252726a6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252726a6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x195)) returned 1
	[0231.490] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Default Apps.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\default apps.lnk"), fInfoLevelId=0x0, lpFileInformation=0x124318b8 | out: lpFileInformation=0x124318b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x32f)) returned 1
	[0231.490] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x12431908 | out: lpFileInformation=0x12431908*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x37ca39c, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973fb817, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x9ee78381, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3e0)) returned 1
	[0231.491] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Devices.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\devices.lnk"), fInfoLevelId=0x0, lpFileInformation=0x12431958 | out: lpFileInformation=0x12431958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2524c44b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x32d)) returned 1
	[0231.491] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk"), fInfoLevelId=0x0, lpFileInformation=0x124319a8 | out: lpFileInformation=0x124319a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252988fc, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252988fc, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252988fc, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x197)) returned 1
	[0231.492] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk"), fInfoLevelId=0x0, lpFileInformation=0x124319f8 | out: lpFileInformation=0x124319f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252988fc, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252988fc, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252988fc, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x199)) returned 1
	[0231.492] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk"), fInfoLevelId=0x0, lpFileInformation=0x12431a48 | out: lpFileInformation=0x12431a48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252726a6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252726a6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252726a6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x14f)) returned 1
	[0231.492] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell"), fInfoLevelId=0x0, lpFileInformation=0x12431a98 | out: lpFileInformation=0x12431a98*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf639e71, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.492] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.493] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\*", lpFindFileData=0x12423724 | out: lpFindFileData=0x12423724*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf639e71, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fa28
	[0231.495] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf639e71, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.495] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf639e71, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x9ee2becc, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x9ee2becc, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0231.495] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37ca39c, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973fb817, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x973fb817, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell (x86).lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1
	[0231.495] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f066aa8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f066aa8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f066aa8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell ISE (x86).lnk", cAlternateFileName="")) returned 1
	[0231.495] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f066aa8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f066aa8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f066aa8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell ISE.lnk", cAlternateFileName="")) returned 1
	[0231.495] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37f05f6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1
	[0231.495] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.495] FindClose (in: hFindFile=0x79fa28 | out: hFindFile=0x79fa28) returned 1
	[0231.496] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk"), fInfoLevelId=0x0, lpFileInformation=0x12431c78 | out: lpFileInformation=0x12431c78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37ca39c, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973fb817, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x973fb817, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8bc)) returned 1
	[0231.498] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk"), fInfoLevelId=0x0, lpFileInformation=0x12431cc8 | out: lpFileInformation=0x12431cc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f066aa8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f066aa8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f066aa8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4fa)) returned 1
	[0231.498] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk"), fInfoLevelId=0x0, lpFileInformation=0x12431d18 | out: lpFileInformation=0x12431d18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f066aa8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4f066aa8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4f066aa8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4fa)) returned 1
	[0231.498] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk"), fInfoLevelId=0x0, lpFileInformation=0x12431d68 | out: lpFileInformation=0x12431d68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37f05f6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8bc)) returned 1
	[0231.498] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x12431db8 | out: lpFileInformation=0x12431db8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf639e71, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x9ee2becc, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x9ee2becc, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xda)) returned 1
	[0231.499] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Templates" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\templates"), fInfoLevelId=0x0, lpFileInformation=0x12431e08 | out: lpFileInformation=0x12431e08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.499] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Templates" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\templates"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.499] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fb28
	[0231.499] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.499] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.500] FindClose (in: hFindFile=0x79fb28 | out: hFindFile=0x79fb28) returned 1
	[0231.500] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Application Data" (normalized: "c:\\users\\default\\application data"), fInfoLevelId=0x0, lpFileInformation=0x12431e58 | out: lpFileInformation=0x12431e58*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d54d8a8, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d54d8a8, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d54d8a8, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.500] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Cookies" (normalized: "c:\\users\\default\\cookies"), fInfoLevelId=0x0, lpFileInformation=0x12431ea8 | out: lpFileInformation=0x12431ea8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.500] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Desktop" (normalized: "c:\\users\\default\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x12431ef8 | out: lpFileInformation=0x12431ef8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.500] CreateFileW (lpFileName="C:\\Users\\Default\\Desktop" (normalized: "c:\\users\\default\\desktop"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.501] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Desktop\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fde8
	[0231.501] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.501] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.501] FindClose (in: hFindFile=0x79fde8 | out: hFindFile=0x79fde8) returned 1
	[0231.501] CreateFileW (lpFileName="C:\\Users\\Default\\Desktop\\README.html" (normalized: "c:\\users\\default\\desktop\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0231.502] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d94 | out: lpMode=0x12422d94) returned 0
	[0231.502] WriteFile (in: hFile=0x178, lpBuffer=0x12697600*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d84, lpOverlapped=0x0 | out: lpBuffer=0x12697600*, lpNumberOfBytesWritten=0x12422d84*=0xc85, lpOverlapped=0x0) returned 1
	[0231.503] CloseHandle (hObject=0x178) returned 1
	[0231.503] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123d1a40*, nNumberOfCharsToWrite=0x33, lpNumberOfCharsWritten=0x12422914, lpReserved=0x0 | out: lpBuffer=0x123d1a40*, lpNumberOfCharsWritten=0x12422914*=0x33) returned 1
	[0231.505] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Documents" (normalized: "c:\\users\\default\\documents"), fInfoLevelId=0x0, lpFileInformation=0x12431f48 | out: lpFileInformation=0x12431f48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d527734, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d527734, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.505] CreateFileW (lpFileName="C:\\Users\\Default\\Documents" (normalized: "c:\\users\\default\\documents"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.505] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d527734, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d527734, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fe28
	[0231.507] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d527734, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d527734, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.507] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d527734, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d527734, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d527734, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1
	[0231.507] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d527734, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d527734, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d527734, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1
	[0231.507] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d527734, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d527734, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d527734, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1
	[0231.507] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.507] FindClose (in: hFindFile=0x79fe28 | out: hFindFile=0x79fe28) returned 1
	[0231.508] CreateFileW (lpFileName="C:\\Users\\Default\\Documents\\README.html" (normalized: "c:\\users\\default\\documents\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0231.509] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d94 | out: lpMode=0x12422d94) returned 0
	[0231.509] WriteFile (in: hFile=0x178, lpBuffer=0x12698380*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d84, lpOverlapped=0x0 | out: lpBuffer=0x12698380*, lpNumberOfBytesWritten=0x12422d84*=0xc85, lpOverlapped=0x0) returned 1
	[0231.511] CloseHandle (hObject=0x178) returned 1
	[0231.511] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123d1ab0*, nNumberOfCharsToWrite=0x35, lpNumberOfCharsWritten=0x12422914, lpReserved=0x0 | out: lpBuffer=0x123d1ab0*, lpNumberOfCharsWritten=0x12422914*=0x35) returned 1
	[0231.512] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Documents\\My Music" (normalized: "c:\\users\\default\\documents\\my music"), fInfoLevelId=0x0, lpFileInformation=0x124a60a8 | out: lpFileInformation=0x124a60a8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d527734, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d527734, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d527734, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.512] CreateFileW (lpFileName="C:\\Users\\Default\\Documents\\My Music" (normalized: "c:\\users\\default\\documents\\my music"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.513] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Music\\*", lpFindFileData=0x1242293c | out: lpFindFileData=0x1242293c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0231.513] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12505800*, nNumberOfCharsToWrite=0x30, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x12505800*, lpNumberOfCharsWritten=0x124228a0*=0x30) returned 1
	[0231.514] GetProcAddress (hModule=0x75600000, lpProcName="DeleteFileW") returned 0x756268c0
	[0231.515] DeleteFileW (lpFileName="C:\\Users\\Default\\Documents\\My Music.locked" (normalized: "c:\\users\\default\\documents\\my music.locked")) returned 0
	[0231.515] GetProcAddress (hModule=0x75600000, lpProcName="RemoveDirectoryW") returned 0x75626bf0
	[0231.515] RemoveDirectoryW (lpPathName="C:\\Users\\Default\\Documents\\My Music.locked" (normalized: "c:\\users\\default\\documents\\my music.locked")) returned 0
	[0231.516] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Documents\\My Pictures" (normalized: "c:\\users\\default\\documents\\my pictures"), fInfoLevelId=0x0, lpFileInformation=0x124a60f8 | out: lpFileInformation=0x124a60f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d527734, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d527734, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d527734, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.516] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Documents\\My Videos" (normalized: "c:\\users\\default\\documents\\my videos"), fInfoLevelId=0x0, lpFileInformation=0x124a6148 | out: lpFileInformation=0x124a6148*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d527734, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d527734, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d527734, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.516] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Downloads" (normalized: "c:\\users\\default\\downloads"), fInfoLevelId=0x0, lpFileInformation=0x124a6198 | out: lpFileInformation=0x124a6198*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.516] CreateFileW (lpFileName="C:\\Users\\Default\\Downloads" (normalized: "c:\\users\\default\\downloads"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.516] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Downloads\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0028
	[0231.516] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.516] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.516] FindClose (in: hFindFile=0x7a0028 | out: hFindFile=0x7a0028) returned 1
	[0231.517] CreateFileW (lpFileName="C:\\Users\\Default\\Downloads\\README.html" (normalized: "c:\\users\\default\\downloads\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0231.517] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d94 | out: lpMode=0x12422d94) returned 0
	[0231.517] WriteFile (in: hFile=0x178, lpBuffer=0x12699100*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d84, lpOverlapped=0x0 | out: lpBuffer=0x12699100*, lpNumberOfBytesWritten=0x12422d84*=0xc85, lpOverlapped=0x0) returned 1
	[0231.518] CloseHandle (hObject=0x178) returned 1
	[0231.518] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123d1b20*, nNumberOfCharsToWrite=0x35, lpNumberOfCharsWritten=0x12422914, lpReserved=0x0 | out: lpBuffer=0x123d1b20*, lpNumberOfCharsWritten=0x12422914*=0x35) returned 1
	[0231.519] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Favorites" (normalized: "c:\\users\\default\\favorites"), fInfoLevelId=0x0, lpFileInformation=0x124a61e8 | out: lpFileInformation=0x124a61e8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.519] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites" (normalized: "c:\\users\\default\\favorites"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.520] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fde8
	[0231.520] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.520] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.520] FindClose (in: hFindFile=0x79fde8 | out: hFindFile=0x79fde8) returned 1
	[0231.520] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\README.html" (normalized: "c:\\users\\default\\favorites\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0231.521] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d94 | out: lpMode=0x12422d94) returned 0
	[0231.521] WriteFile (in: hFile=0x178, lpBuffer=0x125ce000*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d84, lpOverlapped=0x0 | out: lpBuffer=0x125ce000*, lpNumberOfBytesWritten=0x12422d84*=0xc85, lpOverlapped=0x0) returned 1
	[0231.524] CloseHandle (hObject=0x178) returned 1
	[0231.524] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123d1b90*, nNumberOfCharsToWrite=0x35, lpNumberOfCharsWritten=0x12422914, lpReserved=0x0 | out: lpBuffer=0x123d1b90*, lpNumberOfCharsWritten=0x12422914*=0x35) returned 1
	[0231.525] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Links" (normalized: "c:\\users\\default\\links"), fInfoLevelId=0x0, lpFileInformation=0x124a6238 | out: lpFileInformation=0x124a6238*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.527] CreateFileW (lpFileName="C:\\Users\\Default\\Links" (normalized: "c:\\users\\default\\links"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.527] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Links\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fd68
	[0231.527] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.527] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.527] FindClose (in: hFindFile=0x79fd68 | out: hFindFile=0x79fd68) returned 1
	[0231.527] CreateFileW (lpFileName="C:\\Users\\Default\\Links\\README.html" (normalized: "c:\\users\\default\\links\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0231.528] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d94 | out: lpMode=0x12422d94) returned 0
	[0231.528] WriteFile (in: hFile=0x178, lpBuffer=0x125ced80*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d84, lpOverlapped=0x0 | out: lpBuffer=0x125ced80*, lpNumberOfBytesWritten=0x12422d84*=0xc85, lpOverlapped=0x0) returned 1
	[0231.529] CloseHandle (hObject=0x178) returned 1
	[0231.529] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123d1c00*, nNumberOfCharsToWrite=0x31, lpNumberOfCharsWritten=0x12422914, lpReserved=0x0 | out: lpBuffer=0x123d1c00*, lpNumberOfCharsWritten=0x12422914*=0x31) returned 1
	[0231.530] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Local Settings" (normalized: "c:\\users\\default\\local settings"), fInfoLevelId=0x0, lpFileInformation=0x124a6288 | out: lpFileInformation=0x124a6288*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.531] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Music" (normalized: "c:\\users\\default\\music"), fInfoLevelId=0x0, lpFileInformation=0x124a62d8 | out: lpFileInformation=0x124a62d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.531] CreateFileW (lpFileName="C:\\Users\\Default\\Music" (normalized: "c:\\users\\default\\music"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.531] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Music\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0028
	[0231.531] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.531] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.531] FindClose (in: hFindFile=0x7a0028 | out: hFindFile=0x7a0028) returned 1
	[0231.531] CreateFileW (lpFileName="C:\\Users\\Default\\Music\\README.html" (normalized: "c:\\users\\default\\music\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0231.532] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d94 | out: lpMode=0x12422d94) returned 0
	[0231.532] WriteFile (in: hFile=0x178, lpBuffer=0x125cfb00*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d84, lpOverlapped=0x0 | out: lpBuffer=0x125cfb00*, lpNumberOfBytesWritten=0x12422d84*=0xc85, lpOverlapped=0x0) returned 1
	[0231.533] CloseHandle (hObject=0x178) returned 1
	[0231.533] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123d1c70*, nNumberOfCharsToWrite=0x31, lpNumberOfCharsWritten=0x12422914, lpReserved=0x0 | out: lpBuffer=0x123d1c70*, lpNumberOfCharsWritten=0x12422914*=0x31) returned 1
	[0231.535] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\My Documents" (normalized: "c:\\users\\default\\my documents"), fInfoLevelId=0x0, lpFileInformation=0x124a6328 | out: lpFileInformation=0x124a6328*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d527734, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d527734, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d527734, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.550] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT" (normalized: "c:\\users\\default\\ntuser.dat"), fInfoLevelId=0x0, lpFileInformation=0x124a6378 | out: lpFileInformation=0x124a6378*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x31bfa5a5, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xea64ab63, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xea64ab63, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x40000)) returned 1
	[0231.550] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG1" (normalized: "c:\\users\\default\\ntuser.dat.log1"), fInfoLevelId=0x0, lpFileInformation=0x124a63c8 | out: lpFileInformation=0x124a63c8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x31cb9166, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x31cb9166, ftLastAccessTime.dwHighDateTime=0x1d112dc, ftLastWriteTime.dwLowDateTime=0x31cb9166, ftLastWriteTime.dwHighDateTime=0x1d112dc, nFileSizeHigh=0x0, nFileSizeLow=0x9000)) returned 1
	[0231.550] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG2" (normalized: "c:\\users\\default\\ntuser.dat.log2"), fInfoLevelId=0x0, lpFileInformation=0x124a6418 | out: lpFileInformation=0x124a6418*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x31cb9166, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x31cb9166, ftLastAccessTime.dwHighDateTime=0x1d112dc, ftLastWriteTime.dwLowDateTime=0x31cb9166, ftLastWriteTime.dwHighDateTime=0x1d112dc, nFileSizeHigh=0x0, nFileSizeLow=0x5000)) returned 1
	[0231.550] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT{62e13464-7ee5-11e5-80c4-a4badb40df56}.TM.blf" (normalized: "c:\\users\\default\\ntuser.dat{62e13464-7ee5-11e5-80c4-a4badb40df56}.tm.blf"), fInfoLevelId=0x0, lpFileInformation=0x124a6468 | out: lpFileInformation=0x124a6468*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8d5f4e96, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x8d5f4e96, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x8d61ae52, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1
	[0231.554] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT{62e13464-7ee5-11e5-80c4-a4badb40df56}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{62e13464-7ee5-11e5-80c4-a4badb40df56}.tmcontainer00000000000000000001.regtrans-ms"), fInfoLevelId=0x0, lpFileInformation=0x124a64b8 | out: lpFileInformation=0x124a64b8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8d5f4e96, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x8d5f4e96, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x8d61ae52, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x80000)) returned 1
	[0231.554] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT{62e13464-7ee5-11e5-80c4-a4badb40df56}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{62e13464-7ee5-11e5-80c4-a4badb40df56}.tmcontainer00000000000000000002.regtrans-ms"), fInfoLevelId=0x0, lpFileInformation=0x124a6508 | out: lpFileInformation=0x124a6508*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8d61ae52, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x8d61ae52, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x8d61ae52, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x80000)) returned 1
	[0231.554] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\NetHood" (normalized: "c:\\users\\default\\nethood"), fInfoLevelId=0x0, lpFileInformation=0x124a6558 | out: lpFileInformation=0x124a6558*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.554] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Pictures" (normalized: "c:\\users\\default\\pictures"), fInfoLevelId=0x0, lpFileInformation=0x124a65a8 | out: lpFileInformation=0x124a65a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.555] CreateFileW (lpFileName="C:\\Users\\Default\\Pictures" (normalized: "c:\\users\\default\\pictures"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.555] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Pictures\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0028
	[0231.555] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.555] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.555] FindClose (in: hFindFile=0x7a0028 | out: hFindFile=0x7a0028) returned 1
	[0231.555] CreateFileW (lpFileName="C:\\Users\\Default\\Pictures\\README.html" (normalized: "c:\\users\\default\\pictures\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0231.556] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d94 | out: lpMode=0x12422d94) returned 0
	[0231.556] WriteFile (in: hFile=0x178, lpBuffer=0x125d0880*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d84, lpOverlapped=0x0 | out: lpBuffer=0x125d0880*, lpNumberOfBytesWritten=0x12422d84*=0xc85, lpOverlapped=0x0) returned 1
	[0231.558] CloseHandle (hObject=0x178) returned 1
	[0231.558] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12429ea0*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x12422914, lpReserved=0x0 | out: lpBuffer=0x12429ea0*, lpNumberOfCharsWritten=0x12422914*=0x34) returned 1
	[0231.572] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\PrintHood" (normalized: "c:\\users\\default\\printhood"), fInfoLevelId=0x0, lpFileInformation=0x124a65f8 | out: lpFileInformation=0x124a65f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.572] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Recent" (normalized: "c:\\users\\default\\recent"), fInfoLevelId=0x0, lpFileInformation=0x124a6648 | out: lpFileInformation=0x124a6648*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.572] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Saved Games" (normalized: "c:\\users\\default\\saved games"), fInfoLevelId=0x0, lpFileInformation=0x124a6698 | out: lpFileInformation=0x124a6698*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.573] CreateFileW (lpFileName="C:\\Users\\Default\\Saved Games" (normalized: "c:\\users\\default\\saved games"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.573] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Saved Games\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0028
	[0231.573] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.573] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.573] FindClose (in: hFindFile=0x7a0028 | out: hFindFile=0x7a0028) returned 1
	[0231.573] CreateFileW (lpFileName="C:\\Users\\Default\\Saved Games\\README.html" (normalized: "c:\\users\\default\\saved games\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0231.574] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d94 | out: lpMode=0x12422d94) returned 0
	[0231.574] WriteFile (in: hFile=0x178, lpBuffer=0x125d1600*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d84, lpOverlapped=0x0 | out: lpBuffer=0x125d1600*, lpNumberOfBytesWritten=0x12422d84*=0xc85, lpOverlapped=0x0) returned 1
	[0231.575] CloseHandle (hObject=0x178) returned 1
	[0231.575] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12429f10*, nNumberOfCharsToWrite=0x37, lpNumberOfCharsWritten=0x12422914, lpReserved=0x0 | out: lpBuffer=0x12429f10*, lpNumberOfCharsWritten=0x12422914*=0x37) returned 1
	[0231.604] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\SendTo" (normalized: "c:\\users\\default\\sendto"), fInfoLevelId=0x0, lpFileInformation=0x124a66e8 | out: lpFileInformation=0x124a66e8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.604] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Start Menu" (normalized: "c:\\users\\default\\start menu"), fInfoLevelId=0x0, lpFileInformation=0x124a6738 | out: lpFileInformation=0x124a6738*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.605] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Templates" (normalized: "c:\\users\\default\\templates"), fInfoLevelId=0x0, lpFileInformation=0x124a6788 | out: lpFileInformation=0x124a6788*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.605] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Videos" (normalized: "c:\\users\\default\\videos"), fInfoLevelId=0x0, lpFileInformation=0x124a67d8 | out: lpFileInformation=0x124a67d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.605] CreateFileW (lpFileName="C:\\Users\\Default\\Videos" (normalized: "c:\\users\\default\\videos"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.605] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Videos\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fba8
	[0231.605] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.605] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.605] FindClose (in: hFindFile=0x79fba8 | out: hFindFile=0x79fba8) returned 1
	[0231.606] CreateFileW (lpFileName="C:\\Users\\Default\\Videos\\README.html" (normalized: "c:\\users\\default\\videos\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0231.606] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d94 | out: lpMode=0x12422d94) returned 0
	[0231.606] WriteFile (in: hFile=0x178, lpBuffer=0x125d2380*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d84, lpOverlapped=0x0 | out: lpBuffer=0x125d2380*, lpNumberOfBytesWritten=0x12422d84*=0xc85, lpOverlapped=0x0) returned 1
	[0231.607] CloseHandle (hObject=0x178) returned 1
	[0231.608] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12429f80*, nNumberOfCharsToWrite=0x32, lpNumberOfCharsWritten=0x12422914, lpReserved=0x0 | out: lpBuffer=0x12429f80*, lpNumberOfCharsWritten=0x12422914*=0x32) returned 1
	[0231.621] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default User" (normalized: "c:\\users\\default user"), fInfoLevelId=0x0, lpFileInformation=0x124a6828 | out: lpFileInformation=0x124a6828*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x4f6643a1, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0x4f6643a1, ftLastAccessTime.dwHighDateTime=0x1d112ea, ftLastWriteTime.dwLowDateTime=0x4f6643a1, ftLastWriteTime.dwHighDateTime=0x1d112ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.622] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public" (normalized: "c:\\users\\public"), fInfoLevelId=0x0, lpFileInformation=0x124a6878 | out: lpFileInformation=0x124a6878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0231.622] CreateFileW (lpFileName="C:\\Users\\Public" (normalized: "c:\\users\\public"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.622] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fb28
	[0231.622] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.622] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x436238c4, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccountPictures", cAlternateFileName="ACCOUN~1")) returned 1
	[0231.622] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37f05f6, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37f05f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1
	[0231.622] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x37f05f6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0231.622] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d5bfea2, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d5bfea2, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1
	[0231.622] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1
	[0231.622] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1
	[0231.623] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1
	[0231.623] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1
	[0231.623] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1
	[0231.623] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.623] FindClose (in: hFindFile=0x79fb28 | out: hFindFile=0x79fb28) returned 1
	[0231.623] CreateFileW (lpFileName="C:\\Users\\Public\\README.html" (normalized: "c:\\users\\public\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0231.623] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422df8 | out: lpMode=0x12422df8) returned 0
	[0231.623] WriteFile (in: hFile=0x178, lpBuffer=0x125d3100*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422de8, lpOverlapped=0x0 | out: lpBuffer=0x125d3100*, lpNumberOfBytesWritten=0x12422de8*=0xc85, lpOverlapped=0x0) returned 1
	[0231.624] CloseHandle (hObject=0x178) returned 1
	[0231.624] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12505920*, nNumberOfCharsToWrite=0x2a, lpNumberOfCharsWritten=0x12422978, lpReserved=0x0 | out: lpBuffer=0x12505920*, lpNumberOfCharsWritten=0x12422978*=0x2a) returned 1
	[0231.637] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\AccountPictures" (normalized: "c:\\users\\public\\accountpictures"), fInfoLevelId=0x0, lpFileInformation=0x124a6be8 | out: lpFileInformation=0x124a6be8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x436238c4, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.637] CreateFileW (lpFileName="C:\\Users\\Public\\AccountPictures" (normalized: "c:\\users\\public\\accountpictures"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.637] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\AccountPictures\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x436238c4, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffe8
	[0231.638] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x436238c4, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.638] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x436238c4, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0231.638] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.638] FindClose (in: hFindFile=0x79ffe8 | out: hFindFile=0x79ffe8) returned 1
	[0231.638] CreateFileW (lpFileName="C:\\Users\\Public\\AccountPictures\\README.html" (normalized: "c:\\users\\public\\accountpictures\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0231.638] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d94 | out: lpMode=0x12422d94) returned 0
	[0231.638] WriteFile (in: hFile=0x178, lpBuffer=0x12536000*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d84, lpOverlapped=0x0 | out: lpBuffer=0x12536000*, lpNumberOfBytesWritten=0x12422d84*=0xc85, lpOverlapped=0x0) returned 1
	[0231.639] CloseHandle (hObject=0x178) returned 1
	[0231.640] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123fd500*, nNumberOfCharsToWrite=0x3a, lpNumberOfCharsWritten=0x12422914, lpReserved=0x0 | out: lpBuffer=0x123fd500*, lpNumberOfCharsWritten=0x12422914*=0x3a) returned 1
	[0231.652] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\AccountPictures\\desktop.ini" (normalized: "c:\\users\\public\\accountpictures\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x124a6c88 | out: lpFileInformation=0x124a6c88*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x436238c4, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0xc4)) returned 1
	[0231.653] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Desktop" (normalized: "c:\\users\\public\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x124a6cd8 | out: lpFileInformation=0x124a6cd8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37f05f6, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37f05f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.653] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop" (normalized: "c:\\users\\public\\desktop"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.653] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37f05f6, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37f05f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fc68
	[0231.653] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37f05f6, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37f05f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.653] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x37f05f6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0231.653] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.653] FindClose (in: hFindFile=0x79fc68 | out: hFindFile=0x79fc68) returned 1
	[0231.653] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\README.html" (normalized: "c:\\users\\public\\desktop\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0231.656] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d94 | out: lpMode=0x12422d94) returned 0
	[0231.656] WriteFile (in: hFile=0x178, lpBuffer=0x12536d80*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d84, lpOverlapped=0x0 | out: lpBuffer=0x12536d80*, lpNumberOfBytesWritten=0x12422d84*=0xc85, lpOverlapped=0x0) returned 1
	[0231.661] CloseHandle (hObject=0x178) returned 1
	[0231.662] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1253c000*, nNumberOfCharsToWrite=0x32, lpNumberOfCharsWritten=0x12422914, lpReserved=0x0 | out: lpBuffer=0x1253c000*, lpNumberOfCharsWritten=0x12422914*=0x32) returned 1
	[0231.682] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Desktop\\desktop.ini" (normalized: "c:\\users\\public\\desktop\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x124a6d78 | out: lpFileInformation=0x124a6d78*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x37f05f6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xae)) returned 1
	[0231.682] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Documents" (normalized: "c:\\users\\public\\documents"), fInfoLevelId=0x0, lpFileInformation=0x124a6dc8 | out: lpFileInformation=0x124a6dc8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d5bfea2, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d5bfea2, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.682] CreateFileW (lpFileName="C:\\Users\\Public\\Documents" (normalized: "c:\\users\\public\\documents"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.682] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d5bfea2, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d5bfea2, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ff28
	[0231.686] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d5bfea2, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d5bfea2, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.686] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x37f05f6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0231.686] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1
	[0231.686] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1
	[0231.686] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d5bfea2, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d5bfea2, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d5bfea2, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1
	[0231.686] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.686] FindClose (in: hFindFile=0x79ff28 | out: hFindFile=0x79ff28) returned 1
	[0231.687] CreateFileW (lpFileName="C:\\Users\\Public\\Documents\\README.html" (normalized: "c:\\users\\public\\documents\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0231.688] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d94 | out: lpMode=0x12422d94) returned 0
	[0231.688] WriteFile (in: hFile=0x178, lpBuffer=0x12537b00*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d84, lpOverlapped=0x0 | out: lpBuffer=0x12537b00*, lpNumberOfBytesWritten=0x12422d84*=0xc85, lpOverlapped=0x0) returned 1
	[0231.692] CloseHandle (hObject=0x178) returned 1
	[0231.693] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1253c070*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x12422914, lpReserved=0x0 | out: lpBuffer=0x1253c070*, lpNumberOfCharsWritten=0x12422914*=0x34) returned 1
	[0231.702] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music" (normalized: "c:\\users\\public\\documents\\my music"), fInfoLevelId=0x0, lpFileInformation=0x124a6fa8 | out: lpFileInformation=0x124a6fa8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.702] CreateFileW (lpFileName="C:\\Users\\Public\\Documents\\My Music" (normalized: "c:\\users\\public\\documents\\my music"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.703] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music\\*", lpFindFileData=0x1242293c | out: lpFindFileData=0x1242293c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0231.703] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12505a40*, nNumberOfCharsToWrite=0x2f, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x12505a40*, lpNumberOfCharsWritten=0x124228a0*=0x2f) returned 1
	[0231.717] DeleteFileW (lpFileName="C:\\Users\\Public\\Documents\\My Music.locked" (normalized: "c:\\users\\public\\documents\\my music.locked")) returned 0
	[0231.717] RemoveDirectoryW (lpPathName="C:\\Users\\Public\\Documents\\My Music.locked" (normalized: "c:\\users\\public\\documents\\my music.locked")) returned 0
	[0231.717] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures" (normalized: "c:\\users\\public\\documents\\my pictures"), fInfoLevelId=0x0, lpFileInformation=0x124a6ff8 | out: lpFileInformation=0x124a6ff8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.717] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos" (normalized: "c:\\users\\public\\documents\\my videos"), fInfoLevelId=0x0, lpFileInformation=0x124a7048 | out: lpFileInformation=0x124a7048*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d5bfea2, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d5bfea2, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d5bfea2, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.718] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Documents\\desktop.ini" (normalized: "c:\\users\\public\\documents\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x124a7098 | out: lpFileInformation=0x124a7098*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x37f05f6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x116)) returned 1
	[0231.718] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Downloads" (normalized: "c:\\users\\public\\downloads"), fInfoLevelId=0x0, lpFileInformation=0x124a70e8 | out: lpFileInformation=0x124a70e8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.718] CreateFileW (lpFileName="C:\\Users\\Public\\Downloads" (normalized: "c:\\users\\public\\downloads"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.718] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Downloads\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0068
	[0231.718] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.718] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0231.718] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.719] FindClose (in: hFindFile=0x7a0068 | out: hFindFile=0x7a0068) returned 1
	[0231.719] CreateFileW (lpFileName="C:\\Users\\Public\\Downloads\\README.html" (normalized: "c:\\users\\public\\downloads\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0231.719] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d94 | out: lpMode=0x12422d94) returned 0
	[0231.719] WriteFile (in: hFile=0x178, lpBuffer=0x12538880*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d84, lpOverlapped=0x0 | out: lpBuffer=0x12538880*, lpNumberOfBytesWritten=0x12422d84*=0xc85, lpOverlapped=0x0) returned 1
	[0231.720] CloseHandle (hObject=0x178) returned 1
	[0231.720] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1253c0e0*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x12422914, lpReserved=0x0 | out: lpBuffer=0x1253c0e0*, lpNumberOfCharsWritten=0x12422914*=0x34) returned 1
	[0231.733] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Downloads\\desktop.ini" (normalized: "c:\\users\\public\\downloads\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x124a7188 | out: lpFileInformation=0x124a7188*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xae)) returned 1
	[0231.734] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Libraries" (normalized: "c:\\users\\public\\libraries"), fInfoLevelId=0x0, lpFileInformation=0x124a71d8 | out: lpFileInformation=0x124a71d8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.735] CreateFileW (lpFileName="C:\\Users\\Public\\Libraries" (normalized: "c:\\users\\public\\libraries"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.735] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Libraries\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fea8
	[0231.735] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.735] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0231.735] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecordedTV.library-ms", cAlternateFileName="RECORD~1.LIB")) returned 1
	[0231.735] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.735] FindClose (in: hFindFile=0x79fea8 | out: hFindFile=0x79fea8) returned 1
	[0231.735] CreateFileW (lpFileName="C:\\Users\\Public\\Libraries\\README.html" (normalized: "c:\\users\\public\\libraries\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0231.736] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d94 | out: lpMode=0x12422d94) returned 0
	[0231.736] WriteFile (in: hFile=0x178, lpBuffer=0x12539600*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d84, lpOverlapped=0x0 | out: lpBuffer=0x12539600*, lpNumberOfBytesWritten=0x12422d84*=0xc85, lpOverlapped=0x0) returned 1
	[0231.737] CloseHandle (hObject=0x178) returned 1
	[0231.737] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1253c150*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x12422914, lpReserved=0x0 | out: lpBuffer=0x1253c150*, lpNumberOfCharsWritten=0x12422914*=0x34) returned 1
	[0231.753] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms"), fInfoLevelId=0x0, lpFileInformation=0x124a72c8 | out: lpFileInformation=0x124a72c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3e7)) returned 1
	[0231.758] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Libraries\\desktop.ini" (normalized: "c:\\users\\public\\libraries\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x124a7318 | out: lpFileInformation=0x124a7318*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaf)) returned 1
	[0231.758] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Music" (normalized: "c:\\users\\public\\music"), fInfoLevelId=0x0, lpFileInformation=0x124a7368 | out: lpFileInformation=0x124a7368*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.758] CreateFileW (lpFileName="C:\\Users\\Public\\Music" (normalized: "c:\\users\\public\\music"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.758] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fae8
	[0231.758] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.759] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0231.759] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.759] FindClose (in: hFindFile=0x79fae8 | out: hFindFile=0x79fae8) returned 1
	[0231.759] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\README.html" (normalized: "c:\\users\\public\\music\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0231.759] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d94 | out: lpMode=0x12422d94) returned 0
	[0231.759] WriteFile (in: hFile=0x178, lpBuffer=0x1253a380*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d84, lpOverlapped=0x0 | out: lpBuffer=0x1253a380*, lpNumberOfBytesWritten=0x12422d84*=0xc85, lpOverlapped=0x0) returned 1
	[0231.760] CloseHandle (hObject=0x178) returned 1
	[0231.761] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12505bc0*, nNumberOfCharsToWrite=0x30, lpNumberOfCharsWritten=0x12422914, lpReserved=0x0 | out: lpBuffer=0x12505bc0*, lpNumberOfCharsWritten=0x12422914*=0x30) returned 1
	[0231.770] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Music\\desktop.ini" (normalized: "c:\\users\\public\\music\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x124a7408 | out: lpFileInformation=0x124a7408*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x17c)) returned 1
	[0231.770] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Pictures" (normalized: "c:\\users\\public\\pictures"), fInfoLevelId=0x0, lpFileInformation=0x124a7458 | out: lpFileInformation=0x124a7458*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.770] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures" (normalized: "c:\\users\\public\\pictures"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.770] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79faa8
	[0231.770] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.770] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0231.770] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.770] FindClose (in: hFindFile=0x79faa8 | out: hFindFile=0x79faa8) returned 1
	[0231.770] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\README.html" (normalized: "c:\\users\\public\\pictures\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0231.773] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d94 | out: lpMode=0x12422d94) returned 0
	[0231.774] WriteFile (in: hFile=0x178, lpBuffer=0x1253b100*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d84, lpOverlapped=0x0 | out: lpBuffer=0x1253b100*, lpNumberOfBytesWritten=0x12422d84*=0xc85, lpOverlapped=0x0) returned 1
	[0231.775] CloseHandle (hObject=0x178) returned 1
	[0231.775] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1253c1c0*, nNumberOfCharsToWrite=0x33, lpNumberOfCharsWritten=0x12422914, lpReserved=0x0 | out: lpBuffer=0x1253c1c0*, lpNumberOfCharsWritten=0x12422914*=0x33) returned 1
	[0231.784] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Pictures\\desktop.ini" (normalized: "c:\\users\\public\\pictures\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x124a74f8 | out: lpFileInformation=0x124a74f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x17c)) returned 1
	[0231.786] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Videos" (normalized: "c:\\users\\public\\videos"), fInfoLevelId=0x0, lpFileInformation=0x124a7548 | out: lpFileInformation=0x124a7548*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.786] CreateFileW (lpFileName="C:\\Users\\Public\\Videos" (normalized: "c:\\users\\public\\videos"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.786] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0068
	[0231.786] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.786] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0231.786] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.786] FindClose (in: hFindFile=0x7a0068 | out: hFindFile=0x7a0068) returned 1
	[0231.786] CreateFileW (lpFileName="C:\\Users\\Public\\Videos\\README.html" (normalized: "c:\\users\\public\\videos\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0231.794] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d94 | out: lpMode=0x12422d94) returned 0
	[0231.794] WriteFile (in: hFile=0x178, lpBuffer=0x1250c000*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d84, lpOverlapped=0x0 | out: lpBuffer=0x1250c000*, lpNumberOfBytesWritten=0x12422d84*=0xc85, lpOverlapped=0x0) returned 1
	[0231.795] CloseHandle (hObject=0x178) returned 1
	[0231.796] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1253c230*, nNumberOfCharsToWrite=0x31, lpNumberOfCharsWritten=0x12422914, lpReserved=0x0 | out: lpBuffer=0x1253c230*, lpNumberOfCharsWritten=0x12422914*=0x31) returned 1
	[0231.809] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Videos\\desktop.ini" (normalized: "c:\\users\\public\\videos\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x124a75e8 | out: lpFileInformation=0x124a75e8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x17c)) returned 1
	[0231.810] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\desktop.ini" (normalized: "c:\\users\\public\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x124a7638 | out: lpFileInformation=0x124a7638*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x37f05f6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xae)) returned 1
	[0231.810] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX" (normalized: "c:\\users\\rdhj0cnfevzx"), fInfoLevelId=0x0, lpFileInformation=0x124a7688 | out: lpFileInformation=0x124a7688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xeb7c536d, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xeb7c536d, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0231.810] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX" (normalized: "c:\\users\\rdhj0cnfevzx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.810] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xeb7c536d, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xeb7c536d, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f928
	[0231.810] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xeb7c536d, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xeb7c536d, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.811] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1
	[0231.811] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0231.811] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435fd682, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1
	[0231.811] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1
	[0231.811] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1
	[0231.811] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf61622b2, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf61622b2, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1
	[0231.811] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1
	[0231.811] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1
	[0231.811] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437c7194, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437ed538, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1
	[0231.811] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1
	[0231.811] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf48bc745, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf48bc745, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1
	[0231.811] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d374e80, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d374e80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d374e80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1
	[0231.811] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1
	[0231.811] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x3ce3dbd0, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6b125138, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0x6b125138, ftLastWriteTime.dwHighDateTime=0x1d82a22, nFileSizeHigh=0x0, nFileSizeLow=0x180000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1
	[0231.811] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3d2dc444, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d2dc444, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d2dc444, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1
	[0231.811] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3d2dc444, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d2dc444, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d2dc444, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x8f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1
	[0231.811] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3d2dc444, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d2dc444, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x63434853, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{62e13464-7ee5-11e5-80c4-a4badb40df56}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1
	[0231.811] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3d3026e1, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d3026e1, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6340e659, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{62e13464-7ee5-11e5-80c4-a4badb40df56}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1
	[0231.811] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3d3026e1, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d3026e1, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6340e659, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{62e13464-7ee5-11e5-80c4-a4badb40df56}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1
	[0231.811] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1
	[0231.811] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x84ac775d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x84aeda3c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84aeda3c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive", cAlternateFileName="")) returned 1
	[0231.811] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf4af2a94, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf4af2a94, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1
	[0231.811] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1
	[0231.811] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1
	[0231.812] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43754b80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43754b80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1
	[0231.812] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43695fb2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437a1142, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437a1142, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1
	[0231.812] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1
	[0231.812] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1
	[0231.812] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1
	[0231.812] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf4be58e0, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf4be58e0, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1
	[0231.812] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7c536d, ftCreationTime.dwHighDateTime=0x1d83aa1, ftLastAccessTime.dwLowDateTime=0xeb7c536d, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xeb97077e, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x6ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="windows", cAlternateFileName="")) returned 1
	[0231.812] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.812] FindClose (in: hFindFile=0x79f928 | out: hFindFile=0x79f928) returned 1
	[0231.812] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0231.812] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422df8 | out: lpMode=0x12422df8) returned 0
	[0231.812] WriteFile (in: hFile=0x178, lpBuffer=0x1250cd80*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422de8, lpOverlapped=0x0 | out: lpBuffer=0x1250cd80*, lpNumberOfBytesWritten=0x12422de8*=0xc85, lpOverlapped=0x0) returned 1
	[0231.813] CloseHandle (hObject=0x178) returned 1
	[0231.814] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12505ce0*, nNumberOfCharsToWrite=0x30, lpNumberOfCharsWritten=0x12422978, lpReserved=0x0 | out: lpBuffer=0x12505ce0*, lpNumberOfCharsWritten=0x12422978*=0x30) returned 1
	[0231.827] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata"), fInfoLevelId=0x0, lpFileInformation=0x124d40a8 | out: lpFileInformation=0x124d40a8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.827] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.828] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0068
	[0231.828] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.828] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4252734, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x4252734, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1
	[0231.828] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4f14c05a, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x4f14c05a, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalLow", cAlternateFileName="")) returned 1
	[0231.828] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf6684dfe, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf6684dfe, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1
	[0231.828] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.828] FindClose (in: hFindFile=0x7a0068 | out: hFindFile=0x7a0068) returned 1
	[0231.828] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local"), fInfoLevelId=0x0, lpFileInformation=0x124d41e8 | out: lpFileInformation=0x124d41e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4252734, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x4252734, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0231.828] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.828] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4252734, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x4252734, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fda8
	[0231.828] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4252734, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x4252734, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.828] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c3f133, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x7c3f133, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x7c3f133, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveSync", cAlternateFileName="ACTIVE~1")) returned 1
	[0231.829] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0231.829] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x2397496d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x241f3052, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Comms", cAlternateFileName="")) returned 1
	[0231.829] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1
	[0231.829] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xb1dfb94f, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0xb1dfb94f, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x69d588a7, ftLastWriteTime.dwHighDateTime=0x1d82a22, nFileSizeHigh=0x0, nFileSizeLow=0x5c6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 1
	[0231.829] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3a17d745, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a17d745, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0231.829] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4252734, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x4252734, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x4252734, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftEdge", cAlternateFileName="MICROS~2")) returned 1
	[0231.829] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x217bac55, ftLastAccessTime.dwHighDateTime=0x1d70503, ftLastWriteTime.dwLowDateTime=0x217bac55, ftLastWriteTime.dwHighDateTime=0x1d70503, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 1
	[0231.829] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73f4dcd0, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73f4dcd0, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73f4dcd0, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PeerDistRepub", cAlternateFileName="PEERDI~1")) returned 1
	[0231.829] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc699b5c, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xdc699b5c, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xdc699b5c, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publishers", cAlternateFileName="PUBLIS~1")) returned 1
	[0231.829] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xd6e4cf3e, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xd6e4cf3e, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0231.829] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1
	[0231.829] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40a64b1d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40a64b1d, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40a64b1d, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TileDataLayer", cAlternateFileName="TILEDA~1")) returned 1
	[0231.829] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5599aefd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5599aefd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5599aefd, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 1
	[0231.829] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.829] FindClose (in: hFindFile=0x79fda8 | out: hFindFile=0x79fda8) returned 1
	[0231.829] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\activesync"), fInfoLevelId=0x0, lpFileInformation=0x124d4698 | out: lpFileInformation=0x124d4698*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c3f133, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x7c3f133, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x7c3f133, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.829] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\activesync"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.830] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c3f133, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x7c3f133, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x7c3f133, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79faa8
	[0231.830] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c3f133, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x7c3f133, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x7c3f133, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.834] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.834] FindClose (in: hFindFile=0x79faa8 | out: hFindFile=0x79faa8) returned 1
	[0231.834] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Application Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\application data"), fInfoLevelId=0x0, lpFileInformation=0x124d46e8 | out: lpFileInformation=0x124d46e8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.838] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comms"), fInfoLevelId=0x0, lpFileInformation=0x124d4738 | out: lpFileInformation=0x124d4738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x241f3052, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x241f3052, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.838] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.838] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x2397496d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x241f3052, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fde8
	[0231.838] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x2397496d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x241f3052, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.838] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x241f3052, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x3bbf8cb3, ftLastAccessTime.dwHighDateTime=0x1d7e768, ftLastWriteTime.dwLowDateTime=0x3bbf8cb3, ftLastWriteTime.dwHighDateTime=0x1d7e768, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0231.838] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c4973c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x23c4973c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23c4973c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Unistore", cAlternateFileName="")) returned 1
	[0231.838] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0xc44b2fe5, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xc44b2fe5, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnistoreDB", cAlternateFileName="UNISTO~1")) returned 1
	[0231.838] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.839] FindClose (in: hFindFile=0x79fde8 | out: hFindFile=0x79fde8) returned 1
	[0231.839] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Temp" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comms\\temp"), fInfoLevelId=0x0, lpFileInformation=0x124d4878 | out: lpFileInformation=0x124d4878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x241f3052, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0xeb3536b0, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xeb3536b0, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.839] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Temp" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comms\\temp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.839] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Temp\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x241f3052, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0xeb3536b0, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xeb3536b0, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fd28
	[0231.839] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x241f3052, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0xeb3536b0, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xeb3536b0, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.839] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b315521, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0xeb3536b0, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xeb3536b0, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x0, dwReserved1=0x0, cFileName="CalendarCache.dat", cAlternateFileName="CALEND~1.DAT")) returned 1
	[0231.839] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.839] FindClose (in: hFindFile=0x79fd28 | out: hFindFile=0x79fd28) returned 1
	[0231.839] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Temp\\CalendarCache.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comms\\temp\\calendarcache.dat"), fInfoLevelId=0x0, lpFileInformation=0x124d4918 | out: lpFileInformation=0x124d4918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b315521, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0xeb3536b0, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xeb3536b0, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x14)) returned 1
	[0231.840] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Unistore" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comms\\unistore"), fInfoLevelId=0x0, lpFileInformation=0x124d4968 | out: lpFileInformation=0x124d4968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c4973c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x23c4973c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23c4973c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.840] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Unistore" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comms\\unistore"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.840] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Unistore\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c4973c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x23c4973c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23c4973c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fa28
	[0231.840] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c4973c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x23c4973c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23c4973c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.840] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.840] FindClose (in: hFindFile=0x79fa28 | out: hFindFile=0x79fa28) returned 1
	[0231.840] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\UnistoreDB" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comms\\unistoredb"), fInfoLevelId=0x0, lpFileInformation=0x124d49b8 | out: lpFileInformation=0x124d49b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0xc44b2fe5, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xc44b2fe5, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0231.840] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\UnistoreDB" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comms\\unistoredb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.841] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\UnistoreDB\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0xc44b2fe5, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xc44b2fe5, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fee8
	[0231.841] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0xc44b2fe5, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xc44b2fe5, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.841] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x23a0d188, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x23a0d188, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0xc449e3a7, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x600000, dwReserved0=0x0, dwReserved1=0x0, cFileName="store.vol", cAlternateFileName="")) returned 1
	[0231.841] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc44b2fe5, ftCreationTime.dwHighDateTime=0x1d82a28, ftLastAccessTime.dwLowDateTime=0xc44b2fe5, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xc44e79be, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x30000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tmp.edb", cAlternateFileName="")) returned 1
	[0231.841] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239e71ab, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x239e71ab, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0xea42b2c7, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="USS.chk", cAlternateFileName="")) returned 1
	[0231.841] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2399ab8b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x2399ab8b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0xc44661a2, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0x0, dwReserved1=0x0, cFileName="USS.log", cAlternateFileName="")) returned 1
	[0231.841] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239c0dc2, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x239c0dc2, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x239c0dc2, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0x0, dwReserved1=0x0, cFileName="USSres00001.jrs", cAlternateFileName="USSRES~1.JRS")) returned 1
	[0231.841] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239c0dc2, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x239c0dc2, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x239c0dc2, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0x0, dwReserved1=0x0, cFileName="USSres00002.jrs", cAlternateFileName="USSRES~2.JRS")) returned 1
	[0231.841] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2399ab8b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x2399ab8b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0xdd289e64, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0x0, dwReserved1=0x0, cFileName="USStmp.log", cAlternateFileName="")) returned 1
	[0231.841] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.841] FindClose (in: hFindFile=0x79fee8 | out: hFindFile=0x79fee8) returned 1
	[0231.841] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\UnistoreDB\\USS.chk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comms\\unistoredb\\uss.chk"), fInfoLevelId=0x0, lpFileInformation=0x124d4c38 | out: lpFileInformation=0x124d4c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239e71ab, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x239e71ab, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0xea42b2c7, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0231.842] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\UnistoreDB\\USS.log" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comms\\unistoredb\\uss.log"), fInfoLevelId=0x0, lpFileInformation=0x124d4c88 | out: lpFileInformation=0x124d4c88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2399ab8b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x2399ab8b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0xc44661a2, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x300000)) returned 1
	[0231.842] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\UnistoreDB\\USSres00001.jrs" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comms\\unistoredb\\ussres00001.jrs"), fInfoLevelId=0x0, lpFileInformation=0x124d4cd8 | out: lpFileInformation=0x124d4cd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239c0dc2, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x239c0dc2, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x239c0dc2, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x300000)) returned 1
	[0231.842] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\UnistoreDB\\USSres00002.jrs" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comms\\unistoredb\\ussres00002.jrs"), fInfoLevelId=0x0, lpFileInformation=0x124d4d28 | out: lpFileInformation=0x124d4d28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239c0dc2, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x239c0dc2, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x239c0dc2, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x300000)) returned 1
	[0231.842] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\UnistoreDB\\USStmp.log" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comms\\unistoredb\\usstmp.log"), fInfoLevelId=0x0, lpFileInformation=0x124d4d78 | out: lpFileInformation=0x124d4d78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2399ab8b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x2399ab8b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0xdd289e64, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x300000)) returned 1
	[0231.842] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\UnistoreDB\\store.vol" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comms\\unistoredb\\store.vol"), fInfoLevelId=0x0, lpFileInformation=0x124d4dc8 | out: lpFileInformation=0x124d4dc8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x23a0d188, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x23a0d188, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0xc449e3a7, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x600000)) returned 1
	[0231.842] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\UnistoreDB\\tmp.edb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comms\\unistoredb\\tmp.edb"), fInfoLevelId=0x0, lpFileInformation=0x124d4e18 | out: lpFileInformation=0x124d4e18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc44b2fe5, ftCreationTime.dwHighDateTime=0x1d82a28, ftLastAccessTime.dwLowDateTime=0xc44b2fe5, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xc44e79be, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x30000)) returned 1
	[0231.843] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\History" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\history"), fInfoLevelId=0x0, lpFileInformation=0x124d4e68 | out: lpFileInformation=0x124d4e68*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.843] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\iconcache.db"), fInfoLevelId=0x0, lpFileInformation=0x124d4eb8 | out: lpFileInformation=0x124d4eb8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xb1dfb94f, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0xb1dfb94f, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x69d588a7, ftLastWriteTime.dwHighDateTime=0x1d82a22, nFileSizeHigh=0x0, nFileSizeLow=0x5c6e)) returned 1
	[0231.843] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft"), fInfoLevelId=0x0, lpFileInformation=0x124d4f08 | out: lpFileInformation=0x124d4f08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3a17d745, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a17d745, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0231.843] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.843] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3a17d745, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a17d745, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fbe8
	[0231.843] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3a17d745, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a17d745, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.843] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5b2eec3b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x5b2eec3b, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLR_v4.0", cAlternateFileName="")) returned 1
	[0231.843] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73c78cc8, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLR_v4.0_32", cAlternateFileName="CLR_V4~1.0_3")) returned 1
	[0231.843] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x58717184, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0x58717184, ftLastWriteTime.dwHighDateTime=0x1d82a22, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1
	[0231.843] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x1bdb8d1, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1bdb8d1, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Feeds", cAlternateFileName="")) returned 1
	[0231.844] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x430ec4ba, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x1c98c18, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1c98c18, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Feeds Cache", cAlternateFileName="FEEDSC~1")) returned 1
	[0231.844] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a17d745, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x3a184b86, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a184b86, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORMS", cAlternateFileName="")) returned 1
	[0231.844] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x809248a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xc7db342, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xc7db342, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameDVR", cAlternateFileName="")) returned 1
	[0231.844] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization", cAlternateFileName="INPUTP~1")) returned 1
	[0231.844] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5b61023, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xf5b61023, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0xf5b61023, ftLastWriteTime.dwHighDateTime=0x1d7045f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InstallAgent", cAlternateFileName="INSTAL~1")) returned 1
	[0231.844] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4137bbef, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xc37e06d0, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xc37e06d0, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1
	[0231.844] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40f9be3f, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40f9be3f, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40f9be3f, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1
	[0231.844] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5781bc17, ftCreationTime.dwHighDateTime=0x1d7046d, ftLastAccessTime.dwLowDateTime=0x696efe32, ftLastAccessTime.dwHighDateTime=0x1d7046d, ftLastWriteTime.dwLowDateTime=0x696efe32, ftLastWriteTime.dwHighDateTime=0x1d7046d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1
	[0231.844] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87b49234, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x84c1ec39, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84c1ec39, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive", cAlternateFileName="")) returned 1
	[0231.844] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a11bc67, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x3a11cf49, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a11cf49, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook", cAlternateFileName="")) returned 1
	[0231.844] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PlayReady", cAlternateFileName="PLAYRE~1")) returned 1
	[0231.844] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb898985, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xb898985, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xb9574d8, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1
	[0231.844] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf7b5ef1b, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf7b5ef1b, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0231.844] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87ca06a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x87ca06a1, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x87ca06a1, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~2")) returned 1
	[0231.844] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d0c63cd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x377dee7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1
	[0231.844] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.844] FindClose (in: hFindFile=0x79fbe8 | out: hFindFile=0x79fbe8) returned 1
	[0231.845] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\clr_v4.0"), fInfoLevelId=0x0, lpFileInformation=0x124d5548 | out: lpFileInformation=0x124d5548*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5b2eec3b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x5b2eec3b, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.845] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\clr_v4.0"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.845] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5b2eec3b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x5b2eec3b, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fa68
	[0231.845] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5b2eec3b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x5b2eec3b, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.845] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5b2eec3b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x5b2eec3b, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsageLogs", cAlternateFileName="USAGEL~1")) returned 1
	[0231.845] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.845] FindClose (in: hFindFile=0x79fa68 | out: hFindFile=0x79fa68) returned 1
	[0231.845] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs"), fInfoLevelId=0x0, lpFileInformation=0x124d55e8 | out: lpFileInformation=0x124d55e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x70f197fc, ftLastAccessTime.dwHighDateTime=0x1d7b059, ftLastWriteTime.dwLowDateTime=0x70f197fc, ftLastWriteTime.dwHighDateTime=0x1d7b059, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.846] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.847] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x70f197fc, ftLastAccessTime.dwHighDateTime=0x1d7b059, ftLastWriteTime.dwLowDateTime=0x70f197fc, ftLastWriteTime.dwHighDateTime=0x1d7b059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0028
	[0231.847] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x70f197fc, ftLastAccessTime.dwHighDateTime=0x1d7b059, ftLastWriteTime.dwLowDateTime=0x70f197fc, ftLastWriteTime.dwHighDateTime=0x1d7b059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.847] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5b2eec3b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x8647598c, ftLastWriteTime.dwHighDateTime=0x1d7e768, nFileSizeHigh=0x0, nFileSizeLow=0x110c, dwReserved0=0x0, dwReserved1=0x0, cFileName="powershell.exe.log", cAlternateFileName="POWERS~1.LOG")) returned 1
	[0231.847] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f197fc, ftCreationTime.dwHighDateTime=0x1d7b059, ftLastAccessTime.dwLowDateTime=0x70f197fc, ftLastAccessTime.dwHighDateTime=0x1d7b059, ftLastWriteTime.dwLowDateTime=0x70f197fc, ftLastWriteTime.dwHighDateTime=0x1d7b059, nFileSizeHigh=0x0, nFileSizeLow=0x15dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="sdiagnhost.exe.log", cAlternateFileName="SDIAGN~1.LOG")) returned 1
	[0231.847] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.847] FindClose (in: hFindFile=0x7a0028 | out: hFindFile=0x7a0028) returned 1
	[0231.847] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\powershell.exe.log" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\powershell.exe.log"), fInfoLevelId=0x0, lpFileInformation=0x124d56d8 | out: lpFileInformation=0x124d56d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5b2eec3b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x8647598c, ftLastWriteTime.dwHighDateTime=0x1d7e768, nFileSizeHigh=0x0, nFileSizeLow=0x110c)) returned 1
	[0231.847] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\sdiagnhost.exe.log" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\sdiagnhost.exe.log"), fInfoLevelId=0x0, lpFileInformation=0x124d5728 | out: lpFileInformation=0x124d5728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f197fc, ftCreationTime.dwHighDateTime=0x1d7b059, ftLastAccessTime.dwLowDateTime=0x70f197fc, ftLastAccessTime.dwHighDateTime=0x1d7b059, ftLastWriteTime.dwLowDateTime=0x70f197fc, ftLastWriteTime.dwHighDateTime=0x1d7b059, nFileSizeHigh=0x0, nFileSizeLow=0x15dd)) returned 1
	[0231.847] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0_32" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\clr_v4.0_32"), fInfoLevelId=0x0, lpFileInformation=0x124d5778 | out: lpFileInformation=0x124d5778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73c78cc8, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.848] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0_32" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\clr_v4.0_32"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.848] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73c78cc8, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79faa8
	[0231.848] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73c78cc8, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.848] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73c78cc8, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsageLogs", cAlternateFileName="USAGEL~1")) returned 1
	[0231.849] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.849] FindClose (in: hFindFile=0x79faa8 | out: hFindFile=0x79faa8) returned 1
	[0231.849] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs"), fInfoLevelId=0x0, lpFileInformation=0x124d58b8 | out: lpFileInformation=0x124d58b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73c78cc8, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.849] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.850] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73c78cc8, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ff68
	[0231.850] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73c78cc8, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.850] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x8a845ef9, ftLastWriteTime.dwHighDateTime=0x1d7e768, nFileSizeHigh=0x0, nFileSizeLow=0x1078, dwReserved0=0x0, dwReserved1=0x0, cFileName="powershell.exe.log", cAlternateFileName="POWERS~1.LOG")) returned 1
	[0231.850] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.850] FindClose (in: hFindFile=0x79ff68 | out: hFindFile=0x79ff68) returned 1
	[0231.850] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\powershell.exe.log"), fInfoLevelId=0x0, lpFileInformation=0x124d5958 | out: lpFileInformation=0x124d5958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x8a845ef9, ftLastWriteTime.dwHighDateTime=0x1d7e768, nFileSizeHigh=0x0, nFileSizeLow=0x1078)) returned 1
	[0231.850] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\credentials"), fInfoLevelId=0x0, lpFileInformation=0x124d59a8 | out: lpFileInformation=0x124d59a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x58717184, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0x58717184, ftLastWriteTime.dwHighDateTime=0x1d82a22, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.850] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\credentials"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.850] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x58717184, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0x58717184, ftLastWriteTime.dwHighDateTime=0x1d82a22, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fca8
	[0231.851] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x58717184, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0x58717184, ftLastWriteTime.dwHighDateTime=0x1d82a22, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.851] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x508b12b7, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x58717184, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0x5871986a, ftLastWriteTime.dwHighDateTime=0x1d82a22, nFileSizeHigh=0x0, nFileSizeLow=0x2ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DFBE70A7E5CC19A398EBF1B96859CE5D", cAlternateFileName="DFBE70~1")) returned 1
	[0231.851] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.851] FindClose (in: hFindFile=0x79fca8 | out: hFindFile=0x79fca8) returned 1
	[0231.852] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\credentials\\dfbe70a7e5cc19a398ebf1b96859ce5d"), fInfoLevelId=0x0, lpFileInformation=0x124d5a48 | out: lpFileInformation=0x124d5a48*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x508b12b7, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x58717184, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0x5871986a, ftLastWriteTime.dwHighDateTime=0x1d82a22, nFileSizeHigh=0x0, nFileSizeLow=0x2ac0)) returned 1
	[0231.852] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\FORMS" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\forms"), fInfoLevelId=0x0, lpFileInformation=0x124d5a98 | out: lpFileInformation=0x124d5a98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a17d745, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x3a184b86, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a184b86, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.853] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\FORMS" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\forms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.853] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\FORMS\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a17d745, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x3a184b86, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a184b86, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fe68
	[0231.853] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a17d745, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x3a184b86, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a184b86, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.853] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a184b86, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x3a184b86, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a4e76b4, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x3c0dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRMCACHE.DAT", cAlternateFileName="")) returned 1
	[0231.853] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.853] FindClose (in: hFindFile=0x79fe68 | out: hFindFile=0x79fe68) returned 1
	[0231.853] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\forms\\frmcache.dat"), fInfoLevelId=0x0, lpFileInformation=0x124d5b38 | out: lpFileInformation=0x124d5b38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a184b86, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x3a184b86, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a4e76b4, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x3c0dc)) returned 1
	[0231.853] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\feeds"), fInfoLevelId=0x0, lpFileInformation=0x124d5b88 | out: lpFileInformation=0x124d5b88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x1bdb8d1, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1bdb8d1, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.853] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\feeds"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.853] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x1bdb8d1, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1bdb8d1, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0028
	[0231.854] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x1bdb8d1, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1bdb8d1, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.854] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bdb8d1, ftCreationTime.dwHighDateTime=0x1d82a29, ftLastAccessTime.dwLowDateTime=0x1bdb8d1, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1bb2306, ftLastWriteTime.dwHighDateTime=0x1d83aa2, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="FeedsStore.feedsdb-ms", cAlternateFileName="FEEDSS~1.FEE")) returned 1
	[0231.854] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x1afb4e0, ftCreationTime.dwHighDateTime=0x1d82a29, ftLastAccessTime.dwLowDateTime=0x1b42ef5, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1b42ef5, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 1
	[0231.854] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.854] FindClose (in: hFindFile=0x7a0028 | out: hFindFile=0x7a0028) returned 1
	[0231.854] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms"), fInfoLevelId=0x0, lpFileInformation=0x124d5c78 | out: lpFileInformation=0x124d5c78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bdb8d1, ftCreationTime.dwHighDateTime=0x1d82a29, ftLastAccessTime.dwLowDateTime=0x1bdb8d1, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1bb2306, ftLastWriteTime.dwHighDateTime=0x1d83aa2, nFileSizeHigh=0x0, nFileSizeLow=0x1400)) returned 1
	[0231.855] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~"), fInfoLevelId=0x0, lpFileInformation=0x124d5cc8 | out: lpFileInformation=0x124d5cc8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x1afb4e0, ftCreationTime.dwHighDateTime=0x1d82a29, ftLastAccessTime.dwLowDateTime=0x1b42ef5, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1b42ef5, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.855] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.855] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x1afb4e0, ftCreationTime.dwHighDateTime=0x1d82a29, ftLastAccessTime.dwLowDateTime=0x1b42ef5, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1b42ef5, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0068
	[0231.856] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x1afb4e0, ftCreationTime.dwHighDateTime=0x1d82a29, ftLastAccessTime.dwLowDateTime=0x1b42ef5, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1b42ef5, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.856] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1b42ef5, ftCreationTime.dwHighDateTime=0x1d82a29, ftLastAccessTime.dwLowDateTime=0x1b42ef5, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1c6e390, ftLastWriteTime.dwHighDateTime=0x1d83aa2, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer Suggested Sites~.feed-ms", cAlternateFileName="INTERN~1.FEE")) returned 1
	[0231.856] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.856] FindClose (in: hFindFile=0x7a0068 | out: hFindFile=0x7a0068) returned 1
	[0231.856] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\Internet Explorer Suggested Sites~.feed-ms" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\internet explorer suggested sites~.feed-ms"), fInfoLevelId=0x0, lpFileInformation=0x124d5d68 | out: lpFileInformation=0x124d5d68*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1b42ef5, ftCreationTime.dwHighDateTime=0x1d82a29, ftLastAccessTime.dwLowDateTime=0x1b42ef5, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1c6e390, ftLastWriteTime.dwHighDateTime=0x1d83aa2, nFileSizeHigh=0x0, nFileSizeLow=0x9000)) returned 1
	[0231.856] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\feeds cache"), fInfoLevelId=0x0, lpFileInformation=0x124d5db8 | out: lpFileInformation=0x124d5db8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x430ec4ba, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x1c98c18, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1c98c18, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0231.856] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\feeds cache"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.856] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x430ec4ba, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x1c98c18, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1c98c18, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fee8
	[0231.856] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x430ec4ba, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x1c98c18, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1c98c18, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.856] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1c66b79, ftCreationTime.dwHighDateTime=0x1d82a29, ftLastAccessTime.dwLowDateTime=0x1c66b79, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1c66b79, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="62XTTT8B", cAlternateFileName="")) returned 1
	[0231.857] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1c67e91, ftCreationTime.dwHighDateTime=0x1d82a29, ftLastAccessTime.dwLowDateTime=0x1c67e91, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1c67e91, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9O005C1L", cAlternateFileName="")) returned 1
	[0231.857] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x1b01624, ftCreationTime.dwHighDateTime=0x1d82a29, ftLastAccessTime.dwLowDateTime=0x1b01624, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1b01624, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1
	[0231.857] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1c66b79, ftCreationTime.dwHighDateTime=0x1d82a29, ftLastAccessTime.dwLowDateTime=0x1c66b79, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1c66b79, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="F71ONMET", cAlternateFileName="")) returned 1
	[0231.857] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1c657dd, ftCreationTime.dwHighDateTime=0x1d82a29, ftLastAccessTime.dwLowDateTime=0x1c657dd, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1c657dd, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XE50GYKC", cAlternateFileName="")) returned 1
	[0231.857] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.857] FindClose (in: hFindFile=0x79fee8 | out: hFindFile=0x79fee8) returned 1
	[0231.857] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\62XTTT8B" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\feeds cache\\62xttt8b"), fInfoLevelId=0x0, lpFileInformation=0x124d5f98 | out: lpFileInformation=0x124d5f98*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1c66b79, ftCreationTime.dwHighDateTime=0x1d82a29, ftLastAccessTime.dwLowDateTime=0x1c66b79, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1c66b79, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.858] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\62XTTT8B" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\feeds cache\\62xttt8b"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.858] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\62XTTT8B\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1c66b79, ftCreationTime.dwHighDateTime=0x1d82a29, ftLastAccessTime.dwLowDateTime=0x1c66b79, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1c66b79, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fb68
	[0231.858] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1c66b79, ftCreationTime.dwHighDateTime=0x1d82a29, ftLastAccessTime.dwLowDateTime=0x1c66b79, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1c66b79, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.858] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.858] FindClose (in: hFindFile=0x79fb68 | out: hFindFile=0x79fb68) returned 1
	[0231.858] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\9O005C1L" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\feeds cache\\9o005c1l"), fInfoLevelId=0x0, lpFileInformation=0x1281c008 | out: lpFileInformation=0x1281c008*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1c67e91, ftCreationTime.dwHighDateTime=0x1d82a29, ftLastAccessTime.dwLowDateTime=0x1d22ad4, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1d22ad4, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.858] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\9O005C1L" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\feeds cache\\9o005c1l"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.859] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\9O005C1L\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1c67e91, ftCreationTime.dwHighDateTime=0x1d82a29, ftLastAccessTime.dwLowDateTime=0x1c67e91, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1d22ad4, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fb28
	[0231.859] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1c67e91, ftCreationTime.dwHighDateTime=0x1d82a29, ftLastAccessTime.dwLowDateTime=0x1c67e91, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1d22ad4, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.859] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d22ad4, ftCreationTime.dwHighDateTime=0x1d82a29, ftLastAccessTime.dwLowDateTime=0x1d22ad4, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1d22ad4, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieonlinews.microsoft[1]", cAlternateFileName="IEONLI~1.MIC")) returned 1
	[0231.859] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.859] FindClose (in: hFindFile=0x79fb28 | out: hFindFile=0x79fb28) returned 1
	[0231.859] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\9O005C1L\\ieonlinews.microsoft[1]" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\feeds cache\\9o005c1l\\ieonlinews.microsoft[1]"), fInfoLevelId=0x0, lpFileInformation=0x1281c0a8 | out: lpFileInformation=0x1281c0a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d22ad4, ftCreationTime.dwHighDateTime=0x1d82a29, ftLastAccessTime.dwLowDateTime=0x1d22ad4, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1d22ad4, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.859] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\F71ONMET" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\feeds cache\\f71onmet"), fInfoLevelId=0x0, lpFileInformation=0x1281c0f8 | out: lpFileInformation=0x1281c0f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1c66b79, ftCreationTime.dwHighDateTime=0x1d82a29, ftLastAccessTime.dwLowDateTime=0x1c66b79, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1c66b79, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.859] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\F71ONMET" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\feeds cache\\f71onmet"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.859] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\F71ONMET\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1c66b79, ftCreationTime.dwHighDateTime=0x1d82a29, ftLastAccessTime.dwLowDateTime=0x1c66b79, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1c66b79, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f8e8
	[0231.859] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1c66b79, ftCreationTime.dwHighDateTime=0x1d82a29, ftLastAccessTime.dwLowDateTime=0x1c66b79, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1c66b79, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.859] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.860] FindClose (in: hFindFile=0x79f8e8 | out: hFindFile=0x79f8e8) returned 1
	[0231.860] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\XE50GYKC" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\feeds cache\\xe50gykc"), fInfoLevelId=0x0, lpFileInformation=0x1281c148 | out: lpFileInformation=0x1281c148*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1c657dd, ftCreationTime.dwHighDateTime=0x1d82a29, ftLastAccessTime.dwLowDateTime=0x1c657dd, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1c657dd, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.860] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\XE50GYKC" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\feeds cache\\xe50gykc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.860] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\XE50GYKC\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1c657dd, ftCreationTime.dwHighDateTime=0x1d82a29, ftLastAccessTime.dwLowDateTime=0x1c657dd, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1c657dd, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f968
	[0231.860] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1c657dd, ftCreationTime.dwHighDateTime=0x1d82a29, ftLastAccessTime.dwLowDateTime=0x1c657dd, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1c657dd, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.860] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.860] FindClose (in: hFindFile=0x79f968 | out: hFindFile=0x79f968) returned 1
	[0231.861] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\container.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\feeds cache\\container.dat"), fInfoLevelId=0x0, lpFileInformation=0x1281c198 | out: lpFileInformation=0x1281c198*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x1b01624, ftCreationTime.dwHighDateTime=0x1d82a29, ftLastAccessTime.dwLowDateTime=0x1b01624, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1b01624, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.861] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\GameDVR" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\gamedvr"), fInfoLevelId=0x0, lpFileInformation=0x1281c1e8 | out: lpFileInformation=0x1281c1e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x809248a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xc7db342, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xc7db342, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.861] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\GameDVR" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\gamedvr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.861] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\GameDVR\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x809248a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xc7db342, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xc7db342, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fd68
	[0231.861] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x809248a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xc7db342, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xc7db342, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.861] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7db342, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xc7db342, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x212d1b5b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd23c, dwReserved0=0x0, dwReserved1=0x0, cFileName="KnownGameList.bin", cAlternateFileName="KNOWNG~1.BIN")) returned 1
	[0231.861] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.861] FindClose (in: hFindFile=0x79fd68 | out: hFindFile=0x79fd68) returned 1
	[0231.861] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\GameDVR\\KnownGameList.bin" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\gamedvr\\knowngamelist.bin"), fInfoLevelId=0x0, lpFileInformation=0x1281c288 | out: lpFileInformation=0x1281c288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7db342, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xc7db342, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x212d1b5b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd23c)) returned 1
	[0231.861] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InputPersonalization" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\inputpersonalization"), fInfoLevelId=0x0, lpFileInformation=0x1281c2d8 | out: lpFileInformation=0x1281c2d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.862] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InputPersonalization" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\inputpersonalization"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.862] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InputPersonalization\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fea8
	[0231.862] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.863] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TrainedDataStore", cAlternateFileName="TRAINE~1")) returned 1
	[0231.863] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.863] FindClose (in: hFindFile=0x79fea8 | out: hFindFile=0x79fea8) returned 1
	[0231.863] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InputPersonalization\\TrainedDataStore" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\inputpersonalization\\traineddatastore"), fInfoLevelId=0x0, lpFileInformation=0x1281c378 | out: lpFileInformation=0x1281c378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.863] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InputPersonalization\\TrainedDataStore" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\inputpersonalization\\traineddatastore"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.863] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InputPersonalization\\TrainedDataStore\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffe8
	[0231.863] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.863] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.863] FindClose (in: hFindFile=0x79ffe8 | out: hFindFile=0x79ffe8) returned 1
	[0231.863] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InstallAgent" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\installagent"), fInfoLevelId=0x0, lpFileInformation=0x1281c3c8 | out: lpFileInformation=0x1281c3c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5b61023, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xf5b61023, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0xf5b61023, ftLastWriteTime.dwHighDateTime=0x1d7045f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.864] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InstallAgent" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\installagent"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.864] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InstallAgent\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5b61023, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xf5b61023, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0xf5b61023, ftLastWriteTime.dwHighDateTime=0x1d7045f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9e8
	[0231.864] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5b61023, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xf5b61023, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0xf5b61023, ftLastWriteTime.dwHighDateTime=0x1d7045f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.864] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5b61023, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xf5b61023, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0xf5b61023, ftLastWriteTime.dwHighDateTime=0x1d7045f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkpoints", cAlternateFileName="CHECKP~1")) returned 1
	[0231.864] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.864] FindClose (in: hFindFile=0x79f9e8 | out: hFindFile=0x79f9e8) returned 1
	[0231.864] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\installagent\\checkpoints"), fInfoLevelId=0x0, lpFileInformation=0x1281c468 | out: lpFileInformation=0x1281c468*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5b61023, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xf5b61023, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0xf5b61023, ftLastWriteTime.dwHighDateTime=0x1d7045f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.865] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\installagent\\checkpoints"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.865] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5b61023, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xf5b61023, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0xf5b61023, ftLastWriteTime.dwHighDateTime=0x1d7045f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ff68
	[0231.865] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5b61023, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xf5b61023, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0xf5b61023, ftLastWriteTime.dwHighDateTime=0x1d7045f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.866] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.866] FindClose (in: hFindFile=0x79ff68 | out: hFindFile=0x79ff68) returned 1
	[0231.866] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer"), fInfoLevelId=0x0, lpFileInformation=0x1281c4b8 | out: lpFileInformation=0x1281c4b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4137bbef, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xe1bc7d6f, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xe1bc7d6f, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0231.866] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.866] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4137bbef, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xe1bc7d6f, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xe1bc7d6f, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fde8
	[0231.866] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4137bbef, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xe1bc7d6f, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xe1bc7d6f, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.866] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4302da2a, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4302da2a, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x430ec4ba, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x19b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="brndlog.txt", cAlternateFileName="")) returned 1
	[0231.866] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc37e06d0, ftCreationTime.dwHighDateTime=0x1d83aa1, ftLastAccessTime.dwLowDateTime=0xc37e06d0, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xc37e06d0, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DomainSuggestions", cAlternateFileName="DOMAIN~1")) returned 1
	[0231.867] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfceb7161, ftCreationTime.dwHighDateTime=0x1d82a28, ftLastAccessTime.dwLowDateTime=0xfced9468, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xfced9468, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EmieSiteList", cAlternateFileName="EMIESI~1")) returned 1
	[0231.867] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfceef3d7, ftCreationTime.dwHighDateTime=0x1d82a28, ftLastAccessTime.dwLowDateTime=0xfcf1c6b2, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xfcf1c6b2, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EmieUserList", cAlternateFileName="EMIEUS~1")) returned 1
	[0231.867] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x431ab1e5, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x431ab1e5, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x600a7168, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x92, dwReserved0=0x0, dwReserved1=0x0, cFileName="ie4uinit-ClearIconCache.log", cAlternateFileName="IE4UIN~2.LOG")) returned 1
	[0231.867] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4137bbef, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4137bbef, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x431128d7, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x514, dwReserved0=0x0, dwReserved1=0x0, cFileName="ie4uinit-UserConfig.log", cAlternateFileName="IE4UIN~1.LOG")) returned 1
	[0231.867] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42cc0372, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42cc0372, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IECompatData", cAlternateFileName="IECOMP~1")) returned 1
	[0231.867] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe1bc7d6f, ftCreationTime.dwHighDateTime=0x1d83aa1, ftLastAccessTime.dwLowDateTime=0xe49e30a6, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xe49e30a6, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IEFlipAheadCache", cAlternateFileName="IEFLIP~1")) returned 1
	[0231.867] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1367a16, ftCreationTime.dwHighDateTime=0x1d82a29, ftLastAccessTime.dwLowDateTime=0x1367a16, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1367a16, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="imagestore", cAlternateFileName="IMAGES~1")) returned 1
	[0231.867] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3d48664, ftCreationTime.dwHighDateTime=0x1d82a28, ftLastAccessTime.dwLowDateTime=0xf3d48664, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf3d48664, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1
	[0231.867] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabRoaming", cAlternateFileName="TABROA~1")) returned 1
	[0231.867] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tracking Protection", cAlternateFileName="TRACKI~1")) returned 1
	[0231.867] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa112d16c, ftCreationTime.dwHighDateTime=0x1d83aa1, ftLastAccessTime.dwLowDateTime=0xa14ed366, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa14ed366, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VersionManager", cAlternateFileName="VERSIO~1")) returned 1
	[0231.867] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.867] FindClose (in: hFindFile=0x79fde8 | out: hFindFile=0x79fde8) returned 1
	[0231.867] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\DomainSuggestions" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\domainsuggestions"), fInfoLevelId=0x0, lpFileInformation=0x1281c918 | out: lpFileInformation=0x1281c918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc37e06d0, ftCreationTime.dwHighDateTime=0x1d83aa1, ftLastAccessTime.dwLowDateTime=0xc6d59dce, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xc6d59dce, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.868] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\DomainSuggestions" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\domainsuggestions"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.868] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\DomainSuggestions\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc37e06d0, ftCreationTime.dwHighDateTime=0x1d83aa1, ftLastAccessTime.dwLowDateTime=0xc6d59dce, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xc6d59dce, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fb28
	[0231.868] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc37e06d0, ftCreationTime.dwHighDateTime=0x1d83aa1, ftLastAccessTime.dwLowDateTime=0xc6d59dce, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xc6d59dce, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.868] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d58a40, ftCreationTime.dwHighDateTime=0x1d83aa1, ftLastAccessTime.dwLowDateTime=0xc6d58a40, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xc37dcc31, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x4700, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US.1", cAlternateFileName="")) returned 1
	[0231.868] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.868] FindClose (in: hFindFile=0x79fb28 | out: hFindFile=0x79fb28) returned 1
	[0231.868] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\DomainSuggestions\\en-US.1" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\domainsuggestions\\en-us.1"), fInfoLevelId=0x0, lpFileInformation=0x1281c9b8 | out: lpFileInformation=0x1281c9b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d58a40, ftCreationTime.dwHighDateTime=0x1d83aa1, ftLastAccessTime.dwLowDateTime=0xc6d58a40, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xc37dcc31, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x4700)) returned 1
	[0231.868] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieSiteList" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\emiesitelist"), fInfoLevelId=0x0, lpFileInformation=0x1281ca08 | out: lpFileInformation=0x1281ca08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfceb7161, ftCreationTime.dwHighDateTime=0x1d82a28, ftLastAccessTime.dwLowDateTime=0xfced9468, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xfced9468, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.868] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieSiteList" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\emiesitelist"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.869] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieSiteList\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfceb7161, ftCreationTime.dwHighDateTime=0x1d82a28, ftLastAccessTime.dwLowDateTime=0xfced9468, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xfced9468, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fb28
	[0231.869] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfceb7161, ftCreationTime.dwHighDateTime=0x1d82a28, ftLastAccessTime.dwLowDateTime=0xfced9468, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xfced9468, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.869] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xfced9468, ftCreationTime.dwHighDateTime=0x1d82a28, ftLastAccessTime.dwLowDateTime=0xfced9468, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xfced9468, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1
	[0231.869] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.869] FindClose (in: hFindFile=0x79fb28 | out: hFindFile=0x79fb28) returned 1
	[0231.869] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieSiteList\\container.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\emiesitelist\\container.dat"), fInfoLevelId=0x0, lpFileInformation=0x1281caa8 | out: lpFileInformation=0x1281caa8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xfced9468, ftCreationTime.dwHighDateTime=0x1d82a28, ftLastAccessTime.dwLowDateTime=0xfced9468, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xfced9468, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.869] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieUserList" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\emieuserlist"), fInfoLevelId=0x0, lpFileInformation=0x1281caf8 | out: lpFileInformation=0x1281caf8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfceef3d7, ftCreationTime.dwHighDateTime=0x1d82a28, ftLastAccessTime.dwLowDateTime=0xfcf1c6b2, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xfcf1c6b2, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.869] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieUserList" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\emieuserlist"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.869] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieUserList\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfceef3d7, ftCreationTime.dwHighDateTime=0x1d82a28, ftLastAccessTime.dwLowDateTime=0xfcf1c6b2, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xfcf1c6b2, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fc68
	[0231.870] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfceef3d7, ftCreationTime.dwHighDateTime=0x1d82a28, ftLastAccessTime.dwLowDateTime=0xfcf1c6b2, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xfcf1c6b2, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.870] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xfcf1c6b2, ftCreationTime.dwHighDateTime=0x1d82a28, ftLastAccessTime.dwLowDateTime=0xfcf1c6b2, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xfcf1c6b2, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1
	[0231.870] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.870] FindClose (in: hFindFile=0x79fc68 | out: hFindFile=0x79fc68) returned 1
	[0231.870] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieUserList\\container.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\emieuserlist\\container.dat"), fInfoLevelId=0x0, lpFileInformation=0x1281cb98 | out: lpFileInformation=0x1281cb98*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xfcf1c6b2, ftCreationTime.dwHighDateTime=0x1d82a28, ftLastAccessTime.dwLowDateTime=0xfcf1c6b2, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xfcf1c6b2, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.870] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\IECompatData" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\iecompatdata"), fInfoLevelId=0x0, lpFileInformation=0x1281cbe8 | out: lpFileInformation=0x1281cbe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42cc0372, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42cc0372, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.870] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\IECompatData" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\iecompatdata"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.870] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\IECompatData\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42cc0372, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42cc0372, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9e8
	[0231.870] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42cc0372, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42cc0372, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.870] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42cc0372, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42cc0372, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0xc10, dwReserved0=0x0, dwReserved1=0x0, cFileName="iecompatdata.xml", cAlternateFileName="IECOMP~1.XML")) returned 1
	[0231.870] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.871] FindClose (in: hFindFile=0x79f9e8 | out: hFindFile=0x79f9e8) returned 1
	[0231.871] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\IECompatData\\iecompatdata.xml" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\iecompatdata\\iecompatdata.xml"), fInfoLevelId=0x0, lpFileInformation=0x1281cc88 | out: lpFileInformation=0x1281cc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42cc0372, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42cc0372, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0xc10)) returned 1
	[0231.871] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\IEFlipAheadCache" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\ieflipaheadcache"), fInfoLevelId=0x0, lpFileInformation=0x1281ccd8 | out: lpFileInformation=0x1281ccd8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe1bc7d6f, ftCreationTime.dwHighDateTime=0x1d83aa1, ftLastAccessTime.dwLowDateTime=0xe49e30a6, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xe49e30a6, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.871] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\IEFlipAheadCache" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\ieflipaheadcache"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.871] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\IEFlipAheadCache\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe1bc7d6f, ftCreationTime.dwHighDateTime=0x1d83aa1, ftLastAccessTime.dwLowDateTime=0xe49e30a6, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xe49e30a6, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fee8
	[0231.871] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe1bc7d6f, ftCreationTime.dwHighDateTime=0x1d83aa1, ftLastAccessTime.dwLowDateTime=0xe49e30a6, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xe49e30a6, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.871] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xe49e30a6, ftCreationTime.dwHighDateTime=0x1d83aa1, ftLastAccessTime.dwLowDateTime=0xe49e30a6, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xe49e30a6, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1
	[0231.871] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.871] FindClose (in: hFindFile=0x79fee8 | out: hFindFile=0x79fee8) returned 1
	[0231.872] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\IEFlipAheadCache\\container.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\ieflipaheadcache\\container.dat"), fInfoLevelId=0x0, lpFileInformation=0x1281cd78 | out: lpFileInformation=0x1281cd78*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xe49e30a6, ftCreationTime.dwHighDateTime=0x1d83aa1, ftLastAccessTime.dwLowDateTime=0xe49e30a6, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xe49e30a6, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.872] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\recovery"), fInfoLevelId=0x0, lpFileInformation=0x1281cdc8 | out: lpFileInformation=0x1281cdc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3d48664, ftCreationTime.dwHighDateTime=0x1d82a28, ftLastAccessTime.dwLowDateTime=0xf3d5229b, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf3d5229b, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.872] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\recovery"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.872] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3d48664, ftCreationTime.dwHighDateTime=0x1d82a28, ftLastAccessTime.dwLowDateTime=0xf3d5229b, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf3d5229b, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fa68
	[0231.872] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3d48664, ftCreationTime.dwHighDateTime=0x1d82a28, ftLastAccessTime.dwLowDateTime=0xf3d5229b, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf3d5229b, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.872] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3d5229b, ftCreationTime.dwHighDateTime=0x1d82a28, ftLastAccessTime.dwLowDateTime=0xf3d5229b, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf3d5229b, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Active", cAlternateFileName="")) returned 1
	[0231.872] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.872] FindClose (in: hFindFile=0x79fa68 | out: hFindFile=0x79fa68) returned 1
	[0231.872] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\recovery\\active"), fInfoLevelId=0x0, lpFileInformation=0x1281ce68 | out: lpFileInformation=0x1281ce68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3d5229b, ftCreationTime.dwHighDateTime=0x1d82a28, ftLastAccessTime.dwLowDateTime=0xf8d8ba40, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf8d8ba40, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.873] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\recovery\\active"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.873] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3d5229b, ftCreationTime.dwHighDateTime=0x1d82a28, ftLastAccessTime.dwLowDateTime=0xf8d8ba40, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf8d8ba40, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f8e8
	[0231.873] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3d5229b, ftCreationTime.dwHighDateTime=0x1d82a28, ftLastAccessTime.dwLowDateTime=0xf8d8ba40, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf8d8ba40, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.873] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3d597a4, ftCreationTime.dwHighDateTime=0x1d82a28, ftLastAccessTime.dwLowDateTime=0xf3d597a4, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0x1383c0c, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecoveryStore.{2F9A9085-961C-11EC-B0BF-000FF3E16138}.dat", cAlternateFileName="RECOVE~1.DAT")) returned 1
	[0231.873] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8d8ba40, ftCreationTime.dwHighDateTime=0x1d82a28, ftLastAccessTime.dwLowDateTime=0xf8d8ba40, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0x17a1e7b, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="{368170A8-961C-11EC-B0BF-000FF3E16138}.dat", cAlternateFileName="{36817~1.DAT")) returned 1
	[0231.873] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.873] FindClose (in: hFindFile=0x79f8e8 | out: hFindFile=0x79f8e8) returned 1
	[0231.873] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\RecoveryStore.{2F9A9085-961C-11EC-B0BF-000FF3E16138}.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\recovery\\active\\recoverystore.{2f9a9085-961c-11ec-b0bf-000ff3e16138}.dat"), fInfoLevelId=0x0, lpFileInformation=0x1281cf58 | out: lpFileInformation=0x1281cf58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3d597a4, ftCreationTime.dwHighDateTime=0x1d82a28, ftLastAccessTime.dwLowDateTime=0xf3d597a4, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0x1383c0c, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x1600)) returned 1
	[0231.873] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\{368170A8-961C-11EC-B0BF-000FF3E16138}.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\recovery\\active\\{368170a8-961c-11ec-b0bf-000ff3e16138}.dat"), fInfoLevelId=0x0, lpFileInformation=0x1281cfa8 | out: lpFileInformation=0x1281cfa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8d8ba40, ftCreationTime.dwHighDateTime=0x1d82a28, ftLastAccessTime.dwLowDateTime=0xf8d8ba40, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0x17a1e7b, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0xe00)) returned 1
	[0231.873] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\TabRoaming" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\tabroaming"), fInfoLevelId=0x0, lpFileInformation=0x1281cff8 | out: lpFileInformation=0x1281cff8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.874] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\TabRoaming" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\tabroaming"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.874] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\TabRoaming\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9e8
	[0231.874] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.874] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.874] FindClose (in: hFindFile=0x79f9e8 | out: hFindFile=0x79f9e8) returned 1
	[0231.874] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\Tracking Protection" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\tracking protection"), fInfoLevelId=0x0, lpFileInformation=0x1281d048 | out: lpFileInformation=0x1281d048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.874] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\Tracking Protection" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\tracking protection"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.874] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\Tracking Protection\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fe28
	[0231.874] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.875] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.875] FindClose (in: hFindFile=0x79fe28 | out: hFindFile=0x79fe28) returned 1
	[0231.875] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\VersionManager" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\versionmanager"), fInfoLevelId=0x0, lpFileInformation=0x1281d098 | out: lpFileInformation=0x1281d098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa112d16c, ftCreationTime.dwHighDateTime=0x1d83aa1, ftLastAccessTime.dwLowDateTime=0xa14ed366, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa14ed366, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.875] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\VersionManager" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\versionmanager"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.875] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\VersionManager\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa112d16c, ftCreationTime.dwHighDateTime=0x1d83aa1, ftLastAccessTime.dwLowDateTime=0xa14ed366, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa14ed366, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffa8
	[0231.875] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa112d16c, ftCreationTime.dwHighDateTime=0x1d83aa1, ftLastAccessTime.dwLowDateTime=0xa14ed366, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa14ed366, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.875] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa14de776, ftCreationTime.dwHighDateTime=0x1d83aa1, ftLastAccessTime.dwLowDateTime=0xa14de776, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa14dfab3, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x3f96, dwReserved0=0x0, dwReserved1=0x0, cFileName="versionlist.xml", cAlternateFileName="VERSIO~1.XML")) returned 1
	[0231.875] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.875] FindClose (in: hFindFile=0x79ffa8 | out: hFindFile=0x79ffa8) returned 1
	[0231.875] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\VersionManager\\versionlist.xml" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\versionmanager\\versionlist.xml"), fInfoLevelId=0x0, lpFileInformation=0x1281d138 | out: lpFileInformation=0x1281d138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa14de776, ftCreationTime.dwHighDateTime=0x1d83aa1, ftLastAccessTime.dwLowDateTime=0xa14de776, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa14dfab3, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x3f96)) returned 1
	[0231.876] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), fInfoLevelId=0x0, lpFileInformation=0x1281d188 | out: lpFileInformation=0x1281d188*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4302da2a, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4302da2a, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x430ec4ba, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x19b3)) returned 1
	[0231.876] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\ie4uinit-ClearIconCache.log" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\ie4uinit-cleariconcache.log"), fInfoLevelId=0x0, lpFileInformation=0x1281d1d8 | out: lpFileInformation=0x1281d1d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x431ab1e5, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x431ab1e5, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x600a7168, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x92)) returned 1
	[0231.876] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\ie4uinit-UserConfig.log" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\ie4uinit-userconfig.log"), fInfoLevelId=0x0, lpFileInformation=0x1281d228 | out: lpFileInformation=0x1281d228*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4137bbef, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4137bbef, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x431128d7, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x514)) returned 1
	[0231.876] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\imagestore" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\imagestore"), fInfoLevelId=0x0, lpFileInformation=0x1281d278 | out: lpFileInformation=0x1281d278*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1367a16, ftCreationTime.dwHighDateTime=0x1d82a29, ftLastAccessTime.dwLowDateTime=0x1367a16, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1367a16, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.876] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\imagestore" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\imagestore"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.876] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\imagestore\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1367a16, ftCreationTime.dwHighDateTime=0x1d82a29, ftLastAccessTime.dwLowDateTime=0x1367a16, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1367a16, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fda8
	[0231.877] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1367a16, ftCreationTime.dwHighDateTime=0x1d82a29, ftLastAccessTime.dwLowDateTime=0x1367a16, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1367a16, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.877] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1367a16, ftCreationTime.dwHighDateTime=0x1d82a29, ftLastAccessTime.dwLowDateTime=0x1367a16, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1367a16, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="xu5jhze", cAlternateFileName="")) returned 1
	[0231.877] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.877] FindClose (in: hFindFile=0x79fda8 | out: hFindFile=0x79fda8) returned 1
	[0231.877] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\imagestore\\xu5jhze" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\imagestore\\xu5jhze"), fInfoLevelId=0x0, lpFileInformation=0x1281d318 | out: lpFileInformation=0x1281d318*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1367a16, ftCreationTime.dwHighDateTime=0x1d82a29, ftLastAccessTime.dwLowDateTime=0x1367a16, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1367a16, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.877] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\imagestore\\xu5jhze" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\imagestore\\xu5jhze"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.877] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\imagestore\\xu5jhze\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1367a16, ftCreationTime.dwHighDateTime=0x1d82a29, ftLastAccessTime.dwLowDateTime=0x1367a16, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1367a16, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0068
	[0231.877] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1367a16, ftCreationTime.dwHighDateTime=0x1d82a29, ftLastAccessTime.dwLowDateTime=0x1367a16, ftLastAccessTime.dwHighDateTime=0x1d82a29, ftLastWriteTime.dwLowDateTime=0x1367a16, ftLastWriteTime.dwHighDateTime=0x1d82a29, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.877] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.877] FindClose (in: hFindFile=0x7a0068 | out: hFindFile=0x7a0068) returned 1
	[0231.878] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Media Player" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\media player"), fInfoLevelId=0x0, lpFileInformation=0x1281d368 | out: lpFileInformation=0x1281d368*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40f9be3f, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x760d4d6f, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x760d4d6f, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.878] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Media Player" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\media player"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.878] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Media Player\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40f9be3f, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x760d4d6f, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x760d4d6f, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fce8
	[0231.878] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40f9be3f, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x760d4d6f, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x760d4d6f, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.878] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40f9be3f, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40f9be3f, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40f9be3f, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sync Playlists", cAlternateFileName="SYNCPL~1")) returned 1
	[0231.878] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x760d4d6f, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x760d4d6f, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x760d4d6f, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Transcoded Files Cache", cAlternateFileName="TRANSC~1")) returned 1
	[0231.878] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.878] FindClose (in: hFindFile=0x79fce8 | out: hFindFile=0x79fce8) returned 1
	[0231.878] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\media player\\sync playlists"), fInfoLevelId=0x0, lpFileInformation=0x1281d458 | out: lpFileInformation=0x1281d458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40f9be3f, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40f9be3f, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40f9be3f, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.880] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\media player\\sync playlists"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.880] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40f9be3f, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40f9be3f, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40f9be3f, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fc68
	[0231.881] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40f9be3f, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40f9be3f, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40f9be3f, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.881] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40f9be3f, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40f9be3f, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40f9be3f, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0231.881] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.881] FindClose (in: hFindFile=0x79fc68 | out: hFindFile=0x79fc68) returned 1
	[0231.881] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x1281d4f8 | out: lpFileInformation=0x1281d4f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40f9be3f, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40f9be3f, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40f9be3f, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.881] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.881] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40f9be3f, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40f9be3f, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40f9be3f, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fea8
	[0231.881] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40f9be3f, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40f9be3f, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40f9be3f, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.881] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40f9be3f, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40fe83ee, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40fe83ee, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="00007F03", cAlternateFileName="")) returned 1
	[0231.881] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.881] FindClose (in: hFindFile=0x79fea8 | out: hFindFile=0x79fea8) returned 1
	[0231.882] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00007F03" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00007f03"), fInfoLevelId=0x0, lpFileInformation=0x1281d598 | out: lpFileInformation=0x1281d598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40f9be3f, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40fe83ee, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40fe83ee, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.882] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00007F03" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00007f03"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.882] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00007F03\\*", lpFindFileData=0x12423724 | out: lpFindFileData=0x12423724*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40f9be3f, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40fe83ee, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40fe83ee, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffe8
	[0231.922] SetEvent (hEvent=0x168) returned 1
	[0231.922] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40f9be3f, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40fe83ee, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40fe83ee, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.922] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40f9be3f, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40f9be3f, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40f9be3f, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x0, cFileName="01_Music_auto_rated_at_5_stars.wpl", cAlternateFileName="01_MUS~1.WPL")) returned 1
	[0231.923] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40f9be3f, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40f9be3f, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40f9be3f, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x4ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="02_Music_added_in_the_last_month.wpl", cAlternateFileName="02_MUS~1.WPL")) returned 1
	[0231.923] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40f9be3f, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40f9be3f, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40fc20df, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x4f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="03_Music_rated_at_4_or_5_stars.wpl", cAlternateFileName="03_MUS~1.WPL")) returned 1
	[0231.923] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40fc20df, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40fc20df, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40fc20df, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x0, dwReserved1=0x0, cFileName="04_Music_played_in_the_last_month.wpl", cAlternateFileName="04_MUS~1.WPL")) returned 1
	[0231.923] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40fc20df, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40fc20df, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40fc20df, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x0, dwReserved1=0x0, cFileName="05_Pictures_taken_in_the_last_month.wpl", cAlternateFileName="05_PIC~1.WPL")) returned 1
	[0231.923] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40fc20df, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40fc20df, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40fc20df, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x0, dwReserved1=0x0, cFileName="06_Pictures_rated_4_or_5_stars.wpl", cAlternateFileName="06_PIC~1.WPL")) returned 1
	[0231.923] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40fc20df, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40fc20df, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40fc20df, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x0, dwReserved1=0x0, cFileName="07_TV_recorded_in_the_last_week.wpl", cAlternateFileName="07_TV_~1.WPL")) returned 1
	[0231.923] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40fc20df, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40fc20df, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40fc20df, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="08_Video_rated_at_4_or_5_stars.wpl", cAlternateFileName="08_VID~1.WPL")) returned 1
	[0231.923] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40fc20df, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40fc20df, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40fc20df, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x0, dwReserved1=0x0, cFileName="09_Music_played_the_most.wpl", cAlternateFileName="09_MUS~1.WPL")) returned 1
	[0231.923] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40fc20df, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40fc20df, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40fc20df, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x427, dwReserved0=0x0, dwReserved1=0x0, cFileName="10_All_Music.wpl", cAlternateFileName="10_ALL~1.WPL")) returned 1
	[0231.923] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40fc20df, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40fc20df, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40fe83ee, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x0, cFileName="11_All_Pictures.wpl", cAlternateFileName="11_ALL~1.WPL")) returned 1
	[0231.923] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40fe83ee, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40fe83ee, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40fe83ee, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x0, dwReserved1=0x0, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 1
	[0231.923] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.923] FindClose (in: hFindFile=0x79ffe8 | out: hFindFile=0x79ffe8) returned 1
	[0231.924] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00007F03\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00007f03\\01_music_auto_rated_at_5_stars.wpl"), fInfoLevelId=0x0, lpFileInformation=0x1281d9a8 | out: lpFileInformation=0x1281d9a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40f9be3f, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40f9be3f, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40f9be3f, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x414)) returned 1
	[0231.925] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00007F03\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00007f03\\02_music_added_in_the_last_month.wpl"), fInfoLevelId=0x0, lpFileInformation=0x1281d9f8 | out: lpFileInformation=0x1281d9f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40f9be3f, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40f9be3f, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40f9be3f, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x4ff)) returned 1
	[0231.926] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00007F03\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00007f03\\03_music_rated_at_4_or_5_stars.wpl"), fInfoLevelId=0x0, lpFileInformation=0x1281da48 | out: lpFileInformation=0x1281da48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40f9be3f, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40f9be3f, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40fc20df, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x4f3)) returned 1
	[0231.927] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00007F03\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00007f03\\04_music_played_in_the_last_month.wpl"), fInfoLevelId=0x0, lpFileInformation=0x1281da98 | out: lpFileInformation=0x1281da98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40fc20df, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40fc20df, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40fc20df, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x504)) returned 1
	[0231.927] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00007F03\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00007f03\\05_pictures_taken_in_the_last_month.wpl"), fInfoLevelId=0x0, lpFileInformation=0x1281dae8 | out: lpFileInformation=0x1281dae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40fc20df, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40fc20df, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40fc20df, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x31d)) returned 1
	[0231.927] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00007F03\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00007f03\\06_pictures_rated_4_or_5_stars.wpl"), fInfoLevelId=0x0, lpFileInformation=0x1281db38 | out: lpFileInformation=0x1281db38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40fc20df, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40fc20df, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40fc20df, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x311)) returned 1
	[0231.928] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00007F03\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00007f03\\07_tv_recorded_in_the_last_week.wpl"), fInfoLevelId=0x0, lpFileInformation=0x1281db88 | out: lpFileInformation=0x1281db88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40fc20df, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40fc20df, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40fc20df, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x410)) returned 1
	[0231.928] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00007F03\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00007f03\\08_video_rated_at_4_or_5_stars.wpl"), fInfoLevelId=0x0, lpFileInformation=0x1281dbd8 | out: lpFileInformation=0x1281dbd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40fc20df, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40fc20df, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40fc20df, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x3fc)) returned 1
	[0231.928] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00007F03\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00007f03\\09_music_played_the_most.wpl"), fInfoLevelId=0x0, lpFileInformation=0x1281dc28 | out: lpFileInformation=0x1281dc28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40fc20df, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40fc20df, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40fc20df, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x401)) returned 1
	[0231.928] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00007F03\\10_All_Music.wpl" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00007f03\\10_all_music.wpl"), fInfoLevelId=0x0, lpFileInformation=0x1281dc78 | out: lpFileInformation=0x1281dc78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40fc20df, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40fc20df, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40fc20df, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x427)) returned 1
	[0231.928] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00007F03\\11_All_Pictures.wpl" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00007f03\\11_all_pictures.wpl"), fInfoLevelId=0x0, lpFileInformation=0x1281dcc8 | out: lpFileInformation=0x1281dcc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40fc20df, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40fc20df, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40fe83ee, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x249)) returned 1
	[0231.929] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00007F03\\12_All_Video.wpl" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00007f03\\12_all_video.wpl"), fInfoLevelId=0x0, lpFileInformation=0x1281dd18 | out: lpFileInformation=0x1281dd18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40fe83ee, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40fe83ee, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40fe83ee, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x437)) returned 1
	[0231.929] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\media player\\transcoded files cache"), fInfoLevelId=0x0, lpFileInformation=0x1281dd68 | out: lpFileInformation=0x1281dd68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x760d4d6f, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x760d4d6f, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x760d4d6f, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.929] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\media player\\transcoded files cache"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.930] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x760d4d6f, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x760d4d6f, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x760d4d6f, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f928
	[0231.930] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x760d4d6f, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x760d4d6f, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x760d4d6f, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.930] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.930] FindClose (in: hFindFile=0x79f928 | out: hFindFile=0x79f928) returned 1
	[0231.930] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office"), fInfoLevelId=0x0, lpFileInformation=0x1281ddb8 | out: lpFileInformation=0x1281ddb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5781bc17, ftCreationTime.dwHighDateTime=0x1d7046d, ftLastAccessTime.dwLowDateTime=0x696efe32, ftLastAccessTime.dwHighDateTime=0x1d7046d, ftLastWriteTime.dwLowDateTime=0x696efe32, ftLastWriteTime.dwHighDateTime=0x1d7046d, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.930] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.931] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5781bc17, ftCreationTime.dwHighDateTime=0x1d7046d, ftLastAccessTime.dwLowDateTime=0x696efe32, ftLastAccessTime.dwHighDateTime=0x1d7046d, ftLastWriteTime.dwLowDateTime=0x696efe32, ftLastWriteTime.dwHighDateTime=0x1d7046d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fa68
	[0231.931] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5781bc17, ftCreationTime.dwHighDateTime=0x1d7046d, ftLastAccessTime.dwLowDateTime=0x696efe32, ftLastAccessTime.dwHighDateTime=0x1d7046d, ftLastWriteTime.dwLowDateTime=0x696efe32, ftLastWriteTime.dwHighDateTime=0x1d7046d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.931] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5781bc17, ftCreationTime.dwHighDateTime=0x1d7046d, ftLastAccessTime.dwLowDateTime=0x3b96fdbf, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3b96fdbf, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0", cAlternateFileName="")) returned 1
	[0231.931] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x696efe32, ftCreationTime.dwHighDateTime=0x1d7046d, ftLastAccessTime.dwLowDateTime=0xa304b1cc, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0xa304b1cc, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OTele", cAlternateFileName="")) returned 1
	[0231.931] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.931] FindClose (in: hFindFile=0x79fa68 | out: hFindFile=0x79fa68) returned 1
	[0231.931] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0"), fInfoLevelId=0x0, lpFileInformation=0x1281dea8 | out: lpFileInformation=0x1281dea8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5781bc17, ftCreationTime.dwHighDateTime=0x1d7046d, ftLastAccessTime.dwLowDateTime=0x3b96fdbf, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3b96fdbf, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0231.931] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.931] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5781bc17, ftCreationTime.dwHighDateTime=0x1d7046d, ftLastAccessTime.dwLowDateTime=0x3b96fdbf, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3b96fdbf, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9a8
	[0231.931] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5781bc17, ftCreationTime.dwHighDateTime=0x1d7046d, ftLastAccessTime.dwLowDateTime=0x3b96fdbf, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3b96fdbf, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.932] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaba9333c, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xaba9333c, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x6b3f26a7, ftLastWriteTime.dwHighDateTime=0x1d7b058, nFileSizeHigh=0x0, nFileSizeLow=0x13bd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="excel.exe_Rules.xml", cAlternateFileName="EXCELE~1.XML")) returned 1
	[0231.932] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cb2b47, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc8cb2b47, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc8cb2b47, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x11d02, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaccess.exe_Rules.xml", cAlternateFileName="MSACCE~1.XML")) returned 1
	[0231.932] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20bb7bfa, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x20bb7bfa, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x20bb8ff9, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x4050, dwReserved0=0x0, dwReserved1=0x0, cFileName="officec2rclient.exe_Rules.xml", cAlternateFileName="OFFICE~2.XML")) returned 1
	[0231.932] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cfcf021, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1cfcf021, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1cfcf021, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x4050, dwReserved0=0x0, dwReserved1=0x0, cFileName="officeclicktorun.exe_Rules.xml", cAlternateFileName="OFFICE~1.XML")) returned 1
	[0231.932] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b96fdbf, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x3b96fdbf, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3b96fdbf, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x14a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="outlook.exe_Rules.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1
	[0231.932] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb50ff70b, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb50ff70b, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb50ff70b, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x12c3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="powerpnt.exe_Rules.xml", cAlternateFileName="POWERP~1.XML")) returned 1
	[0231.932] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5781bc17, ftCreationTime.dwHighDateTime=0x1d7046d, ftLastAccessTime.dwLowDateTime=0x5781bc17, ftLastAccessTime.dwHighDateTime=0x1d7046d, ftLastWriteTime.dwLowDateTime=0x9d540b29, ftLastWriteTime.dwHighDateTime=0x1d70502, nFileSizeHigh=0x0, nFileSizeLow=0x4d2aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe_Rules.xml", cAlternateFileName="SETUPE~1.XML")) returned 1
	[0231.932] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18417d03, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x18417d03, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1841a3b9, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x4050, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup32.exe_Rules.xml", cAlternateFileName="SETUP3~1.XML")) returned 1
	[0231.932] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fe741f9, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1fe741f9, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1fe741f9, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebServiceCache", cAlternateFileName="WEBSER~1")) returned 1
	[0231.932] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fa7c66, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82fa7c66, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82fa7c66, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x197d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="winword.exe_Rules.xml", cAlternateFileName="WINWOR~1.XML")) returned 1
	[0231.932] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.932] FindClose (in: hFindFile=0x79f9a8 | out: hFindFile=0x79f9a8) returned 1
	[0231.932] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache"), fInfoLevelId=0x0, lpFileInformation=0x126e0288 | out: lpFileInformation=0x126e0288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fe741f9, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1fe741f9, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1fe741f9, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.933] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.933] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fe741f9, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1fe741f9, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1fe741f9, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ff68
	[0231.933] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fe741f9, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1fe741f9, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1fe741f9, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.933] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fe741f9, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1fe741f9, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x82347855, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AllUsers", cAlternateFileName="")) returned 1
	[0231.933] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.934] FindClose (in: hFindFile=0x79ff68 | out: hFindFile=0x79ff68) returned 1
	[0231.934] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers"), fInfoLevelId=0x0, lpFileInformation=0x126e0328 | out: lpFileInformation=0x126e0328*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fe741f9, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x82347855, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82347855, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.934] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.934] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\*", lpFindFileData=0x12423724 | out: lpFindFileData=0x12423724*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fe741f9, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x82347855, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82347855, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f8e8
	[0231.934] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fe741f9, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x82347855, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82347855, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.934] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82347855, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc8b05ffa, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc8b05ffa, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="binaries.templates.cdn.office.net", cAlternateFileName="BINARI~1.NET")) returned 1
	[0231.934] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fe741f9, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x5d374b6c, ftLastAccessTime.dwHighDateTime=0x1d7b058, ftLastWriteTime.dwLowDateTime=0x5d38e5d2, ftLastWriteTime.dwHighDateTime=0x1d7b058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="officeclient.microsoft.com", cAlternateFileName="OFFICE~1.COM")) returned 1
	[0231.934] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423744 | out: lpFindFileData=0x12423744*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0231.934] FindClose (in: hFindFile=0x79f8e8 | out: hFindFile=0x79f8e8) returned 1
	[0231.934] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net"), fInfoLevelId=0x0, lpFileInformation=0x126e0418 | out: lpFileInformation=0x126e0418*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82347855, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x5d4d30d2, ftLastAccessTime.dwHighDateTime=0x1d7b058, ftLastWriteTime.dwLowDateTime=0x5d4d30d2, ftLastWriteTime.dwHighDateTime=0x1d7b058, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0231.936] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0231.936] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\*", lpFindFileData=0x124236c0 | out: lpFindFileData=0x124236c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82347855, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x5d4d30d2, ftLastAccessTime.dwHighDateTime=0x1d7b058, ftLastWriteTime.dwLowDateTime=0x5d4d30d2, ftLastWriteTime.dwHighDateTime=0x1d7b058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fe28
	[0232.084] SetEvent (hEvent=0x168) returned 1
	[0232.084] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82347855, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x5d4d30d2, ftLastAccessTime.dwHighDateTime=0x1d7b058, ftLastWriteTime.dwLowDateTime=0x5d4d30d2, ftLastWriteTime.dwHighDateTime=0x1d7b058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0232.212] SetEvent (hEvent=0x168) returned 1
	[0232.212] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4e03b9e, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb4e03b9e, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb4e03b9e, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0xaff, dwReserved0=0x0, dwReserved1=0x0, cFileName="033A5E2E-F52B-4392-A855-EB1B603352F7", cAlternateFileName="033A5E~1")) returned 1
	[0232.212] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabb2bc31, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xabb2bc31, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xabb2d062, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x2b3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="0431222D-6E07-4867-BED3-3672DEAE6648", cAlternateFileName="043122~1")) returned 1
	[0232.212] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82ca303e, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82ca303e, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82ca303e, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x3be8, dwReserved0=0x0, dwReserved1=0x0, cFileName="05BDDC85-1B21-40A1-AD47-D6AD70518BA9", cAlternateFileName="05BDDC~1")) returned 1
	[0232.212] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8494d29, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc8494d29, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc8496206, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0xa96, dwReserved0=0x0, dwReserved1=0x0, cFileName="08DD48C4-4C22-48B1-8676-03955502381B", cAlternateFileName="08DD48~1")) returned 1
	[0232.212] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82b5398c, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82b5398c, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82b54d17, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x5ba7, dwReserved0=0x0, dwReserved1=0x0, cFileName="0BB3D81C-E14E-48A8-9E37-42996BD92C45", cAlternateFileName="0BB3D8~1")) returned 1
	[0232.212] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82c946be, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82c946be, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82c946be, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x14b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="0FFEDD2D-75F1-4D91-8A68-D07299430A95", cAlternateFileName="0FFEDD~1")) returned 1
	[0232.212] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82b28e4c, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82b28e4c, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82b28e4c, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x2426, dwReserved0=0x0, dwReserved1=0x0, cFileName="136081F3-73A0-4FF7-B28C-3470DE19BBF1", cAlternateFileName="136081~1")) returned 1
	[0232.212] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84be520, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc84be520, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc84bf915, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x1193, dwReserved0=0x0, dwReserved1=0x0, cFileName="149EF4F4-82E0-49BF-99DB-2EA4A1B5FD74", cAlternateFileName="149EF4~1")) returned 1
	[0232.212] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4d9ad45, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb4d9ad45, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb4d9ad45, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x812e, dwReserved0=0x0, dwReserved1=0x0, cFileName="15A1ED83-2E0D-4739-B941-AD1703A61A1C", cAlternateFileName="15A1ED~1")) returned 1
	[0232.212] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabb6b457, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xabb6b457, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xabb6b457, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x1bc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1604DFC0-3711-40F4-A312-5716BCF1C705", cAlternateFileName="1604DF~1")) returned 1
	[0232.212] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc860f3fd, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc860f3fd, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc86107a9, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0xc69, dwReserved0=0x0, dwReserved1=0x0, cFileName="1A8199FD-6A7F-407E-BA91-64E3C5A3EECB", cAlternateFileName="1A8199~1")) returned 1
	[0232.212] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab9f20e3, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xab9f20e3, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xab9f20e3, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x80bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="1E1D102B-3E38-42D5-97CF-F307C2E53FA9", cAlternateFileName="1E1D10~1")) returned 1
	[0232.212] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabb5b5f4, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xabb5b5f4, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xabb5dbcb, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x2084, dwReserved0=0x0, dwReserved1=0x0, cFileName="21676BA8-01CC-477B-8C3D-258E774A1164", cAlternateFileName="21676B~1")) returned 1
	[0232.212] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4efb86e, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb4efb86e, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb4efcbea, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x6b94, dwReserved0=0x0, dwReserved1=0x0, cFileName="23BF312F-1BE9-4411-BFF6-FA34461B5139", cAlternateFileName="23BF31~1")) returned 1
	[0232.213] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab9d4b04, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xab9d4b04, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xab9d5f98, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x3bcb, dwReserved0=0x0, dwReserved1=0x0, cFileName="23FB071D-E9EC-4666-A0CB-7D6993563959", cAlternateFileName="23FB07~1")) returned 1
	[0232.213] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a897d3, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc8a897d3, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc8a8ab48, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x1fdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="292EB0B0-CEFD-4710-B2BC-B6DEBB11376B", cAlternateFileName="292EB0~1")) returned 1
	[0232.213] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb49f4ff8, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb49f4ff8, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb49f62e6, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x2fff, dwReserved0=0x0, dwReserved1=0x0, cFileName="29A9F36E-19FA-474E-A88B-9EE7C96DCBA2", cAlternateFileName="29A9F3~1")) returned 1
	[0232.213] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb502ff48, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb502ff48, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb503124f, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x666c, dwReserved0=0x0, dwReserved1=0x0, cFileName="2A756DDE-34E8-4DC2-855B-44682E9D4845", cAlternateFileName="2A756D~1")) returned 1
	[0232.213] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb49fb16b, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb49fb16b, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb49fb16b, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x4af4, dwReserved0=0x0, dwReserved1=0x0, cFileName="2DFAAC69-9C98-47D4-8E3B-6AD109FD232D", cAlternateFileName="2DFAAC~1")) returned 1
	[0232.213] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a80f08, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc8a80f08, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc8a883fc, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x507, dwReserved0=0x0, dwReserved1=0x0, cFileName="2EC88447-26FF-4E32-8D81-5ABC75AE65DB", cAlternateFileName="2EC884~1")) returned 1
	[0232.213] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4ea9c0d, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb4ea9c0d, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb4ea9c0d, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x8b27, dwReserved0=0x0, dwReserved1=0x0, cFileName="33F63883-F0AE-4AB6-B4F0-30BB1951B381", cAlternateFileName="33F638~1")) returned 1
	[0232.213] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82bdad10, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82bdad10, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82bdad10, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x8440, dwReserved0=0x0, dwReserved1=0x0, cFileName="3628527B-53B7-45AD-A6DB-2BB7CCE4B284", cAlternateFileName="362852~1")) returned 1
	[0232.213] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab8e2fcd, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xab8e2fcd, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xab8e2fcd, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x4a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="393DA17C-492D-4E39-93B9-A0EB68F559AE", cAlternateFileName="393DA1~1")) returned 1
	[0232.213] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x829648ac, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x829648ac, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x829648ac, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x63f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="3BA4462F-9DE4-49DE-B3B4-C55DE0BC2436", cAlternateFileName="3BA446~1")) returned 1
	[0232.399] SetEvent (hEvent=0x168) returned 1
	[0232.399] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82c74994, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82c74994, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82c770d1, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x235a, dwReserved0=0x0, dwReserved1=0x0, cFileName="3C5BB25A-C5B4-4565-A1C7-47EA3C32B62B", cAlternateFileName="3C5BB2~1")) returned 1
	[0232.400] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaba3536d, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xaba3536d, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xaba3536d, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x1a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="3E543A2A-53F0-47F8-9F51-FF1B9D7890AD", cAlternateFileName="3E543A~1")) returned 1
	[0232.400] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d79e71, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82d79e71, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82d7b256, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x2aee, dwReserved0=0x0, dwReserved1=0x0, cFileName="3FFAE199-5C90-4A06-AA16-96546E1FDFD1", cAlternateFileName="3FFAE1~1")) returned 1
	[0232.400] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82960d16, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82960d16, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82962239, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x341b, dwReserved0=0x0, dwReserved1=0x0, cFileName="406E18D5-EC82-4FCC-82A8-2D148D067E02", cAlternateFileName="406E18~1")) returned 1
	[0232.400] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84c0c6a, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc84c0c6a, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc84c20aa, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x97c, dwReserved0=0x0, dwReserved1=0x0, cFileName="43F05AC3-1345-4232-9173-E5AEAF85BF98", cAlternateFileName="43F05A~1")) returned 1
	[0232.400] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc847f2b8, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc847f2b8, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc847f2b8, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0xcec, dwReserved0=0x0, dwReserved1=0x0, cFileName="4BCC7FD4-613C-4B15-9DBE-908105E4ED54", cAlternateFileName="4BCC7F~1")) returned 1
	[0232.400] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x828dd133, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x828dd133, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x828dd133, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x4825, dwReserved0=0x0, dwReserved1=0x0, cFileName="4CA2E262-1B83-48AB-BA5B-2A052BA6485B", cAlternateFileName="4CA2E2~1")) returned 1
	[0232.400] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5074490, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb5074490, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb5074490, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x2171, dwReserved0=0x0, dwReserved1=0x0, cFileName="4F183948-A9C6-492E-8CD3-78756D7F03CF", cAlternateFileName="4F1839~1")) returned 1
	[0232.400] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84da778, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc84da778, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc84db9c3, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x438, dwReserved0=0x0, dwReserved1=0x0, cFileName="4F9F0AEF-1D87-4F0C-910C-0ADC7E172289", cAlternateFileName="4F9F0A~1")) returned 1
	[0232.400] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4b06560, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb4b06560, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb4b07902, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x2c73, dwReserved0=0x0, dwReserved1=0x0, cFileName="511B4AE9-CD73-4ED0-A899-602921314CEC", cAlternateFileName="511B4A~1")) returned 1
	[0232.400] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabaab9cf, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xabaab9cf, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xabaacd7e, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x1cab, dwReserved0=0x0, dwReserved1=0x0, cFileName="580DF0A8-7B09-4BAC-BD6B-1096E9BDA073", cAlternateFileName="580DF0~1")) returned 1
	[0232.400] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82b14252, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82b14252, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82b14252, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x23c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="5B268694-C256-497F-B57F-0B2D793CBA10", cAlternateFileName="5B2686~1")) returned 1
	[0232.400] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4cefda3, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb4cefda3, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb4cefda3, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x5128, dwReserved0=0x0, dwReserved1=0x0, cFileName="5B7E87C2-FC64-4F92-8D24-251DE6AF63C0", cAlternateFileName="5B7E87~1")) returned 1
	[0232.400] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab9fe464, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xab9fe464, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xab9fe464, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x487e, dwReserved0=0x0, dwReserved1=0x0, cFileName="5F3382B8-AFBF-4FEA-8B79-20898FE63A3D", cAlternateFileName="5F3382~1")) returned 1
	[0232.400] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabbd098a, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xabbd098a, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xabbd1d40, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x242b, dwReserved0=0x0, dwReserved1=0x0, cFileName="6B8DE11F-3D5A-48C6-81AA-977DA661E2C5", cAlternateFileName="6B8DE1~1")) returned 1
	[0232.401] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82cfd55e, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82cfd55e, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82d37ecc, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x7b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="6E234531-C2BA-4F08-BC11-2ECA97A03E84", cAlternateFileName="6E2345~1")) returned 1
	[0232.401] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc853d4e0, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc853d4e0, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc85646d8, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0xbec, dwReserved0=0x0, dwReserved1=0x0, cFileName="6E4EC81F-6A7B-442E-91B3-150ED476524B", cAlternateFileName="6E4EC8~1")) returned 1
	[0232.401] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82b980a1, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82b980a1, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82b99326, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x401d, dwReserved0=0x0, dwReserved1=0x0, cFileName="6E87FFA6-570D-4F3C-832C-0F0ED39D0DE2", cAlternateFileName="6E87FF~1")) returned 1
	[0232.401] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4cf260c, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb4cf260c, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb4cf260c, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0xb156, dwReserved0=0x0, dwReserved1=0x0, cFileName="719CA5E5-2264-4D2B-B1BC-1979AE2F8481", cAlternateFileName="719CA5~1")) returned 1
	[0232.401] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8b05ffa, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc8b05ffa, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc8b07378, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x60e, dwReserved0=0x0, dwReserved1=0x0, cFileName="73949334-7885-4202-9F99-AD59E8565AB6", cAlternateFileName="739493~1")) returned 1
	[0232.401] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc882d53e, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc882d53e, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc882e8bd, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x722, dwReserved0=0x0, dwReserved1=0x0, cFileName="7600EED5-3234-4650-8D9A-67C39E956D87", cAlternateFileName="7600EE~1")) returned 1
	[0232.401] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabae28fb, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xabae28fb, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xabae3bb5, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x1f8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="7C92FCEB-66EB-471D-9BA1-BDEE0E12FD94", cAlternateFileName="7C92FC~1")) returned 1
	[0232.401] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82b59afa, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82b59afa, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82b59afa, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x98d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="7F96D0A4-ECC8-4300-A3C4-8C2B5918BBAA", cAlternateFileName="7F96D0~1")) returned 1
	[0232.401] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a05a2f, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc8a05a2f, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc8a06e54, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0xc11, dwReserved0=0x0, dwReserved1=0x0, cFileName="806760D6-0D46-4F0D-9A2A-5619D868318C", cAlternateFileName="806760~1")) returned 1
	[0232.845] SetEvent (hEvent=0x168) returned 1
	[0232.845] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8565b98, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc8565b98, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc8565b98, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x4c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="825BFDEB-777E-4DF1-818C-7CA4FC0D3016", cAlternateFileName="825BFD~1")) returned 1
	[0232.845] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84e7d50, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc84e7d50, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc84e9287, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x9c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="82B38E75-3368-40D2-B1E5-193E0E558D48", cAlternateFileName="82B38E~1")) returned 1
	[0232.845] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaba093e4, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xaba093e4, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xaba093e4, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x507d, dwReserved0=0x0, dwReserved1=0x0, cFileName="8618DFC3-EF76-4235-AA5D-06BEABD6E242", cAlternateFileName="8618DF~1")) returned 1
	[0232.845] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4c2c9d8, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb4c2c9d8, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb4c2c9d8, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x17be, dwReserved0=0x0, dwReserved1=0x0, cFileName="89953CAA-1AB9-4A6E-A488-DFEFC5075387", cAlternateFileName="89953C~1")) returned 1
	[0232.845] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82ac863d, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82ac863d, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82ac9960, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x541f, dwReserved0=0x0, dwReserved1=0x0, cFileName="8EE3590E-CE33-42C6-8250-DF185AF8DAA4", cAlternateFileName="8EE359~1")) returned 1
	[0232.845] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb476eaa3, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb476eaa3, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb476fe6d, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x4c3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="9056E597-0C30-4F42-BA7A-70B004BF042A", cAlternateFileName="9056E5~1")) returned 1
	[0232.845] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb49b7e91, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb49b7e91, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb49b7e91, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x12b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="92D09C47-EFFB-4E54-B85D-797F67B0527C", cAlternateFileName="92D09C~1")) returned 1
	[0232.845] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc848065f, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc848065f, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc84819da, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x3b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="95301B49-34BE-47D5-99D1-1C50A4B80C13", cAlternateFileName="95301B~1")) returned 1
	[0232.845] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabb715e7, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xabb715e7, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xabb715e7, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x372b, dwReserved0=0x0, dwReserved1=0x0, cFileName="95AFB9A8-DEAD-49F6-9234-BEA10973F0CD", cAlternateFileName="95AFB9~1")) returned 1
	[0232.845] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a305e3, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc8a305e3, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc8a7fd33, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x7d42, dwReserved0=0x0, dwReserved1=0x0, cFileName="9639F732-A0F4-4A33-92A0-01330C0BB8C3", cAlternateFileName="9639F7~1")) returned 1
	[0232.845] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc83bbe8a, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc83bbe8a, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc83bd386, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0xd8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="96BAA0E7-CE03-46C0-A45A-8F71ADB9C825", cAlternateFileName="96BAA0~1")) returned 1
	[0232.845] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82b07c5d, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82b07c5d, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82b07c5d, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0xd2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="9A557D1E-5B55-45D0-B83F-66D1CCFBCC32", cAlternateFileName="9A557D~1")) returned 1
	[0232.845] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a15964, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc8a15964, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc8a16c5a, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x0, dwReserved1=0x0, cFileName="9CFC7195-9421-404F-A40A-EEBD8F033365", cAlternateFileName="9CFC71~1")) returned 1
	[0232.845] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabbdccf8, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xabbdccf8, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xabbdccf8, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x135f, dwReserved0=0x0, dwReserved1=0x0, cFileName="A0D2B79B-05BB-4871-8DE6-E766643BD65E", cAlternateFileName="A0D2B7~1")) returned 1
	[0232.845] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabae01a6, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xabae01a6, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xabae01a6, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x108a, dwReserved0=0x0, dwReserved1=0x0, cFileName="A1E234BD-B121-49A0-9B4B-BBF6A832161B", cAlternateFileName="A1E234~1")) returned 1
	[0232.845] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x829ef008, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x829ef008, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x829ef008, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x990a, dwReserved0=0x0, dwReserved1=0x0, cFileName="A2F95592-6A7F-475A-878F-C593DA8BBEDD", cAlternateFileName="A2F955~1")) returned 1
	[0232.845] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82bb0641, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82bb0641, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82bb19b0, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x2c34, dwReserved0=0x0, dwReserved1=0x0, cFileName="A50A8D38-2A06-4EF5-A84C-B00C714F6B16", cAlternateFileName="A50A8D~1")) returned 1
	[0232.846] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc89f5df6, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc89f5df6, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc89f5df6, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0xc70, dwReserved0=0x0, dwReserved1=0x0, cFileName="A5DEC71F-CF32-4AAD-A02A-3B306B7F1FCC", cAlternateFileName="A5DEC7~1")) returned 1
	[0232.846] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb49c69cc, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb49c69cc, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb49c69cc, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x75b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA8B315F-D191-411A-80E8-BBCCCE176DA7", cAlternateFileName="AA8B31~1")) returned 1
	[0232.846] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabac2fca, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xabac2fca, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xabac3f0e, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x14c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ABF009F6-7021-47EC-8025-BE55AD5EBB57", cAlternateFileName="ABF009~1")) returned 1
	[0232.846] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab9c9b2e, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xab9c9b2e, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xab9c9b2e, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x367e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AF769060-9C3B-4F97-8FB8-1EB72198BA39", cAlternateFileName="AF7690~1")) returned 1
	[0232.846] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab9f96f2, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xab9f96f2, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xab9faa6d, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x2132, dwReserved0=0x0, dwReserved1=0x0, cFileName="B1725647-3A36-4C56-9803-89EDCA8238A8", cAlternateFileName="B17256~1")) returned 1
	[0232.846] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c666c7, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc8c666c7, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc8c666c7, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x148c, dwReserved0=0x0, dwReserved1=0x0, cFileName="B20989ED-6B03-4803-ADD0-4360553EC384", cAlternateFileName="B20989~1")) returned 1
	[0232.846] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4df9f3a, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb4df9f3a, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb4df9f3a, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x7cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="B6937276-0D21-44E4-B6A5-2F13F90E1698", cAlternateFileName="B69372~1")) returned 1
	[0233.064] SetEvent (hEvent=0x168) returned 1
	[0233.064] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82cd8b94, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82cd8b94, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82cd8b94, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x5505, dwReserved0=0x0, dwReserved1=0x0, cFileName="B74632A4-B059-4F5A-849D-252172A06A99", cAlternateFileName="B74632~1")) returned 1
	[0233.064] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab9f482a, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xab9f482a, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xab9f482a, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x3888, dwReserved0=0x0, dwReserved1=0x0, cFileName="BB41F806-1043-41B2-9372-8F6E7066247A", cAlternateFileName="BB41F8~1")) returned 1
	[0233.064] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabae635e, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xabae635e, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xabae635e, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x7f46, dwReserved0=0x0, dwReserved1=0x0, cFileName="BFB97937-ABF1-480A-946B-D367067F68C4", cAlternateFileName="BFB979~1")) returned 1
	[0233.064] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab9c1295, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xab9c1295, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xab9c1295, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x3c73, dwReserved0=0x0, dwReserved1=0x0, cFileName="C0B5FEFE-C6C1-439E-B89D-E39A2031E527", cAlternateFileName="C0B5FE~1")) returned 1
	[0233.064] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb474db8b, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb474db8b, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb474ef1c, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x1ffd, dwReserved0=0x0, dwReserved1=0x0, cFileName="C3DC5BD1-4AB1-4BDD-ACB0-FCCA65EE3D2A", cAlternateFileName="C3DC5B~1")) returned 1
	[0233.064] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab9cfd00, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xab9cfd00, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xab9d23da, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x2f7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C4181E33-213A-4456-87BA-15FD83064187", cAlternateFileName="C4181E~1")) returned 1
	[0233.064] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4974447, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb4974447, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb49759af, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x2bd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="C52B4A7C-C9FD-485A-8375-F97F3A24C1BA", cAlternateFileName="C52B4A~1")) returned 1
	[0233.064] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc83e6a80, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc83e6a80, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc83e6a80, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x1167, dwReserved0=0x0, dwReserved1=0x0, cFileName="C7B65EEC-91E0-4362-AC18-80B09C3C95AC", cAlternateFileName="C7B65E~1")) returned 1
	[0233.064] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x829b15f8, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x829b15f8, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x829b5109, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x634f, dwReserved0=0x0, dwReserved1=0x0, cFileName="C85A59C5-2B02-4194-AB2C-0E6E2B6031A0", cAlternateFileName="C85A59~1")) returned 1
	[0233.064] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4e2fa78, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb4e2fa78, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb4e30e51, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x5543, dwReserved0=0x0, dwReserved1=0x0, cFileName="C9B26F48-B9B2-452D-9E4F-BD539A769B1B", cAlternateFileName="C9B26F~1")) returned 1
	[0233.064] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabad3e63, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xabad3e63, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xabad3e63, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x1a54, dwReserved0=0x0, dwReserved1=0x0, cFileName="CA094F8F-D41E-43AB-8A32-1A2F34851250", cAlternateFileName="CA094F~1")) returned 1
	[0233.064] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8293e9d0, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x8293e9d0, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x8293ff31, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x1e19, dwReserved0=0x0, dwReserved1=0x0, cFileName="CCB1B3FC-5E0C-4241-ABC1-CA67B6C56947", cAlternateFileName="CCB1B3~1")) returned 1
	[0233.064] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4d94a38, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb4d94a38, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb4d94a38, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x422e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CFC05EA4-9A97-47D5-9459-FB2F94EE79CC", cAlternateFileName="CFC05E~1")) returned 1
	[0233.064] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4d89a80, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb4d89a80, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb4d8ae10, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x595d, dwReserved0=0x0, dwReserved1=0x0, cFileName="D03B54D7-2F02-4F26-B245-6759FD3E5356", cAlternateFileName="D03B54~1")) returned 1
	[0233.065] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab9d990d, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xab9d990d, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xab9ee668, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x4c5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="D1658A87-36B4-4565-B36F-CEF71FFC7033", cAlternateFileName="D1658A~1")) returned 1
	[0233.065] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82c85c72, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82c85c72, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82c8700a, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x3894, dwReserved0=0x0, dwReserved1=0x0, cFileName="D69FD789-7AAA-4B6A-86DB-6AD5F309B97F", cAlternateFileName="D69FD7~1")) returned 1
	[0233.065] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4e43432, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb4e43432, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb4e43432, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x6f72, dwReserved0=0x0, dwReserved1=0x0, cFileName="D7F62263-4202-4285-AB58-35DFBBB7899C", cAlternateFileName="D7F622~1")) returned 1
	[0233.065] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc856808a, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc856808a, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc856808a, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0xfe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="DB4F9AB3-289C-4C85-93DC-C7725673E79B", cAlternateFileName="DB4F9A~1")) returned 1
	[0233.065] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d69f78, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82d69f78, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82d69f78, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x2913, dwReserved0=0x0, dwReserved1=0x0, cFileName="DC2A3CBD-DDE4-4C82-98B2-97C578971471", cAlternateFileName="DC2A3C~1")) returned 1
	[0233.065] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc89439d3, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc89439d3, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc89439d3, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x2516, dwReserved0=0x0, dwReserved1=0x0, cFileName="E2B74C9D-38F9-4AF3-849B-6F6ED185FFC9", cAlternateFileName="E2B74C~1")) returned 1
	[0233.065] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4e4e325, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb4e4e325, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb4e4f6b9, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0xa99, dwReserved0=0x0, dwReserved1=0x0, cFileName="E36912C5-9C2D-452F-95F8-CFA1FC049148", cAlternateFileName="E36912~1")) returned 1
	[0233.065] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8850b3e, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc8850b3e, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc8850b3e, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x38f, dwReserved0=0x0, dwReserved1=0x0, cFileName="E457C019-B991-4CCC-8425-CCD48E271DFC", cAlternateFileName="E457C0~1")) returned 1
	[0233.065] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4e928f1, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb4e928f1, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb4e93c87, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x1f40, dwReserved0=0x0, dwReserved1=0x0, cFileName="E64AA1EE-3ABD-40DD-9A7A-E7E891151C82", cAlternateFileName="E64AA1~1")) returned 1
	[0233.065] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82bd5ee3, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82bd5ee3, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82bd85f4, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x3380, dwReserved0=0x0, dwReserved1=0x0, cFileName="E8B41E01-FE51-4F72-9829-70D724467D17", cAlternateFileName="E8B41E~1")) returned 1
	[0233.065] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabb679a6, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xabb679a6, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xabb679a6, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x292e, dwReserved0=0x0, dwReserved1=0x0, cFileName="EA6554FC-7DB2-4685-948E-52402E811540", cAlternateFileName="EA6554~1")) returned 1
	[0233.065] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8424f42, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc8424f42, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc8427531, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x153e, dwReserved0=0x0, dwReserved1=0x0, cFileName="F0A28B79-40AC-459C-968D-4F68E9798715", cAlternateFileName="F0A28B~1")) returned 1
	[0233.065] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x829bd95b, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x829bd95b, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x829bef86, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x7629, dwReserved0=0x0, dwReserved1=0x0, cFileName="F192A1E6-5284-47FF-83DA-D65DCB35FC9F", cAlternateFileName="F192A1~1")) returned 1
	[0233.065] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaba00b7d, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xaba00b7d, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xaba00b7d, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x18bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="F31F431A-DF78-48BC-9A30-E15E83A7DF3B", cAlternateFileName="F31F43~1")) returned 1
	[0233.065] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d4df95, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82d4df95, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82d4df95, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x1362, dwReserved0=0x0, dwReserved1=0x0, cFileName="F8C7174F-633A-4FA0-9187-67153391986A", cAlternateFileName="F8C717~1")) returned 1
	[0233.065] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4c2675f, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb4c2675f, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb4c2675f, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x447b, dwReserved0=0x0, dwReserved1=0x0, cFileName="F97CF839-8F66-44ED-8DB4-5A4D6D408F2E", cAlternateFileName="F97CF8~1")) returned 1
	[0233.065] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb49ec6e1, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb49ec6e1, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb49eda26, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x486e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FDAC0094-8C06-4BE5-856F-0DB7BB8F69B9", cAlternateFileName="FDAC00~1")) returned 1
	[0233.065] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.065] FindClose (in: hFindFile=0x79fe28 | out: hFindFile=0x79fe28) returned 1
	[0233.067] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\033A5E2E-F52B-4392-A855-EB1B603352F7" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\033a5e2e-f52b-4392-a855-eb1b603352f7"), fInfoLevelId=0x0, lpFileInformation=0x126e84b8 | out: lpFileInformation=0x126e84b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4e03b9e, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb4e03b9e, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb4e03b9e, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0xaff)) returned 1
	[0233.072] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\0431222D-6E07-4867-BED3-3672DEAE6648" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\0431222d-6e07-4867-bed3-3672deae6648"), fInfoLevelId=0x0, lpFileInformation=0x126e8508 | out: lpFileInformation=0x126e8508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabb2bc31, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xabb2bc31, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xabb2d062, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x2b3a)) returned 1
	[0233.073] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\05BDDC85-1B21-40A1-AD47-D6AD70518BA9" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\05bddc85-1b21-40a1-ad47-d6ad70518ba9"), fInfoLevelId=0x0, lpFileInformation=0x126e8558 | out: lpFileInformation=0x126e8558*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82ca303e, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82ca303e, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82ca303e, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x3be8)) returned 1
	[0233.075] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\08DD48C4-4C22-48B1-8676-03955502381B" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\08dd48c4-4c22-48b1-8676-03955502381b"), fInfoLevelId=0x0, lpFileInformation=0x126e85a8 | out: lpFileInformation=0x126e85a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8494d29, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc8494d29, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc8496206, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0xa96)) returned 1
	[0233.081] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\0BB3D81C-E14E-48A8-9E37-42996BD92C45" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\0bb3d81c-e14e-48a8-9e37-42996bd92c45"), fInfoLevelId=0x0, lpFileInformation=0x126e85f8 | out: lpFileInformation=0x126e85f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82b5398c, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82b5398c, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82b54d17, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x5ba7)) returned 1
	[0233.082] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\0FFEDD2D-75F1-4D91-8A68-D07299430A95" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\0ffedd2d-75f1-4d91-8a68-d07299430a95"), fInfoLevelId=0x0, lpFileInformation=0x126e8648 | out: lpFileInformation=0x126e8648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82c946be, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82c946be, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82c946be, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x14b50)) returned 1
	[0233.082] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\136081F3-73A0-4FF7-B28C-3470DE19BBF1" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\136081f3-73a0-4ff7-b28c-3470de19bbf1"), fInfoLevelId=0x0, lpFileInformation=0x126e8698 | out: lpFileInformation=0x126e8698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82b28e4c, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82b28e4c, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82b28e4c, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x2426)) returned 1
	[0233.083] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\149EF4F4-82E0-49BF-99DB-2EA4A1B5FD74" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\149ef4f4-82e0-49bf-99db-2ea4a1b5fd74"), fInfoLevelId=0x0, lpFileInformation=0x126e86e8 | out: lpFileInformation=0x126e86e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84be520, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc84be520, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc84bf915, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x1193)) returned 1
	[0233.090] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\15A1ED83-2E0D-4739-B941-AD1703A61A1C" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\15a1ed83-2e0d-4739-b941-ad1703a61a1c"), fInfoLevelId=0x0, lpFileInformation=0x126e8738 | out: lpFileInformation=0x126e8738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4d9ad45, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb4d9ad45, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb4d9ad45, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x812e)) returned 1
	[0233.090] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\1604DFC0-3711-40F4-A312-5716BCF1C705" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\1604dfc0-3711-40f4-a312-5716bcf1c705"), fInfoLevelId=0x0, lpFileInformation=0x126e8788 | out: lpFileInformation=0x126e8788*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabb6b457, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xabb6b457, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xabb6b457, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x1bc0)) returned 1
	[0233.090] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\1A8199FD-6A7F-407E-BA91-64E3C5A3EECB" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\1a8199fd-6a7f-407e-ba91-64e3c5a3eecb"), fInfoLevelId=0x0, lpFileInformation=0x126e87d8 | out: lpFileInformation=0x126e87d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc860f3fd, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc860f3fd, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc86107a9, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0xc69)) returned 1
	[0233.092] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\1E1D102B-3E38-42D5-97CF-F307C2E53FA9" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\1e1d102b-3e38-42d5-97cf-f307c2e53fa9"), fInfoLevelId=0x0, lpFileInformation=0x126e8828 | out: lpFileInformation=0x126e8828*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab9f20e3, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xab9f20e3, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xab9f20e3, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x80bb)) returned 1
	[0233.092] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\21676BA8-01CC-477B-8C3D-258E774A1164" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\21676ba8-01cc-477b-8c3d-258e774a1164"), fInfoLevelId=0x0, lpFileInformation=0x126e8878 | out: lpFileInformation=0x126e8878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabb5b5f4, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xabb5b5f4, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xabb5dbcb, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x2084)) returned 1
	[0233.092] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\23BF312F-1BE9-4411-BFF6-FA34461B5139" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\23bf312f-1be9-4411-bff6-fa34461b5139"), fInfoLevelId=0x0, lpFileInformation=0x126e88c8 | out: lpFileInformation=0x126e88c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4efb86e, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb4efb86e, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb4efcbea, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x6b94)) returned 1
	[0233.093] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\23FB071D-E9EC-4666-A0CB-7D6993563959" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\23fb071d-e9ec-4666-a0cb-7d6993563959"), fInfoLevelId=0x0, lpFileInformation=0x126e8918 | out: lpFileInformation=0x126e8918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab9d4b04, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xab9d4b04, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xab9d5f98, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x3bcb)) returned 1
	[0233.097] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\292EB0B0-CEFD-4710-B2BC-B6DEBB11376B" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\292eb0b0-cefd-4710-b2bc-b6debb11376b"), fInfoLevelId=0x0, lpFileInformation=0x126e8968 | out: lpFileInformation=0x126e8968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a897d3, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc8a897d3, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc8a8ab48, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x1fdd)) returned 1
	[0233.100] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\29A9F36E-19FA-474E-A88B-9EE7C96DCBA2" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\29a9f36e-19fa-474e-a88b-9ee7c96dcba2"), fInfoLevelId=0x0, lpFileInformation=0x126e89b8 | out: lpFileInformation=0x126e89b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb49f4ff8, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb49f4ff8, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb49f62e6, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x2fff)) returned 1
	[0233.101] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\2A756DDE-34E8-4DC2-855B-44682E9D4845" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\2a756dde-34e8-4dc2-855b-44682e9d4845"), fInfoLevelId=0x0, lpFileInformation=0x126e8a08 | out: lpFileInformation=0x126e8a08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb502ff48, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb502ff48, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb503124f, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x666c)) returned 1
	[0233.102] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\2DFAAC69-9C98-47D4-8E3B-6AD109FD232D" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\2dfaac69-9c98-47d4-8e3b-6ad109fd232d"), fInfoLevelId=0x0, lpFileInformation=0x126e8a58 | out: lpFileInformation=0x126e8a58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb49fb16b, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb49fb16b, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb49fb16b, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x4af4)) returned 1
	[0233.102] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\2EC88447-26FF-4E32-8D81-5ABC75AE65DB" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\2ec88447-26ff-4e32-8d81-5abc75ae65db"), fInfoLevelId=0x0, lpFileInformation=0x126e8aa8 | out: lpFileInformation=0x126e8aa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a80f08, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc8a80f08, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc8a883fc, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x507)) returned 1
	[0233.103] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\33F63883-F0AE-4AB6-B4F0-30BB1951B381" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\33f63883-f0ae-4ab6-b4f0-30bb1951b381"), fInfoLevelId=0x0, lpFileInformation=0x126e8af8 | out: lpFileInformation=0x126e8af8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4ea9c0d, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb4ea9c0d, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb4ea9c0d, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x8b27)) returned 1
	[0233.104] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\3628527B-53B7-45AD-A6DB-2BB7CCE4B284" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\3628527b-53b7-45ad-a6db-2bb7cce4b284"), fInfoLevelId=0x0, lpFileInformation=0x126e8b48 | out: lpFileInformation=0x126e8b48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82bdad10, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82bdad10, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82bdad10, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x8440)) returned 1
	[0233.110] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\393DA17C-492D-4E39-93B9-A0EB68F559AE" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\393da17c-492d-4e39-93b9-a0eb68f559ae"), fInfoLevelId=0x0, lpFileInformation=0x126e8b98 | out: lpFileInformation=0x126e8b98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab8e2fcd, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xab8e2fcd, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xab8e2fcd, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x4a91)) returned 1
	[0233.110] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\3BA4462F-9DE4-49DE-B3B4-C55DE0BC2436" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\3ba4462f-9de4-49de-b3b4-c55de0bc2436"), fInfoLevelId=0x0, lpFileInformation=0x126e8be8 | out: lpFileInformation=0x126e8be8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x829648ac, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x829648ac, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x829648ac, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x63f1)) returned 1
	[0233.111] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\3C5BB25A-C5B4-4565-A1C7-47EA3C32B62B" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\3c5bb25a-c5b4-4565-a1c7-47ea3c32b62b"), fInfoLevelId=0x0, lpFileInformation=0x126e8c38 | out: lpFileInformation=0x126e8c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82c74994, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82c74994, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82c770d1, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x235a)) returned 1
	[0233.111] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\3E543A2A-53F0-47F8-9F51-FF1B9D7890AD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\3e543a2a-53f0-47f8-9f51-ff1b9d7890ad"), fInfoLevelId=0x0, lpFileInformation=0x126e8c88 | out: lpFileInformation=0x126e8c88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaba3536d, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xaba3536d, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xaba3536d, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x1a3b)) returned 1
	[0233.112] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\3FFAE199-5C90-4A06-AA16-96546E1FDFD1" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\3ffae199-5c90-4a06-aa16-96546e1fdfd1"), fInfoLevelId=0x0, lpFileInformation=0x126e8cd8 | out: lpFileInformation=0x126e8cd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d79e71, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82d79e71, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82d7b256, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x2aee)) returned 1
	[0233.116] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\406E18D5-EC82-4FCC-82A8-2D148D067E02" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\406e18d5-ec82-4fcc-82a8-2d148d067e02"), fInfoLevelId=0x0, lpFileInformation=0x126e8d28 | out: lpFileInformation=0x126e8d28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82960d16, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82960d16, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82962239, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x341b)) returned 1
	[0233.116] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\43F05AC3-1345-4232-9173-E5AEAF85BF98" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\43f05ac3-1345-4232-9173-e5aeaf85bf98"), fInfoLevelId=0x0, lpFileInformation=0x126e8d78 | out: lpFileInformation=0x126e8d78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84c0c6a, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc84c0c6a, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc84c20aa, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x97c)) returned 1
	[0233.117] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\4BCC7FD4-613C-4B15-9DBE-908105E4ED54" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\4bcc7fd4-613c-4b15-9dbe-908105e4ed54"), fInfoLevelId=0x0, lpFileInformation=0x126e8dc8 | out: lpFileInformation=0x126e8dc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc847f2b8, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc847f2b8, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc847f2b8, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0xcec)) returned 1
	[0233.117] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\4CA2E262-1B83-48AB-BA5B-2A052BA6485B" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\4ca2e262-1b83-48ab-ba5b-2a052ba6485b"), fInfoLevelId=0x0, lpFileInformation=0x126e8e18 | out: lpFileInformation=0x126e8e18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x828dd133, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x828dd133, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x828dd133, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x4825)) returned 1
	[0233.117] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\4F183948-A9C6-492E-8CD3-78756D7F03CF" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\4f183948-a9c6-492e-8cd3-78756d7f03cf"), fInfoLevelId=0x0, lpFileInformation=0x126e8e68 | out: lpFileInformation=0x126e8e68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5074490, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb5074490, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb5074490, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x2171)) returned 1
	[0233.118] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\4F9F0AEF-1D87-4F0C-910C-0ADC7E172289" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\4f9f0aef-1d87-4f0c-910c-0adc7e172289"), fInfoLevelId=0x0, lpFileInformation=0x126e8eb8 | out: lpFileInformation=0x126e8eb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84da778, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc84da778, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc84db9c3, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x438)) returned 1
	[0233.118] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\511B4AE9-CD73-4ED0-A899-602921314CEC" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\511b4ae9-cd73-4ed0-a899-602921314cec"), fInfoLevelId=0x0, lpFileInformation=0x126e8f08 | out: lpFileInformation=0x126e8f08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4b06560, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb4b06560, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb4b07902, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x2c73)) returned 1
	[0233.118] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\580DF0A8-7B09-4BAC-BD6B-1096E9BDA073" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\580df0a8-7b09-4bac-bd6b-1096e9bda073"), fInfoLevelId=0x0, lpFileInformation=0x126e8f58 | out: lpFileInformation=0x126e8f58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabaab9cf, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xabaab9cf, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xabaacd7e, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x1cab)) returned 1
	[0233.119] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\5B268694-C256-497F-B57F-0B2D793CBA10" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\5b268694-c256-497f-b57f-0b2d793cba10"), fInfoLevelId=0x0, lpFileInformation=0x126e8fa8 | out: lpFileInformation=0x126e8fa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82b14252, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82b14252, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82b14252, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x23c3)) returned 1
	[0233.119] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\5B7E87C2-FC64-4F92-8D24-251DE6AF63C0" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\5b7e87c2-fc64-4f92-8d24-251de6af63c0"), fInfoLevelId=0x0, lpFileInformation=0x126e8ff8 | out: lpFileInformation=0x126e8ff8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4cefda3, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb4cefda3, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb4cefda3, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x5128)) returned 1
	[0233.119] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\5F3382B8-AFBF-4FEA-8B79-20898FE63A3D" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\5f3382b8-afbf-4fea-8b79-20898fe63a3d"), fInfoLevelId=0x0, lpFileInformation=0x126e9048 | out: lpFileInformation=0x126e9048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab9fe464, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xab9fe464, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xab9fe464, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x487e)) returned 1
	[0233.120] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\6B8DE11F-3D5A-48C6-81AA-977DA661E2C5" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\6b8de11f-3d5a-48c6-81aa-977da661e2c5"), fInfoLevelId=0x0, lpFileInformation=0x126e9098 | out: lpFileInformation=0x126e9098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabbd098a, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xabbd098a, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xabbd1d40, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x242b)) returned 1
	[0233.120] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\6E234531-C2BA-4F08-BC11-2ECA97A03E84" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\6e234531-c2ba-4f08-bc11-2eca97a03e84"), fInfoLevelId=0x0, lpFileInformation=0x126e90e8 | out: lpFileInformation=0x126e90e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82cfd55e, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82cfd55e, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82d37ecc, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x7b5)) returned 1
	[0233.121] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\6E4EC81F-6A7B-442E-91B3-150ED476524B" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\6e4ec81f-6a7b-442e-91b3-150ed476524b"), fInfoLevelId=0x0, lpFileInformation=0x126e9138 | out: lpFileInformation=0x126e9138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc853d4e0, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc853d4e0, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc85646d8, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0xbec)) returned 1
	[0233.122] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\6E87FFA6-570D-4F3C-832C-0F0ED39D0DE2" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\6e87ffa6-570d-4f3c-832c-0f0ed39d0de2"), fInfoLevelId=0x0, lpFileInformation=0x126e9188 | out: lpFileInformation=0x126e9188*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82b980a1, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82b980a1, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82b99326, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x401d)) returned 1
	[0233.122] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\719CA5E5-2264-4D2B-B1BC-1979AE2F8481" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\719ca5e5-2264-4d2b-b1bc-1979ae2f8481"), fInfoLevelId=0x0, lpFileInformation=0x126e91d8 | out: lpFileInformation=0x126e91d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4cf260c, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb4cf260c, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb4cf260c, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0xb156)) returned 1
	[0233.122] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\73949334-7885-4202-9F99-AD59E8565AB6" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\73949334-7885-4202-9f99-ad59e8565ab6"), fInfoLevelId=0x0, lpFileInformation=0x126e9228 | out: lpFileInformation=0x126e9228*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8b05ffa, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc8b05ffa, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc8b07378, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x60e)) returned 1
	[0233.122] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\7600EED5-3234-4650-8D9A-67C39E956D87" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\7600eed5-3234-4650-8d9a-67c39e956d87"), fInfoLevelId=0x0, lpFileInformation=0x126e9278 | out: lpFileInformation=0x126e9278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc882d53e, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc882d53e, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc882e8bd, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x722)) returned 1
	[0233.124] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\7C92FCEB-66EB-471D-9BA1-BDEE0E12FD94" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\7c92fceb-66eb-471d-9ba1-bdee0e12fd94"), fInfoLevelId=0x0, lpFileInformation=0x126e92c8 | out: lpFileInformation=0x126e92c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabae28fb, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xabae28fb, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xabae3bb5, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x1f8f)) returned 1
	[0233.129] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\7F96D0A4-ECC8-4300-A3C4-8C2B5918BBAA" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\7f96d0a4-ecc8-4300-a3c4-8c2b5918bbaa"), fInfoLevelId=0x0, lpFileInformation=0x126e9318 | out: lpFileInformation=0x126e9318*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82b59afa, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82b59afa, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82b59afa, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x98d6)) returned 1
	[0233.130] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\806760D6-0D46-4F0D-9A2A-5619D868318C" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\806760d6-0d46-4f0d-9a2a-5619d868318c"), fInfoLevelId=0x0, lpFileInformation=0x126e9368 | out: lpFileInformation=0x126e9368*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a05a2f, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc8a05a2f, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc8a06e54, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0xc11)) returned 1
	[0233.130] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\825BFDEB-777E-4DF1-818C-7CA4FC0D3016" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\825bfdeb-777e-4df1-818c-7ca4fc0d3016"), fInfoLevelId=0x0, lpFileInformation=0x126e93b8 | out: lpFileInformation=0x126e93b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8565b98, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc8565b98, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc8565b98, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x4c8)) returned 1
	[0233.130] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\82B38E75-3368-40D2-B1E5-193E0E558D48" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\82b38e75-3368-40d2-b1e5-193e0e558d48"), fInfoLevelId=0x0, lpFileInformation=0x126e9408 | out: lpFileInformation=0x126e9408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84e7d50, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc84e7d50, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc84e9287, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x9c3)) returned 1
	[0233.130] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\8618DFC3-EF76-4235-AA5D-06BEABD6E242" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\8618dfc3-ef76-4235-aa5d-06beabd6e242"), fInfoLevelId=0x0, lpFileInformation=0x126e9458 | out: lpFileInformation=0x126e9458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaba093e4, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xaba093e4, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xaba093e4, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x507d)) returned 1
	[0233.131] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\89953CAA-1AB9-4A6E-A488-DFEFC5075387" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\89953caa-1ab9-4a6e-a488-dfefc5075387"), fInfoLevelId=0x0, lpFileInformation=0x126e94a8 | out: lpFileInformation=0x126e94a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4c2c9d8, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb4c2c9d8, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb4c2c9d8, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x17be)) returned 1
	[0233.131] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\8EE3590E-CE33-42C6-8250-DF185AF8DAA4" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\8ee3590e-ce33-42c6-8250-df185af8daa4"), fInfoLevelId=0x0, lpFileInformation=0x126e94f8 | out: lpFileInformation=0x126e94f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82ac863d, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82ac863d, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82ac9960, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x541f)) returned 1
	[0233.132] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\9056E597-0C30-4F42-BA7A-70B004BF042A" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\9056e597-0c30-4f42-ba7a-70b004bf042a"), fInfoLevelId=0x0, lpFileInformation=0x126e9548 | out: lpFileInformation=0x126e9548*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb476eaa3, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb476eaa3, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb476fe6d, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x4c3c)) returned 1
	[0233.136] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\92D09C47-EFFB-4E54-B85D-797F67B0527C" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\92d09c47-effb-4e54-b85d-797f67b0527c"), fInfoLevelId=0x0, lpFileInformation=0x126e9598 | out: lpFileInformation=0x126e9598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb49b7e91, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb49b7e91, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb49b7e91, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x12b8)) returned 1
	[0233.137] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\95301B49-34BE-47D5-99D1-1C50A4B80C13" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\95301b49-34be-47d5-99d1-1c50a4b80c13"), fInfoLevelId=0x0, lpFileInformation=0x126e95e8 | out: lpFileInformation=0x126e95e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc848065f, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc848065f, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc84819da, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x3b7)) returned 1
	[0233.137] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\95AFB9A8-DEAD-49F6-9234-BEA10973F0CD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\95afb9a8-dead-49f6-9234-bea10973f0cd"), fInfoLevelId=0x0, lpFileInformation=0x126e9638 | out: lpFileInformation=0x126e9638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabb715e7, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xabb715e7, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xabb715e7, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x372b)) returned 1
	[0233.137] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\9639F732-A0F4-4A33-92A0-01330C0BB8C3" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\9639f732-a0f4-4a33-92a0-01330c0bb8c3"), fInfoLevelId=0x0, lpFileInformation=0x126e9688 | out: lpFileInformation=0x126e9688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a305e3, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc8a305e3, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc8a7fd33, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x7d42)) returned 1
	[0233.138] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\96BAA0E7-CE03-46C0-A45A-8F71ADB9C825" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\96baa0e7-ce03-46c0-a45a-8f71adb9c825"), fInfoLevelId=0x0, lpFileInformation=0x126e96d8 | out: lpFileInformation=0x126e96d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc83bbe8a, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc83bbe8a, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc83bd386, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0xd8b)) returned 1
	[0233.138] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\9A557D1E-5B55-45D0-B83F-66D1CCFBCC32" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\9a557d1e-5b55-45d0-b83f-66d1ccfbcc32"), fInfoLevelId=0x0, lpFileInformation=0x126e9728 | out: lpFileInformation=0x126e9728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82b07c5d, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82b07c5d, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82b07c5d, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0xd2e)) returned 1
	[0233.138] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\9CFC7195-9421-404F-A40A-EEBD8F033365" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\9cfc7195-9421-404f-a40a-eebd8f033365"), fInfoLevelId=0x0, lpFileInformation=0x126e9778 | out: lpFileInformation=0x126e9778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a15964, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc8a15964, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc8a16c5a, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x451)) returned 1
	[0233.138] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\A0D2B79B-05BB-4871-8DE6-E766643BD65E" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\a0d2b79b-05bb-4871-8de6-e766643bd65e"), fInfoLevelId=0x0, lpFileInformation=0x126e97c8 | out: lpFileInformation=0x126e97c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabbdccf8, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xabbdccf8, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xabbdccf8, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x135f)) returned 1
	[0233.139] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\A1E234BD-B121-49A0-9B4B-BBF6A832161B" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\a1e234bd-b121-49a0-9b4b-bbf6a832161b"), fInfoLevelId=0x0, lpFileInformation=0x126e9818 | out: lpFileInformation=0x126e9818*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabae01a6, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xabae01a6, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xabae01a6, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x108a)) returned 1
	[0233.139] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\A2F95592-6A7F-475A-878F-C593DA8BBEDD" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\a2f95592-6a7f-475a-878f-c593da8bbedd"), fInfoLevelId=0x0, lpFileInformation=0x126e9868 | out: lpFileInformation=0x126e9868*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x829ef008, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x829ef008, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x829ef008, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x990a)) returned 1
	[0233.139] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\A50A8D38-2A06-4EF5-A84C-B00C714F6B16" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\a50a8d38-2a06-4ef5-a84c-b00c714f6b16"), fInfoLevelId=0x0, lpFileInformation=0x126e98b8 | out: lpFileInformation=0x126e98b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82bb0641, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82bb0641, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82bb19b0, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x2c34)) returned 1
	[0233.139] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\A5DEC71F-CF32-4AAD-A02A-3B306B7F1FCC" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\a5dec71f-cf32-4aad-a02a-3b306b7f1fcc"), fInfoLevelId=0x0, lpFileInformation=0x126e9908 | out: lpFileInformation=0x126e9908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc89f5df6, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc89f5df6, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc89f5df6, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0xc70)) returned 1
	[0233.140] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\AA8B315F-D191-411A-80E8-BBCCCE176DA7" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\aa8b315f-d191-411a-80e8-bbccce176da7"), fInfoLevelId=0x0, lpFileInformation=0x126e9958 | out: lpFileInformation=0x126e9958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb49c69cc, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb49c69cc, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb49c69cc, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x75b)) returned 1
	[0233.140] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\ABF009F6-7021-47EC-8025-BE55AD5EBB57" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\abf009f6-7021-47ec-8025-be55ad5ebb57"), fInfoLevelId=0x0, lpFileInformation=0x126e99a8 | out: lpFileInformation=0x126e99a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabac2fca, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xabac2fca, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xabac3f0e, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x14c5)) returned 1
	[0233.140] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\AF769060-9C3B-4F97-8FB8-1EB72198BA39" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\af769060-9c3b-4f97-8fb8-1eb72198ba39"), fInfoLevelId=0x0, lpFileInformation=0x126e99f8 | out: lpFileInformation=0x126e99f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab9c9b2e, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xab9c9b2e, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xab9c9b2e, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x367e)) returned 1
	[0233.140] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\B1725647-3A36-4C56-9803-89EDCA8238A8" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\b1725647-3a36-4c56-9803-89edca8238a8"), fInfoLevelId=0x0, lpFileInformation=0x126e9a48 | out: lpFileInformation=0x126e9a48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab9f96f2, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xab9f96f2, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xab9faa6d, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x2132)) returned 1
	[0233.141] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\B20989ED-6B03-4803-ADD0-4360553EC384" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\b20989ed-6b03-4803-add0-4360553ec384"), fInfoLevelId=0x0, lpFileInformation=0x126e9a98 | out: lpFileInformation=0x126e9a98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c666c7, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc8c666c7, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc8c666c7, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x148c)) returned 1
	[0233.141] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\B6937276-0D21-44E4-B6A5-2F13F90E1698" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\b6937276-0d21-44e4-b6a5-2f13f90e1698"), fInfoLevelId=0x0, lpFileInformation=0x126e9ae8 | out: lpFileInformation=0x126e9ae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4df9f3a, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb4df9f3a, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb4df9f3a, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x7cb)) returned 1
	[0233.141] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\B74632A4-B059-4F5A-849D-252172A06A99" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\b74632a4-b059-4f5a-849d-252172a06a99"), fInfoLevelId=0x0, lpFileInformation=0x126e9b38 | out: lpFileInformation=0x126e9b38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82cd8b94, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82cd8b94, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82cd8b94, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x5505)) returned 1
	[0233.142] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\BB41F806-1043-41B2-9372-8F6E7066247A" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\bb41f806-1043-41b2-9372-8f6e7066247a"), fInfoLevelId=0x0, lpFileInformation=0x126e9b88 | out: lpFileInformation=0x126e9b88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab9f482a, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xab9f482a, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xab9f482a, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x3888)) returned 1
	[0233.142] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\BFB97937-ABF1-480A-946B-D367067F68C4" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\bfb97937-abf1-480a-946b-d367067f68c4"), fInfoLevelId=0x0, lpFileInformation=0x126e9bd8 | out: lpFileInformation=0x126e9bd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabae635e, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xabae635e, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xabae635e, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x7f46)) returned 1
	[0233.142] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\C0B5FEFE-C6C1-439E-B89D-E39A2031E527" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\c0b5fefe-c6c1-439e-b89d-e39a2031e527"), fInfoLevelId=0x0, lpFileInformation=0x126e9c28 | out: lpFileInformation=0x126e9c28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab9c1295, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xab9c1295, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xab9c1295, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x3c73)) returned 1
	[0233.143] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\C3DC5BD1-4AB1-4BDD-ACB0-FCCA65EE3D2A" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\c3dc5bd1-4ab1-4bdd-acb0-fcca65ee3d2a"), fInfoLevelId=0x0, lpFileInformation=0x126e9c78 | out: lpFileInformation=0x126e9c78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb474db8b, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb474db8b, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb474ef1c, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x1ffd)) returned 1
	[0233.143] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\C4181E33-213A-4456-87BA-15FD83064187" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\c4181e33-213a-4456-87ba-15fd83064187"), fInfoLevelId=0x0, lpFileInformation=0x126e9cc8 | out: lpFileInformation=0x126e9cc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab9cfd00, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xab9cfd00, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xab9d23da, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x2f7e)) returned 1
	[0233.143] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\C52B4A7C-C9FD-485A-8375-F97F3A24C1BA" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\c52b4a7c-c9fd-485a-8375-f97f3a24c1ba"), fInfoLevelId=0x0, lpFileInformation=0x126e9d18 | out: lpFileInformation=0x126e9d18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4974447, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb4974447, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb49759af, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x2bd8)) returned 1
	[0233.143] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\C7B65EEC-91E0-4362-AC18-80B09C3C95AC" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\c7b65eec-91e0-4362-ac18-80b09c3c95ac"), fInfoLevelId=0x0, lpFileInformation=0x126e9d68 | out: lpFileInformation=0x126e9d68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc83e6a80, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc83e6a80, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc83e6a80, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x1167)) returned 1
	[0233.143] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\C85A59C5-2B02-4194-AB2C-0E6E2B6031A0" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\c85a59c5-2b02-4194-ab2c-0e6e2b6031a0"), fInfoLevelId=0x0, lpFileInformation=0x126e9db8 | out: lpFileInformation=0x126e9db8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x829b15f8, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x829b15f8, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x829b5109, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x634f)) returned 1
	[0233.144] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\C9B26F48-B9B2-452D-9E4F-BD539A769B1B" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\c9b26f48-b9b2-452d-9e4f-bd539a769b1b"), fInfoLevelId=0x0, lpFileInformation=0x126e9e08 | out: lpFileInformation=0x126e9e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4e2fa78, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb4e2fa78, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb4e30e51, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x5543)) returned 1
	[0233.144] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\CA094F8F-D41E-43AB-8A32-1A2F34851250" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\ca094f8f-d41e-43ab-8a32-1a2f34851250"), fInfoLevelId=0x0, lpFileInformation=0x126e9e58 | out: lpFileInformation=0x126e9e58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabad3e63, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xabad3e63, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xabad3e63, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x1a54)) returned 1
	[0233.144] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\CCB1B3FC-5E0C-4241-ABC1-CA67B6C56947" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\ccb1b3fc-5e0c-4241-abc1-ca67b6c56947"), fInfoLevelId=0x0, lpFileInformation=0x126e9ea8 | out: lpFileInformation=0x126e9ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8293e9d0, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x8293e9d0, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x8293ff31, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x1e19)) returned 1
	[0233.144] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\CFC05EA4-9A97-47D5-9459-FB2F94EE79CC" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\cfc05ea4-9a97-47d5-9459-fb2f94ee79cc"), fInfoLevelId=0x0, lpFileInformation=0x126e9ef8 | out: lpFileInformation=0x126e9ef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4d94a38, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb4d94a38, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb4d94a38, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x422e)) returned 1
	[0233.145] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\D03B54D7-2F02-4F26-B245-6759FD3E5356" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\d03b54d7-2f02-4f26-b245-6759fd3e5356"), fInfoLevelId=0x0, lpFileInformation=0x126e9f48 | out: lpFileInformation=0x126e9f48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4d89a80, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb4d89a80, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb4d8ae10, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x595d)) returned 1
	[0233.145] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\D1658A87-36B4-4565-B36F-CEF71FFC7033" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\d1658a87-36b4-4565-b36f-cef71ffc7033"), fInfoLevelId=0x0, lpFileInformation=0x126e9f98 | out: lpFileInformation=0x126e9f98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab9d990d, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xab9d990d, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xab9ee668, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x4c5d)) returned 1
	[0233.145] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\D69FD789-7AAA-4B6A-86DB-6AD5F309B97F" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\d69fd789-7aaa-4b6a-86db-6ad5f309b97f"), fInfoLevelId=0x0, lpFileInformation=0x126be008 | out: lpFileInformation=0x126be008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82c85c72, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82c85c72, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82c8700a, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x3894)) returned 1
	[0233.145] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\D7F62263-4202-4285-AB58-35DFBBB7899C" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\d7f62263-4202-4285-ab58-35dfbbb7899c"), fInfoLevelId=0x0, lpFileInformation=0x126be058 | out: lpFileInformation=0x126be058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4e43432, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb4e43432, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb4e43432, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x6f72)) returned 1
	[0233.146] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\DB4F9AB3-289C-4C85-93DC-C7725673E79B" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\db4f9ab3-289c-4c85-93dc-c7725673e79b"), fInfoLevelId=0x0, lpFileInformation=0x126be0a8 | out: lpFileInformation=0x126be0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc856808a, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc856808a, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc856808a, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0xfe2)) returned 1
	[0233.146] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\DC2A3CBD-DDE4-4C82-98B2-97C578971471" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\dc2a3cbd-dde4-4c82-98b2-97c578971471"), fInfoLevelId=0x0, lpFileInformation=0x126be0f8 | out: lpFileInformation=0x126be0f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d69f78, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82d69f78, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82d69f78, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x2913)) returned 1
	[0233.146] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\E2B74C9D-38F9-4AF3-849B-6F6ED185FFC9" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\e2b74c9d-38f9-4af3-849b-6f6ed185ffc9"), fInfoLevelId=0x0, lpFileInformation=0x126be148 | out: lpFileInformation=0x126be148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc89439d3, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc89439d3, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc89439d3, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x2516)) returned 1
	[0233.147] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\E36912C5-9C2D-452F-95F8-CFA1FC049148" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\e36912c5-9c2d-452f-95f8-cfa1fc049148"), fInfoLevelId=0x0, lpFileInformation=0x126be198 | out: lpFileInformation=0x126be198*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4e4e325, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb4e4e325, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb4e4f6b9, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0xa99)) returned 1
	[0233.147] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\E457C019-B991-4CCC-8425-CCD48E271DFC" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\e457c019-b991-4ccc-8425-ccd48e271dfc"), fInfoLevelId=0x0, lpFileInformation=0x126be1e8 | out: lpFileInformation=0x126be1e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8850b3e, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc8850b3e, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc8850b3e, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x38f)) returned 1
	[0233.149] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\E64AA1EE-3ABD-40DD-9A7A-E7E891151C82" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\e64aa1ee-3abd-40dd-9a7a-e7e891151c82"), fInfoLevelId=0x0, lpFileInformation=0x126be238 | out: lpFileInformation=0x126be238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4e928f1, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb4e928f1, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb4e93c87, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x1f40)) returned 1
	[0233.150] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\E8B41E01-FE51-4F72-9829-70D724467D17" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\e8b41e01-fe51-4f72-9829-70d724467d17"), fInfoLevelId=0x0, lpFileInformation=0x126be288 | out: lpFileInformation=0x126be288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82bd5ee3, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82bd5ee3, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82bd85f4, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x3380)) returned 1
	[0233.150] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\EA6554FC-7DB2-4685-948E-52402E811540" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\ea6554fc-7db2-4685-948e-52402e811540"), fInfoLevelId=0x0, lpFileInformation=0x126be2d8 | out: lpFileInformation=0x126be2d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabb679a6, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xabb679a6, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xabb679a6, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x292e)) returned 1
	[0233.150] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\F0A28B79-40AC-459C-968D-4F68E9798715" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\f0a28b79-40ac-459c-968d-4f68e9798715"), fInfoLevelId=0x0, lpFileInformation=0x126be328 | out: lpFileInformation=0x126be328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8424f42, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc8424f42, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc8427531, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x153e)) returned 1
	[0233.150] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\F192A1E6-5284-47FF-83DA-D65DCB35FC9F" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\f192a1e6-5284-47ff-83da-d65dcb35fc9f"), fInfoLevelId=0x0, lpFileInformation=0x126be378 | out: lpFileInformation=0x126be378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x829bd95b, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x829bd95b, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x829bef86, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x7629)) returned 1
	[0233.150] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\F31F431A-DF78-48BC-9A30-E15E83A7DF3B" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\f31f431a-df78-48bc-9a30-e15e83a7df3b"), fInfoLevelId=0x0, lpFileInformation=0x126be3c8 | out: lpFileInformation=0x126be3c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaba00b7d, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xaba00b7d, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xaba00b7d, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x18bd)) returned 1
	[0233.151] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\F8C7174F-633A-4FA0-9187-67153391986A" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\f8c7174f-633a-4fa0-9187-67153391986a"), fInfoLevelId=0x0, lpFileInformation=0x126be418 | out: lpFileInformation=0x126be418*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d4df95, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82d4df95, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82d4df95, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x1362)) returned 1
	[0233.151] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\F97CF839-8F66-44ED-8DB4-5A4D6D408F2E" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\f97cf839-8f66-44ed-8db4-5a4d6d408f2e"), fInfoLevelId=0x0, lpFileInformation=0x126be468 | out: lpFileInformation=0x126be468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4c2675f, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb4c2675f, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb4c2675f, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x447b)) returned 1
	[0233.151] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\binaries.templates.cdn.office.net\\FDAC0094-8C06-4BE5-856F-0DB7BB8F69B9" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\binaries.templates.cdn.office.net\\fdac0094-8c06-4be5-856f-0db7bb8f69b9"), fInfoLevelId=0x0, lpFileInformation=0x126be4b8 | out: lpFileInformation=0x126be4b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb49ec6e1, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb49ec6e1, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb49eda26, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x486e)) returned 1
	[0233.151] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\officeclient.microsoft.com" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\officeclient.microsoft.com"), fInfoLevelId=0x0, lpFileInformation=0x126be508 | out: lpFileInformation=0x126be508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fe741f9, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x5d38e5d2, ftLastAccessTime.dwHighDateTime=0x1d7b058, ftLastWriteTime.dwLowDateTime=0x5d38e5d2, ftLastWriteTime.dwHighDateTime=0x1d7b058, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0233.152] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\officeclient.microsoft.com" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\officeclient.microsoft.com"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.152] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\officeclient.microsoft.com\\*", lpFindFileData=0x124236c0 | out: lpFindFileData=0x124236c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fe741f9, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x5d374b6c, ftLastAccessTime.dwHighDateTime=0x1d7b058, ftLastWriteTime.dwLowDateTime=0x5d38e5d2, ftLastWriteTime.dwHighDateTime=0x1d7b058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fb28
	[0233.153] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1fe741f9, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x5d374b6c, ftLastAccessTime.dwHighDateTime=0x1d7b058, ftLastWriteTime.dwLowDateTime=0x5d38e5d2, ftLastWriteTime.dwHighDateTime=0x1d7b058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.153] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d374b6c, ftCreationTime.dwHighDateTime=0x1d7b058, ftLastAccessTime.dwLowDateTime=0x5d374b6c, ftLastAccessTime.dwHighDateTime=0x1d7b058, ftLastWriteTime.dwLowDateTime=0x5d37726a, ftLastWriteTime.dwHighDateTime=0x1d7b058, nFileSizeHigh=0x0, nFileSizeLow=0x21d15, dwReserved0=0x0, dwReserved1=0x0, cFileName="4958AB69-A28E-4C1F-916A-BDF19CB99CF0", cAlternateFileName="4958AB~1")) returned 1
	[0233.153] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fe741f9, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1fe741f9, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1fe741f9, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x2071b, dwReserved0=0x0, dwReserved1=0x0, cFileName="85783D1F-A228-4706-A7FF-1C07A8CCD84F", cAlternateFileName="85783D~1")) returned 1
	[0233.153] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124236e0 | out: lpFindFileData=0x124236e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.153] FindClose (in: hFindFile=0x79fb28 | out: hFindFile=0x79fb28) returned 1
	[0233.154] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\officeclient.microsoft.com\\4958AB69-A28E-4C1F-916A-BDF19CB99CF0" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\officeclient.microsoft.com\\4958ab69-a28e-4c1f-916a-bdf19cb99cf0"), fInfoLevelId=0x0, lpFileInformation=0x126be5f8 | out: lpFileInformation=0x126be5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d374b6c, ftCreationTime.dwHighDateTime=0x1d7b058, ftLastAccessTime.dwLowDateTime=0x5d374b6c, ftLastAccessTime.dwHighDateTime=0x1d7b058, ftLastWriteTime.dwLowDateTime=0x5d37726a, ftLastWriteTime.dwHighDateTime=0x1d7b058, nFileSizeHigh=0x0, nFileSizeLow=0x21d15)) returned 1
	[0233.156] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\officeclient.microsoft.com\\85783D1F-A228-4706-A7FF-1C07A8CCD84F" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\webservicecache\\allusers\\officeclient.microsoft.com\\85783d1f-a228-4706-a7ff-1c07a8ccd84f"), fInfoLevelId=0x0, lpFileInformation=0x126be648 | out: lpFileInformation=0x126be648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fe741f9, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1fe741f9, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1fe741f9, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x2071b)) returned 1
	[0233.156] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\excel.exe_Rules.xml" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\excel.exe_rules.xml"), fInfoLevelId=0x0, lpFileInformation=0x126be698 | out: lpFileInformation=0x126be698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaba9333c, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xaba9333c, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x6b3f26a7, ftLastWriteTime.dwHighDateTime=0x1d7b058, nFileSizeHigh=0x0, nFileSizeLow=0x13bd9)) returned 1
	[0233.156] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\msaccess.exe_Rules.xml" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\msaccess.exe_rules.xml"), fInfoLevelId=0x0, lpFileInformation=0x126be6e8 | out: lpFileInformation=0x126be6e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cb2b47, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xc8cb2b47, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xc8cb2b47, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x11d02)) returned 1
	[0233.159] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\officec2rclient.exe_Rules.xml" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\officec2rclient.exe_rules.xml"), fInfoLevelId=0x0, lpFileInformation=0x126be738 | out: lpFileInformation=0x126be738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20bb7bfa, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x20bb7bfa, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x20bb8ff9, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x4050)) returned 1
	[0233.160] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\officeclicktorun.exe_Rules.xml" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\officeclicktorun.exe_rules.xml"), fInfoLevelId=0x0, lpFileInformation=0x126be788 | out: lpFileInformation=0x126be788*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cfcf021, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1cfcf021, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1cfcf021, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x4050)) returned 1
	[0233.160] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\outlook.exe_Rules.xml" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\outlook.exe_rules.xml"), fInfoLevelId=0x0, lpFileInformation=0x126be7d8 | out: lpFileInformation=0x126be7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b96fdbf, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x3b96fdbf, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3b96fdbf, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x14a91)) returned 1
	[0233.166] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\powerpnt.exe_Rules.xml" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\powerpnt.exe_rules.xml"), fInfoLevelId=0x0, lpFileInformation=0x126be828 | out: lpFileInformation=0x126be828*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb50ff70b, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xb50ff70b, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xb50ff70b, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x12c3e)) returned 1
	[0233.166] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\setup.exe_Rules.xml" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\setup.exe_rules.xml"), fInfoLevelId=0x0, lpFileInformation=0x126be878 | out: lpFileInformation=0x126be878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5781bc17, ftCreationTime.dwHighDateTime=0x1d7046d, ftLastAccessTime.dwLowDateTime=0x5781bc17, ftLastAccessTime.dwHighDateTime=0x1d7046d, ftLastWriteTime.dwLowDateTime=0x9d540b29, ftLastWriteTime.dwHighDateTime=0x1d70502, nFileSizeHigh=0x0, nFileSizeLow=0x4d2aa)) returned 1
	[0233.166] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\setup32.exe_Rules.xml" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\setup32.exe_rules.xml"), fInfoLevelId=0x0, lpFileInformation=0x126be8c8 | out: lpFileInformation=0x126be8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18417d03, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x18417d03, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1841a3b9, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x4050)) returned 1
	[0233.167] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\16.0\\winword.exe_Rules.xml" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\16.0\\winword.exe_rules.xml"), fInfoLevelId=0x0, lpFileInformation=0x126be918 | out: lpFileInformation=0x126be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fa7c66, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x82fa7c66, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x82fa7c66, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x197d6)) returned 1
	[0233.167] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\OTele" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\otele"), fInfoLevelId=0x0, lpFileInformation=0x126be968 | out: lpFileInformation=0x126be968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x696efe32, ftCreationTime.dwHighDateTime=0x1d7046d, ftLastAccessTime.dwLowDateTime=0xa3052704, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0xa3052704, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.167] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\OTele" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\otele"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.167] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\OTele\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x696efe32, ftCreationTime.dwHighDateTime=0x1d7046d, ftLastAccessTime.dwLowDateTime=0xa304b1cc, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0xa3052704, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fce8
	[0233.174] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x696efe32, ftCreationTime.dwHighDateTime=0x1d7046d, ftLastAccessTime.dwLowDateTime=0xa304b1cc, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0xa3052704, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.175] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec7c65b, ftCreationTime.dwHighDateTime=0x1d7b063, ftLastAccessTime.dwLowDateTime=0x9ec7c65b, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x9ec7c65b, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x0, dwReserved1=0x0, cFileName="{38EA38E1-6380-4563-8569-FC2DFF19B999} (0) - 896 - excel.exe - OTele.dat", cAlternateFileName="{38EA3~2.DAT")) returned 1
	[0233.175] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec716b8, ftCreationTime.dwHighDateTime=0x1d7b063, ftLastAccessTime.dwLowDateTime=0x9ec716b8, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x9ec7b2ff, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x345, dwReserved0=0x0, dwReserved1=0x0, cFileName="{38EA38E1-6380-4563-8569-FC2DFF19B999} (0) - 896 - excel.exe - OTeleMediumCost.dat", cAlternateFileName="{38EA3~1.DAT")) returned 1
	[0233.175] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec815d6, ftCreationTime.dwHighDateTime=0x1d7b063, ftLastAccessTime.dwLowDateTime=0x9ec815d6, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x9ec82851, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0x0, dwReserved1=0x0, cFileName="{38EA38E1-6380-4563-8569-FC2DFF19B999} (1) - 896 - excel.exe - OTele.dat", cAlternateFileName="{38EA3~4.DAT")) returned 1
	[0233.175] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec7ed61, ftCreationTime.dwHighDateTime=0x1d7b063, ftLastAccessTime.dwLowDateTime=0x9ec7ed61, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x9ec80102, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x1e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="{38EA38E1-6380-4563-8569-FC2DFF19B999} (1) - 896 - excel.exe - OTeleMediumCost.dat", cAlternateFileName="{38EA3~3.DAT")) returned 1
	[0233.175] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3048af2, ftCreationTime.dwHighDateTime=0x1d7b063, ftLastAccessTime.dwLowDateTime=0xa3048af2, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0xa3049e34, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8C5C453E-F1E7-456C-A78B-1F97C49F7A1D} (0) - 2988 - excel.exe - OTele.dat", cAlternateFileName="{8C5C4~2.DAT")) returned 1
	[0233.175] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3041919, ftCreationTime.dwHighDateTime=0x1d7b063, ftLastAccessTime.dwLowDateTime=0xa3041919, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0xa3041919, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x345, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8C5C453E-F1E7-456C-A78B-1F97C49F7A1D} (0) - 2988 - excel.exe - OTeleMediumCost.dat", cAlternateFileName="{8C5C4~1.DAT")) returned 1
	[0233.175] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3052704, ftCreationTime.dwHighDateTime=0x1d7b063, ftLastAccessTime.dwLowDateTime=0xa3052704, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0xa3052704, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8C5C453E-F1E7-456C-A78B-1F97C49F7A1D} (1) - 2988 - excel.exe - OTele.dat", cAlternateFileName="{8C5C4~4.DAT")) returned 1
	[0233.175] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa304b1cc, ftCreationTime.dwHighDateTime=0x1d7b063, ftLastAccessTime.dwLowDateTime=0xa304b1cc, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0xa304c575, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x20b, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8C5C453E-F1E7-456C-A78B-1F97C49F7A1D} (1) - 2988 - excel.exe - OTeleMediumCost.dat", cAlternateFileName="{8C5C4~3.DAT")) returned 1
	[0233.175] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x366f796f, ftCreationTime.dwHighDateTime=0x1d7b063, ftLastAccessTime.dwLowDateTime=0x366f796f, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x366f8d2c, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0xb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="{A031426B-8B99-4A54-857D-B4412BDF67CD} (0) - 3412 - excel.exe - OTele.dat", cAlternateFileName="{A0314~1.DAT")) returned 1
	[0233.175] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.175] FindClose (in: hFindFile=0x79fce8 | out: hFindFile=0x79fce8) returned 1
	[0233.176] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\OTele\\{38EA38E1-6380-4563-8569-FC2DFF19B999} (0) - 896 - excel.exe - OTele.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\otele\\{38ea38e1-6380-4563-8569-fc2dff19b999} (0) - 896 - excel.exe - otele.dat"), fInfoLevelId=0x0, lpFileInformation=0x126becd8 | out: lpFileInformation=0x126becd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec7c65b, ftCreationTime.dwHighDateTime=0x1d7b063, ftLastAccessTime.dwLowDateTime=0x9ec7c65b, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x9ec7c65b, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x117)) returned 1
	[0233.178] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\OTele\\{38EA38E1-6380-4563-8569-FC2DFF19B999} (0) - 896 - excel.exe - OTeleMediumCost.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\otele\\{38ea38e1-6380-4563-8569-fc2dff19b999} (0) - 896 - excel.exe - otelemediumcost.dat"), fInfoLevelId=0x0, lpFileInformation=0x126bed28 | out: lpFileInformation=0x126bed28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec716b8, ftCreationTime.dwHighDateTime=0x1d7b063, ftLastAccessTime.dwLowDateTime=0x9ec716b8, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x9ec7b2ff, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x345)) returned 1
	[0233.183] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\OTele\\{38EA38E1-6380-4563-8569-FC2DFF19B999} (1) - 896 - excel.exe - OTele.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\otele\\{38ea38e1-6380-4563-8569-fc2dff19b999} (1) - 896 - excel.exe - otele.dat"), fInfoLevelId=0x0, lpFileInformation=0x126bed78 | out: lpFileInformation=0x126bed78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec815d6, ftCreationTime.dwHighDateTime=0x1d7b063, ftLastAccessTime.dwLowDateTime=0x9ec815d6, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x9ec82851, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x12c)) returned 1
	[0233.183] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\OTele\\{38EA38E1-6380-4563-8569-FC2DFF19B999} (1) - 896 - excel.exe - OTeleMediumCost.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\otele\\{38ea38e1-6380-4563-8569-fc2dff19b999} (1) - 896 - excel.exe - otelemediumcost.dat"), fInfoLevelId=0x0, lpFileInformation=0x126bedc8 | out: lpFileInformation=0x126bedc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec7ed61, ftCreationTime.dwHighDateTime=0x1d7b063, ftLastAccessTime.dwLowDateTime=0x9ec7ed61, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x9ec80102, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x1e3)) returned 1
	[0233.183] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\OTele\\{8C5C453E-F1E7-456C-A78B-1F97C49F7A1D} (0) - 2988 - excel.exe - OTele.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\otele\\{8c5c453e-f1e7-456c-a78b-1f97c49f7a1d} (0) - 2988 - excel.exe - otele.dat"), fInfoLevelId=0x0, lpFileInformation=0x126bee18 | out: lpFileInformation=0x126bee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3048af2, ftCreationTime.dwHighDateTime=0x1d7b063, ftLastAccessTime.dwLowDateTime=0xa3048af2, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0xa3049e34, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x117)) returned 1
	[0233.188] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\OTele\\{8C5C453E-F1E7-456C-A78B-1F97C49F7A1D} (0) - 2988 - excel.exe - OTeleMediumCost.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\otele\\{8c5c453e-f1e7-456c-a78b-1f97c49f7a1d} (0) - 2988 - excel.exe - otelemediumcost.dat"), fInfoLevelId=0x0, lpFileInformation=0x126bee68 | out: lpFileInformation=0x126bee68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3041919, ftCreationTime.dwHighDateTime=0x1d7b063, ftLastAccessTime.dwLowDateTime=0xa3041919, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0xa3041919, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x345)) returned 1
	[0233.188] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\OTele\\{8C5C453E-F1E7-456C-A78B-1F97C49F7A1D} (1) - 2988 - excel.exe - OTele.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\otele\\{8c5c453e-f1e7-456c-a78b-1f97c49f7a1d} (1) - 2988 - excel.exe - otele.dat"), fInfoLevelId=0x0, lpFileInformation=0x126beeb8 | out: lpFileInformation=0x126beeb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3052704, ftCreationTime.dwHighDateTime=0x1d7b063, ftLastAccessTime.dwLowDateTime=0xa3052704, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0xa3052704, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x12c)) returned 1
	[0233.188] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\OTele\\{8C5C453E-F1E7-456C-A78B-1F97C49F7A1D} (1) - 2988 - excel.exe - OTeleMediumCost.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\otele\\{8c5c453e-f1e7-456c-a78b-1f97c49f7a1d} (1) - 2988 - excel.exe - otelemediumcost.dat"), fInfoLevelId=0x0, lpFileInformation=0x126bef08 | out: lpFileInformation=0x126bef08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa304b1cc, ftCreationTime.dwHighDateTime=0x1d7b063, ftLastAccessTime.dwLowDateTime=0xa304b1cc, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0xa304c575, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x20b)) returned 1
	[0233.189] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\OTele\\{A031426B-8B99-4A54-857D-B4412BDF67CD} (0) - 3412 - excel.exe - OTele.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\otele\\{a031426b-8b99-4a54-857d-b4412bdf67cd} (0) - 3412 - excel.exe - otele.dat"), fInfoLevelId=0x0, lpFileInformation=0x126bef58 | out: lpFileInformation=0x126bef58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x366f796f, ftCreationTime.dwHighDateTime=0x1d7b063, ftLastAccessTime.dwLowDateTime=0x366f796f, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x366f8d2c, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0xb8)) returned 1
	[0233.189] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive"), fInfoLevelId=0x0, lpFileInformation=0x126befa8 | out: lpFileInformation=0x126befa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87b49234, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x84c1ec39, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84c1ec39, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0233.189] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.189] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87b49234, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x84c1ec39, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84c1ec39, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f8e8
	[0233.189] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87b49234, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x84c1ec39, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84c1ec39, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.190] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x883c79d5, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x973d65a1, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x980cd2db, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="17.3.5892.0626", cAlternateFileName="173589~1.062")) returned 1
	[0233.190] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13a98591, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x27e196bc, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x27e196bc, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="17.3.5892.0626_1", cAlternateFileName="173589~2.062")) returned 1
	[0233.190] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf111177, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x19a81fc0, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x1bc7bb71, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="17.3.5892.0626_2", cAlternateFileName="173589~3.062")) returned 1
	[0233.190] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4be92b64, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x6abcad0b, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x6aeebefe, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="17.3.5892.0626_3", cAlternateFileName="173589~4.062")) returned 1
	[0233.190] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2a1d565, ftCreationTime.dwHighDateTime=0x1d70073, ftLastAccessTime.dwLowDateTime=0x849e2ad9, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x849e2ad9, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="17.3.5892.0626_4", cAlternateFileName="177A54~1.062")) returned 1
	[0233.190] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x84c1ec39, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x84c1ec39, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84c1ec39, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 1
	[0233.190] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849e2ad9, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x849e2ad9, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x12862516, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x5d4c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive.exe", cAlternateFileName="")) returned 1
	[0233.190] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87b49234, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x87b49234, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x87b49234, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup", cAlternateFileName="")) returned 1
	[0233.190] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.190] FindClose (in: hFindFile=0x79f8e8 | out: hFindFile=0x79f8e8) returned 1
	[0233.190] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626"), fInfoLevelId=0x0, lpFileInformation=0x126bf278 | out: lpFileInformation=0x126bf278*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x883c79d5, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x980cd2db, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x980cd2db, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.191] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.191] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x883c79d5, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x973d65a1, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x980cd2db, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f968
	[0233.199] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x883c79d5, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x973d65a1, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x980cd2db, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.199] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cd17d55, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x8cd17d55, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x8dfb8492, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x123c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoPlayLogo.png", cAlternateFileName="AUTOPL~1.PNG")) returned 1
	[0233.199] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f743688, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x8f743688, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x91beba26, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x5d8f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoPlayOptIn.gif", cAlternateFileName="AUTOPL~1.GIF")) returned 1
	[0233.199] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x922c670c, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x922c670c, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x92849c84, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x27f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoPlayOptIn.png", cAlternateFileName="AUTOPL~2.PNG")) returned 1
	[0233.199] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92ed8427, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x92ed8427, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x93350a85, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x16da, dwReserved0=0x0, dwReserved1=0x0, cFileName="CollectOneDriveLogs.bat", cAlternateFileName="COLLEC~1.BAT")) returned 1
	[0233.199] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93ea3eb7, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x93ea3eb7, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x9404784f, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x72c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETWlog.dll", cAlternateFileName="")) returned 1
	[0233.199] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94689b47, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x94689b47, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x9489fc30, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x4e5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExclusionList.xml", cAlternateFileName="EXCLUS~1.XML")) returned 1
	[0233.199] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94bc0dc5, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x94bc0dc5, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x94ebbc59, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x140c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll", cAlternateFileName="FILESY~1.DLL")) returned 1
	[0233.200] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x959c295b, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x959c295b, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x98355904, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0xf8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.Resources.dll", cAlternateFileName="FILESY~2.DLL")) returned 1
	[0233.200] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8bbcedb7, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x8bbcedb7, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x8bbcedb7, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="is", cAlternateFileName="")) returned 1
	[0233.200] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fca0d59, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x8fca0d59, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x8fca0d59, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1
	[0233.200] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90f6733c, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x90f6733c, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x90f6733c, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1
	[0233.200] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92954bae, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x92954bae, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x92954bae, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ka", cAlternateFileName="")) returned 1
	[0233.200] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x944bfdaf, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x944bfdaf, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x944bfdaf, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kk", cAlternateFileName="")) returned 1
	[0233.200] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95c97643, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x95c97643, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x95c97643, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="km-kh", cAlternateFileName="")) returned 1
	[0233.200] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x967520dd, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x967520dd, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x967520dd, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kn", cAlternateFileName="")) returned 1
	[0233.200] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x973d65a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x973d65a1, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x973d65a1, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1
	[0233.200] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x980cd2db, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x980cd2db, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x980cd2db, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kok", cAlternateFileName="")) returned 1
	[0233.200] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.200] FindClose (in: hFindFile=0x79f968 | out: hFindFile=0x79f968) returned 1
	[0233.201] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayLogo.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\autoplaylogo.png"), fInfoLevelId=0x0, lpFileInformation=0x126bf818 | out: lpFileInformation=0x126bf818*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cd17d55, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x8cd17d55, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x8dfb8492, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x123c)) returned 1
	[0233.203] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\autoplayoptin.gif"), fInfoLevelId=0x0, lpFileInformation=0x126bf868 | out: lpFileInformation=0x126bf868*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f743688, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x8f743688, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x91beba26, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x5d8f6)) returned 1
	[0233.204] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\autoplayoptin.png"), fInfoLevelId=0x0, lpFileInformation=0x126bf8b8 | out: lpFileInformation=0x126bf8b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x922c670c, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x922c670c, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x92849c84, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x27f2)) returned 1
	[0233.204] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\CollectOneDriveLogs.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\collectonedrivelogs.bat"), fInfoLevelId=0x0, lpFileInformation=0x126bf908 | out: lpFileInformation=0x126bf908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92ed8427, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x92ed8427, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x93350a85, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x16da)) returned 1
	[0233.204] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\ETWlog.dll" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\etwlog.dll"), fInfoLevelId=0x0, lpFileInformation=0x126bf958 | out: lpFileInformation=0x126bf958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93ea3eb7, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x93ea3eb7, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x9404784f, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x72c0)) returned 1
	[0233.207] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\ExclusionList.xml" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\exclusionlist.xml"), fInfoLevelId=0x0, lpFileInformation=0x126bf9a8 | out: lpFileInformation=0x126bf9a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94689b47, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x94689b47, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x9489fc30, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x4e5f)) returned 1
	[0233.207] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\FileSync.LocalizedResources.dll" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\filesync.localizedresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x126bf9f8 | out: lpFileInformation=0x126bf9f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94bc0dc5, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x94bc0dc5, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x94ebbc59, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x140c0)) returned 1
	[0233.207] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\FileSync.Resources.dll" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\filesync.resources.dll"), fInfoLevelId=0x0, lpFileInformation=0x126bfa48 | out: lpFileInformation=0x126bfa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x959c295b, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x959c295b, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x98355904, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0xf8000)) returned 1
	[0233.209] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\is" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\is"), fInfoLevelId=0x0, lpFileInformation=0x126bfa98 | out: lpFileInformation=0x126bfa98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8bbcedb7, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x8edba01f, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x8edba01f, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.217] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\is" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\is"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.217] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\is\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8bbcedb7, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x8bbcedb7, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x8edba01f, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f968
	[0233.217] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8bbcedb7, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x8bbcedb7, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x8edba01f, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.217] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8edba01f, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x8edba01f, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x8f89abc5, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x152c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0233.217] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.217] FindClose (in: hFindFile=0x79f968 | out: hFindFile=0x79f968) returned 1
	[0233.217] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\is\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\is\\filesync.localizedresources.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x126bfb38 | out: lpFileInformation=0x126bfb38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8edba01f, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x8edba01f, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x8f89abc5, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x152c0)) returned 1
	[0233.243] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\it" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\it"), fInfoLevelId=0x0, lpFileInformation=0x126bfb88 | out: lpFileInformation=0x126bfb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fca0d59, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x907a79a9, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x907a79a9, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.243] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\it" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\it"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.243] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\it\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fca0d59, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x8fca0d59, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x907a79a9, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ff28
	[0233.244] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fca0d59, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x8fca0d59, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x907a79a9, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.244] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907a79a9, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x907a79a9, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x90ea89ac, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x160c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0233.244] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.244] FindClose (in: hFindFile=0x79ff28 | out: hFindFile=0x79ff28) returned 1
	[0233.244] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\it\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\it\\filesync.localizedresources.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x126bfc28 | out: lpFileInformation=0x126bfc28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907a79a9, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x907a79a9, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x90ea89ac, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x160c0)) returned 1
	[0233.245] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\ja" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\ja"), fInfoLevelId=0x0, lpFileInformation=0x126bfc78 | out: lpFileInformation=0x126bfc78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90f6733c, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x91510d84, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x91510d84, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.247] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\ja" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\ja"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.248] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\ja\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90f6733c, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x90f6733c, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x91510d84, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fce8
	[0233.248] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90f6733c, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x90f6733c, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x91510d84, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.248] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91510d84, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x91510d84, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x9259b185, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0xfcc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0233.248] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.248] FindClose (in: hFindFile=0x79fce8 | out: hFindFile=0x79fce8) returned 1
	[0233.248] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\ja\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\ja\\filesync.localizedresources.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x126bfd18 | out: lpFileInformation=0x126bfd18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91510d84, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x91510d84, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x9259b185, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0xfcc0)) returned 1
	[0233.249] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\ka" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\ka"), fInfoLevelId=0x0, lpFileInformation=0x126bfd68 | out: lpFileInformation=0x126bfd68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92954bae, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x93186f59, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x93186f59, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.249] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\ka" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\ka"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.249] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\ka\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92954bae, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x92954bae, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x93186f59, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f8e8
	[0233.249] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92954bae, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x92954bae, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x93186f59, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.249] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93186f59, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x93186f59, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x93faeefa, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x164c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0233.249] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.250] FindClose (in: hFindFile=0x79f8e8 | out: hFindFile=0x79f8e8) returned 1
	[0233.250] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\ka\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\ka\\filesync.localizedresources.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x126bfe08 | out: lpFileInformation=0x126bfe08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93186f59, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x93186f59, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x93faeefa, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x164c0)) returned 1
	[0233.251] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\kk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\kk"), fInfoLevelId=0x0, lpFileInformation=0x126bfe58 | out: lpFileInformation=0x126bfe58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x944bfdaf, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x94e232ee, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x94e232ee, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.252] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\kk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\kk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.252] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\kk\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x944bfdaf, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x944bfdaf, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x94e232ee, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0028
	[0233.252] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x944bfdaf, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x944bfdaf, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x94e232ee, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.252] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94e232ee, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x94e232ee, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x952c1a4e, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x160c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0233.252] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.252] FindClose (in: hFindFile=0x7a0028 | out: hFindFile=0x7a0028) returned 1
	[0233.252] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\kk\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\kk\\filesync.localizedresources.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x126bfef8 | out: lpFileInformation=0x126bfef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94e232ee, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x94e232ee, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x952c1a4e, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x160c0)) returned 1
	[0233.252] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\km-kh" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\km-kh"), fInfoLevelId=0x0, lpFileInformation=0x126bff48 | out: lpFileInformation=0x126bff48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95c97643, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x962b3645, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x962b3645, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.253] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\km-kh" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\km-kh"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.254] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\km-kh\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95c97643, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x95c97643, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x962b3645, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0068
	[0233.254] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95c97643, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x95c97643, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x962b3645, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.254] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x962b3645, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x962b3645, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x96647060, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x156c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0233.254] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.254] FindClose (in: hFindFile=0x7a0068 | out: hFindFile=0x7a0068) returned 1
	[0233.254] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\km-kh\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\km-kh\\filesync.localizedresources.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1246a008 | out: lpFileInformation=0x1246a008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x962b3645, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x962b3645, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x96647060, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x156c0)) returned 1
	[0233.255] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\kn" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\kn"), fInfoLevelId=0x0, lpFileInformation=0x1246a058 | out: lpFileInformation=0x1246a058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x967520dd, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x96f11a4d, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x96f11a4d, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.256] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\kn" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\kn"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.256] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\kn\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x967520dd, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x967520dd, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x96f11a4d, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffe8
	[0233.256] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x967520dd, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x967520dd, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x96f11a4d, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.256] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f11a4d, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x96f11a4d, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x97317979, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x172c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0233.256] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.256] FindClose (in: hFindFile=0x79ffe8 | out: hFindFile=0x79ffe8) returned 1
	[0233.256] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\kn\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\kn\\filesync.localizedresources.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1246a0f8 | out: lpFileInformation=0x1246a0f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f11a4d, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x96f11a4d, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x97317979, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x172c0)) returned 1
	[0233.257] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\ko" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\ko"), fInfoLevelId=0x0, lpFileInformation=0x1246a148 | out: lpFileInformation=0x1246a148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x973d65a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x97a3ea55, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x97a3ea55, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.258] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\ko" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\ko"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.258] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\ko\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x973d65a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x973d65a1, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x97a3ea55, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fba8
	[0233.258] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x973d65a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x973d65a1, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x97a3ea55, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.258] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97a3ea55, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x97a3ea55, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x97edd415, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0xf2c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0233.258] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.258] FindClose (in: hFindFile=0x79fba8 | out: hFindFile=0x79fba8) returned 1
	[0233.258] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\ko\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\ko\\filesync.localizedresources.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1246a1e8 | out: lpFileInformation=0x1246a1e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97a3ea55, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x97a3ea55, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x97edd415, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0xf2c0)) returned 1
	[0233.258] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\kok" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\kok"), fInfoLevelId=0x0, lpFileInformation=0x1246a238 | out: lpFileInformation=0x1246a238*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x980cd2db, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x980cd2db, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x980cd2db, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.259] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\kok" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\kok"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.261] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\kok\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x980cd2db, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x980cd2db, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x980cd2db, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fca8
	[0233.262] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x980cd2db, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x980cd2db, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x980cd2db, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.262] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.262] FindClose (in: hFindFile=0x79fca8 | out: hFindFile=0x79fca8) returned 1
	[0233.262] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1"), fInfoLevelId=0x0, lpFileInformation=0x1246a288 | out: lpFileInformation=0x1246a288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13a98591, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x27e196bc, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x27e196bc, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.262] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.262] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13a98591, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x27e196bc, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x27e196bc, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fa68
	[0233.290] SetEvent (hEvent=0x168) returned 1
	[0233.290] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13a98591, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x27e196bc, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x27e196bc, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.290] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13d93484, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x13d93484, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x13ec46bb, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x123c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoPlayLogo.png", cAlternateFileName="AUTOPL~1.PNG")) returned 1
	[0233.290] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x141bf54b, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x141bf54b, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x14742dc7, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x5d8f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoPlayOptIn.gif", cAlternateFileName="AUTOPL~1.GIF")) returned 1
	[0233.291] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x149cb56a, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x149cb56a, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x14e439d9, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x27f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoPlayOptIn.png", cAlternateFileName="AUTOPL~2.PNG")) returned 1
	[0233.291] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1513eaa7, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1513eaa7, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1526fd00, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x16da, dwReserved0=0x0, dwReserved1=0x0, cFileName="CollectOneDriveLogs.bat", cAlternateFileName="COLLEC~1.BAT")) returned 1
	[0233.291] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1583f985, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1583f985, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x15a2f89d, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x72c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETWlog.dll", cAlternateFileName="")) returned 1
	[0233.291] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15de92d7, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x15de92d7, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x15f66b03, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x4e5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExclusionList.xml", cAlternateFileName="EXCLUS~1.XML")) returned 1
	[0233.291] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16071ad7, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x16071ad7, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x161c908f, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x140c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll", cAlternateFileName="FILESY~1.DLL")) returned 1
	[0233.291] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x164ea204, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x164ea204, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1ba724f0, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x28d8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.Resources.dll", cAlternateFileName="FILESY~2.DLL")) returned 1
	[0233.291] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c4220a6, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1c4220a6, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1d118c6c, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x362c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncApi.dll", cAlternateFileName="FILESY~3.DLL")) returned 1
	[0233.291] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21721d25, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x21721d25, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x218eb79d, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x1d9ec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncClient.dll", cAlternateFileName="FILESY~4.DLL")) returned 1
	[0233.291] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27e196bc, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x27e196bc, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x27eb206a, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x238c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncConfig.exe", cAlternateFileName="FILESY~1.EXE")) returned 1
	[0233.291] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13d93484, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x13d93484, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x13d93484, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="is", cAlternateFileName="")) returned 1
	[0233.291] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x146118b3, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x146118b3, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x146118b3, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1
	[0233.291] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x153086e5, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x153086e5, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x153086e5, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1
	[0233.291] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15e0f45b, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x15e0f45b, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x15e0f45b, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ka", cAlternateFileName="")) returned 1
	[0233.291] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16582b22, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x16582b22, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x16582b22, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kk", cAlternateFileName="")) returned 1
	[0233.291] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x173aa99c, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x173aa99c, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x173aa99c, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="km-kh", cAlternateFileName="")) returned 1
	[0233.291] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18b820b8, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x18b820b8, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x18b820b8, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kn", cAlternateFileName="")) returned 1
	[0233.291] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a48ae1d, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1a48ae1d, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1a48ae1d, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1
	[0233.292] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a975942, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1a975942, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1a975942, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kok", cAlternateFileName="")) returned 1
	[0233.292] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ae142b4, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1ae142b4, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1ae142b4, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ku-arab", cAlternateFileName="")) returned 1
	[0233.292] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b37172b, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1b37172b, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1b37172b, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ky", cAlternateFileName="")) returned 1
	[0233.292] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b6464e2, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1b6464e2, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1b6464e2, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lb-lu", cAlternateFileName="")) returned 1
	[0233.292] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c4ba8d9, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1c4ba8d9, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1c4ba8d9, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1
	[0233.292] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x246849d3, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x246849d3, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x246849d3, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1
	[0233.292] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.292] FindClose (in: hFindFile=0x79fa68 | out: hFindFile=0x79fa68) returned 1
	[0233.293] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayLogo.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplaylogo.png"), fInfoLevelId=0x0, lpFileInformation=0x1246aaa8 | out: lpFileInformation=0x1246aaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13d93484, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x13d93484, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x13ec46bb, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x123c)) returned 1
	[0233.294] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayOptIn.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplayoptin.gif"), fInfoLevelId=0x0, lpFileInformation=0x1246aaf8 | out: lpFileInformation=0x1246aaf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x141bf54b, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x141bf54b, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x14742dc7, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x5d8f6)) returned 1
	[0233.295] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayOptIn.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplayoptin.png"), fInfoLevelId=0x0, lpFileInformation=0x1246ab48 | out: lpFileInformation=0x1246ab48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x149cb56a, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x149cb56a, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x14e439d9, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x27f2)) returned 1
	[0233.296] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\CollectOneDriveLogs.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\collectonedrivelogs.bat"), fInfoLevelId=0x0, lpFileInformation=0x1246ab98 | out: lpFileInformation=0x1246ab98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1513eaa7, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1513eaa7, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1526fd00, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x16da)) returned 1
	[0233.297] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\ETWlog.dll" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\etwlog.dll"), fInfoLevelId=0x0, lpFileInformation=0x1246abe8 | out: lpFileInformation=0x1246abe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1583f985, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1583f985, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x15a2f89d, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x72c0)) returned 1
	[0233.297] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\ExclusionList.xml" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\exclusionlist.xml"), fInfoLevelId=0x0, lpFileInformation=0x1246ac38 | out: lpFileInformation=0x1246ac38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15de92d7, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x15de92d7, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x15f66b03, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x4e5f)) returned 1
	[0233.299] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSync.LocalizedResources.dll" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\filesync.localizedresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x1246ac88 | out: lpFileInformation=0x1246ac88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16071ad7, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x16071ad7, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x161c908f, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x140c0)) returned 1
	[0233.300] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSync.Resources.dll" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\filesync.resources.dll"), fInfoLevelId=0x0, lpFileInformation=0x1246acd8 | out: lpFileInformation=0x1246acd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x164ea204, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x164ea204, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1ba724f0, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x28d8c0)) returned 1
	[0233.300] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSyncApi.dll" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\filesyncapi.dll"), fInfoLevelId=0x0, lpFileInformation=0x1246ad28 | out: lpFileInformation=0x1246ad28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c4220a6, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1c4220a6, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1d118c6c, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x362c0)) returned 1
	[0233.301] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSyncClient.dll" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\filesyncclient.dll"), fInfoLevelId=0x0, lpFileInformation=0x1246ad78 | out: lpFileInformation=0x1246ad78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21721d25, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x21721d25, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x218eb79d, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x1d9ec0)) returned 1
	[0233.303] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSyncConfig.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\filesyncconfig.exe"), fInfoLevelId=0x0, lpFileInformation=0x1246adc8 | out: lpFileInformation=0x1246adc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27e196bc, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x27e196bc, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x27eb206a, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x238c0)) returned 1
	[0233.303] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\is" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\is"), fInfoLevelId=0x0, lpFileInformation=0x1246ae18 | out: lpFileInformation=0x1246ae18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13d93484, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1425801e, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1425801e, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.303] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\is" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\is"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.304] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\is\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13d93484, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x13d93484, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1425801e, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fc68
	[0233.304] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13d93484, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x13d93484, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1425801e, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.304] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1425801e, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1425801e, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x146118b3, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x152c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0233.304] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.304] FindClose (in: hFindFile=0x79fc68 | out: hFindFile=0x79fc68) returned 1
	[0233.304] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\is\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\is\\filesync.localizedresources.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1246aeb8 | out: lpFileInformation=0x1246aeb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1425801e, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1425801e, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x146118b3, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x152c0)) returned 1
	[0233.304] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\it" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\it"), fInfoLevelId=0x0, lpFileInformation=0x1246af08 | out: lpFileInformation=0x1246af08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x146118b3, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x14a89f12, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x14a89f12, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.304] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\it" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\it"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.304] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\it\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x146118b3, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x146118b3, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x14a89f12, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fa28
	[0233.305] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x146118b3, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x146118b3, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x14a89f12, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.305] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a89f12, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x14a89f12, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x151d75c6, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x160c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0233.305] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.305] FindClose (in: hFindFile=0x79fa28 | out: hFindFile=0x79fa28) returned 1
	[0233.305] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\it\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\it\\filesync.localizedresources.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1246afa8 | out: lpFileInformation=0x1246afa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a89f12, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x14a89f12, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x151d75c6, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x160c0)) returned 1
	[0233.305] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\ja" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\ja"), fInfoLevelId=0x0, lpFileInformation=0x1246aff8 | out: lpFileInformation=0x1246aff8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x153086e5, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x158d8246, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x158d8246, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.305] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\ja" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\ja"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.305] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\ja\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x153086e5, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x153086e5, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x158d8246, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0028
	[0233.306] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x153086e5, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x153086e5, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x158d8246, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.306] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x158d8246, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x158d8246, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x15bf948f, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0xfcc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0233.306] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.306] FindClose (in: hFindFile=0x7a0028 | out: hFindFile=0x7a0028) returned 1
	[0233.306] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\ja\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\ja\\filesync.localizedresources.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1246b098 | out: lpFileInformation=0x1246b098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x158d8246, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x158d8246, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x15bf948f, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0xfcc0)) returned 1
	[0233.307] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\ka" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\ka"), fInfoLevelId=0x0, lpFileInformation=0x1246b0e8 | out: lpFileInformation=0x1246b0e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15e0f45b, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1610a43c, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1610a43c, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.307] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\ka" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\ka"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.307] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\ka\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15e0f45b, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x15e0f45b, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1610a43c, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ff28
	[0233.307] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15e0f45b, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x15e0f45b, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1610a43c, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.307] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1610a43c, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1610a43c, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x16392bdd, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x164c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0233.307] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.308] FindClose (in: hFindFile=0x79ff28 | out: hFindFile=0x79ff28) returned 1
	[0233.308] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\ka\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\ka\\filesync.localizedresources.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1246b188 | out: lpFileInformation=0x1246b188*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1610a43c, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1610a43c, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x16392bdd, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x164c0)) returned 1
	[0233.308] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\kk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\kk"), fInfoLevelId=0x0, lpFileInformation=0x1246b1d8 | out: lpFileInformation=0x1246b1d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16582b22, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x169161d2, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x169161d2, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.308] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\kk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\kk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.308] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\kk\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16582b22, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x16582b22, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x169161d2, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0068
	[0233.308] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16582b22, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x16582b22, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x169161d2, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.308] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x169161d2, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x169161d2, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x17206ef6, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x160c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0233.308] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.309] FindClose (in: hFindFile=0x7a0068 | out: hFindFile=0x7a0068) returned 1
	[0233.309] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\kk\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\kk\\filesync.localizedresources.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1246b278 | out: lpFileInformation=0x1246b278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x169161d2, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x169161d2, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x17206ef6, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x160c0)) returned 1
	[0233.309] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\km-kh" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\km-kh"), fInfoLevelId=0x0, lpFileInformation=0x1246b2c8 | out: lpFileInformation=0x1246b2c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x173aa99c, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x17f23e2a, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x17f23e2a, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.310] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\km-kh" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\km-kh"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.310] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\km-kh\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x173aa99c, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x173aa99c, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x17f23e2a, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fea8
	[0233.310] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x173aa99c, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x173aa99c, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x17f23e2a, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.310] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17f23e2a, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x17f23e2a, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x189de896, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x156c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0233.310] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.310] FindClose (in: hFindFile=0x79fea8 | out: hFindFile=0x79fea8) returned 1
	[0233.310] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\km-kh\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\km-kh\\filesync.localizedresources.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1246b368 | out: lpFileInformation=0x1246b368*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17f23e2a, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x17f23e2a, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x189de896, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x156c0)) returned 1
	[0233.311] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\kn" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\kn"), fInfoLevelId=0x0, lpFileInformation=0x1246b3b8 | out: lpFileInformation=0x1246b3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18b820b8, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1989ef6a, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1989ef6a, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.312] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\kn" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\kn"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.312] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\kn\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18b820b8, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x18b820b8, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1989ef6a, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fba8
	[0233.312] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18b820b8, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x18b820b8, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1989ef6a, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.312] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1989ef6a, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1989ef6a, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1a464b30, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x172c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0233.312] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.313] FindClose (in: hFindFile=0x79fba8 | out: hFindFile=0x79fba8) returned 1
	[0233.313] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\kn\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\kn\\filesync.localizedresources.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1246b458 | out: lpFileInformation=0x1246b458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1989ef6a, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1989ef6a, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1a464b30, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x172c0)) returned 1
	[0233.313] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\ko" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\ko"), fInfoLevelId=0x0, lpFileInformation=0x1246b4a8 | out: lpFileInformation=0x1246b4a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a48ae1d, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1a7abf56, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1a7abf56, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.314] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\ko" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\ko"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.314] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\ko\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a48ae1d, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1a48ae1d, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1a7abf56, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f968
	[0233.314] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a48ae1d, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1a48ae1d, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1a7abf56, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.314] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a7abf56, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1a7abf56, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1a94f788, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0xf2c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0233.314] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.314] FindClose (in: hFindFile=0x79f968 | out: hFindFile=0x79f968) returned 1
	[0233.314] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\ko\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\ko\\filesync.localizedresources.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1246b548 | out: lpFileInformation=0x1246b548*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a7abf56, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1a7abf56, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1a94f788, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0xf2c0)) returned 1
	[0233.315] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\kok" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\kok"), fInfoLevelId=0x0, lpFileInformation=0x1246b598 | out: lpFileInformation=0x1246b598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a975942, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1ac24464, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1ac24464, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.315] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\kok" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\kok"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.315] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\kok\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a975942, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1a975942, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1ac24464, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fae8
	[0233.315] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a975942, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1a975942, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1ac24464, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.315] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ac24464, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1ac24464, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1ad092fa, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x156c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0233.315] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.316] FindClose (in: hFindFile=0x79fae8 | out: hFindFile=0x79fae8) returned 1
	[0233.316] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\kok\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\kok\\filesync.localizedresources.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1246b638 | out: lpFileInformation=0x1246b638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ac24464, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1ac24464, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1ad092fa, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x156c0)) returned 1
	[0233.316] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\ku-arab" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\ku-arab"), fInfoLevelId=0x0, lpFileInformation=0x1246b688 | out: lpFileInformation=0x1246b688*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ae142b4, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1b1a7cae, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1b1a7cae, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.316] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\ku-arab" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\ku-arab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.316] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\ku-arab\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ae142b4, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1ae142b4, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1b1a7cae, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fce8
	[0233.316] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ae142b4, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1ae142b4, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1b1a7cae, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.316] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b1a7cae, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1b1a7cae, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1b2b2bd5, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x15cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0233.316] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.316] FindClose (in: hFindFile=0x79fce8 | out: hFindFile=0x79fce8) returned 1
	[0233.316] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\ku-arab\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\ku-arab\\filesync.localizedresources.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1246b728 | out: lpFileInformation=0x1246b728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b1a7cae, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1b1a7cae, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1b2b2bd5, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x15cc0)) returned 1
	[0233.317] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\ky" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\ky"), fInfoLevelId=0x0, lpFileInformation=0x1246b778 | out: lpFileInformation=0x1246b778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b37172b, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1b587918, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1b587918, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.317] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\ky" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\ky"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.318] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\ky\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b37172b, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1b37172b, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1b587918, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ff68
	[0233.318] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b37172b, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1b37172b, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1b587918, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.318] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b587918, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1b587918, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1b6464e2, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x15ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0233.318] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.318] FindClose (in: hFindFile=0x79ff68 | out: hFindFile=0x79ff68) returned 1
	[0233.318] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\ky\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\ky\\filesync.localizedresources.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1246b818 | out: lpFileInformation=0x1246b818*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b587918, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1b587918, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1b6464e2, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x15ac0)) returned 1
	[0233.318] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\lb-lu" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\lb-lu"), fInfoLevelId=0x0, lpFileInformation=0x1246b868 | out: lpFileInformation=0x1246b868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b6464e2, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1b91b09f, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1b91b09f, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.319] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\lb-lu" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\lb-lu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.319] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\lb-lu\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b6464e2, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1b6464e2, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1b91b09f, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ff68
	[0233.319] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b6464e2, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1b6464e2, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1b91b09f, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.319] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b91b09f, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1b91b09f, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1bf10fb1, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x174c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0233.319] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.319] FindClose (in: hFindFile=0x79ff68 | out: hFindFile=0x79ff68) returned 1
	[0233.319] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\lb-lu\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\lb-lu\\filesync.localizedresources.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1246b908 | out: lpFileInformation=0x1246b908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b91b09f, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1b91b09f, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1bf10fb1, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x174c0)) returned 1
	[0233.319] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\lt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\lt"), fInfoLevelId=0x0, lpFileInformation=0x1246b958 | out: lpFileInformation=0x1246b958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c4ba8d9, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1c5eb9fa, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1c5eb9fa, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.320] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\lt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\lt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.320] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\lt\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c4ba8d9, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1c4ba8d9, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1c5eb9fa, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0068
	[0233.320] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c4ba8d9, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1c4ba8d9, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1c5eb9fa, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.320] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c5eb9fa, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1c5eb9fa, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1df1a8aa, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x160c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0233.320] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.320] FindClose (in: hFindFile=0x7a0068 | out: hFindFile=0x7a0068) returned 1
	[0233.320] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\lt\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\lt\\filesync.localizedresources.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1246b9f8 | out: lpFileInformation=0x1246b9f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c5eb9fa, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1c5eb9fa, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1df1a8aa, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x160c0)) returned 1
	[0233.320] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\lv" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\lv"), fInfoLevelId=0x0, lpFileInformation=0x1246ba48 | out: lpFileInformation=0x1246ba48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x246849d3, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x29b4e321, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x29b4e321, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.321] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\lv" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\lv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.321] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\lv\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x246849d3, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x246849d3, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x29b4e321, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fea8
	[0233.321] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x246849d3, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x246849d3, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x29b4e321, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.321] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29b4e321, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x29b4e321, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x2b646bb1, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0233.321] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.321] FindClose (in: hFindFile=0x79fea8 | out: hFindFile=0x79fea8) returned 1
	[0233.321] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\lv\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\lv\\filesync.localizedresources.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1246bae8 | out: lpFileInformation=0x1246bae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29b4e321, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x29b4e321, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x2b646bb1, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1
	[0233.322] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2"), fInfoLevelId=0x0, lpFileInformation=0x1246bb38 | out: lpFileInformation=0x1246bb38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf111177, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1bc7bb71, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x1bc7bb71, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.322] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.322] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf111177, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x19a81fc0, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x1bc7bb71, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fae8
	[0233.324] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf111177, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x19a81fc0, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x1bc7bb71, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.326] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd25ab06c, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xd25ab06c, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xd29d7222, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x123c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoPlayLogo.png", cAlternateFileName="AUTOPL~1.PNG")) returned 1
	[0233.326] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5dd86f0, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xd5dd86f0, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xd5e70f71, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x5d8f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoPlayOptIn.gif", cAlternateFileName="AUTOPL~1.GIF")) returned 1
	[0233.326] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda5ab377, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xda5ab377, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xda8f2699, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x27f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoPlayOptIn.png", cAlternateFileName="AUTOPL~2.PNG")) returned 1
	[0233.326] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbb92c03, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xdbb92c03, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xdc26d7fb, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x16da, dwReserved0=0x0, dwReserved1=0x0, cFileName="CollectOneDriveLogs.bat", cAlternateFileName="COLLEC~1.BAT")) returned 1
	[0233.326] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd4e444, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xdcd4e444, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xdd66554a, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x72c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETWlog.dll", cAlternateFileName="")) returned 1
	[0233.326] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42ba1e4, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xe42ba1e4, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xe7c64fd5, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x4e5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExclusionList.xml", cAlternateFileName="EXCLUS~1.XML")) returned 1
	[0233.327] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb1bd98b, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xeb1bd98b, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xeb3ad73a, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x140c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll", cAlternateFileName="FILESY~1.DLL")) returned 1
	[0233.327] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc43b7e, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xecc43b7e, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xf5c4b24e, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x28d8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.Resources.dll", cAlternateFileName="FILESY~2.DLL")) returned 1
	[0233.327] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf77c8633, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xf77c8633, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xf7d9801d, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x362c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncApi.dll", cAlternateFileName="FILESY~3.DLL")) returned 1
	[0233.327] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8878a7e, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xf8878a7e, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xfc424655, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x1d9ec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncClient.dll", cAlternateFileName="FILESY~4.DLL")) returned 1
	[0233.327] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcbbde9d, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xfcbbde9d, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xfd2fec9b, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x238c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncConfig.exe", cAlternateFileName="FILESY~1.EXE")) returned 1
	[0233.327] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd704ae4, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xfd704ae4, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x23231a2, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x1464c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncSessions.dll", cAlternateFileName="FIFC38~1.DLL")) returned 1
	[0233.327] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2454520, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x2454520, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x253922a, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x182cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSyncShell.dll", cAlternateFileName="FI340C~1.DLL")) returned 1
	[0233.327] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2538864, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xd2538864, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xd2538864, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="is", cAlternateFileName="")) returned 1
	[0233.327] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdab2e911, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xdab2e911, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xdab2e911, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1
	[0233.327] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe210ce16, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xe210ce16, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xe210ce16, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1
	[0233.327] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecf187d5, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xecf187d5, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xecf187d5, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ka", cAlternateFileName="")) returned 1
	[0233.327] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedade28a, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xedade28a, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xedade28a, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kk", cAlternateFileName="")) returned 1
	[0233.327] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee3f513b, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xee3f513b, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xee3f513b, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="km-kh", cAlternateFileName="")) returned 1
	[0233.327] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef1846bf, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xef1846bf, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xef1846bf, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kn", cAlternateFileName="")) returned 1
	[0233.327] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e933a5, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xf0e933a5, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xf0e933a5, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1
	[0233.327] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2002503, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xf2002503, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xf2002503, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kok", cAlternateFileName="")) returned 1
	[0233.328] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf25ac394, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xf25ac394, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xf25ac394, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ku-arab", cAlternateFileName="")) returned 1
	[0233.328] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf79de4ea, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xf79de4ea, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xf79de4ea, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ky", cAlternateFileName="")) returned 1
	[0233.328] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf89aa04e, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xf89aa04e, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xf89aa04e, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lb-lu", cAlternateFileName="")) returned 1
	[0233.328] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32eeba5, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x32eeba5, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x4889ef2, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x1a8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LoggingPlatform.dll", cAlternateFileName="LOGGIN~1.DLL")) returned 1
	[0233.328] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9739439, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xf9739439, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xf9739439, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1
	[0233.328] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb006851, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xfb006851, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xfb006851, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1
	[0233.328] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb969ac6, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xfb969ac6, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xfb969ac6, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mi-nz", cAlternateFileName="")) returned 1
	[0233.328] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc090d46, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xfc090d46, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xfc090d46, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mk", cAlternateFileName="")) returned 1
	[0233.328] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc71f7fa, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xfc71f7fa, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xfc71f7fa, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ml-in", cAlternateFileName="")) returned 1
	[0233.328] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd587570, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xfd587570, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xfd587570, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mn", cAlternateFileName="")) returned 1
	[0233.328] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe46dff5, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xfe46dff5, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xfe46dff5, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mr", cAlternateFileName="")) returned 1
	[0233.328] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffc1f3cf, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xffc1f3cf, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xffc1f3cf, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1
	[0233.328] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67fb07e, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x67fb07e, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xae9cb73, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x6f2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp120.dll", cAlternateFileName="")) returned 1
	[0233.329] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbb9ac6, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xbbb9ac6, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xddeae4a, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0xed0a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr120.dll", cAlternateFileName="")) returned 1
	[0233.329] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e38526, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x1e38526, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x1e38526, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mt-mt", cAlternateFileName="")) returned 1
	[0233.329] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f00a8b, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x3f00a8b, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x3f00a8b, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1
	[0233.329] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a4f09e, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x7a4f09e, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x7a4f09e, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ne-np", cAlternateFileName="")) returned 1
	[0233.329] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0c0f2f, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xa0c0f2f, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xa0c0f2f, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1
	[0233.329] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5515c4, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xb5515c4, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xb5515c4, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nn-no", cAlternateFileName="")) returned 1
	[0233.329] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc593d87, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xc593d87, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xc593d87, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nso-za", cAlternateFileName="")) returned 1
	[0233.330] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f40d, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xe50f40d, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xefa8864, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x5d4c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive.exe", cAlternateFileName="")) returned 1
	[0233.330] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd63fe7d, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xd63fe7d, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xd63fe7d, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="or-in", cAlternateFileName="")) returned 1
	[0233.330] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdee5c50, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xdee5c50, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xdee5c50, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pa", cAlternateFileName="")) returned 1
	[0233.330] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d91fe, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xe6d91fe, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xe6d91fe, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pa-arab", cAlternateFileName="")) returned 1
	[0233.330] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcc5962, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xfcc5962, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xfcc5962, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pa-arab-pk", cAlternateFileName="PA-ARA~1")) returned 1
	[0233.330] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10bd26fa, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x10bd26fa, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x10bd26fa, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1
	[0233.330] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x116ff8a5, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x116ff8a5, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x116ff8a5, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="prs-af", cAlternateFileName="")) returned 1
	[0233.330] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x130c8fc0, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x130c8fc0, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x130c8fc0, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1
	[0233.330] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13646246, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x13646246, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x13646246, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-pt", cAlternateFileName="")) returned 1
	[0233.330] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13e9e78d, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x13e9e78d, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x13e9e78d, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qut-latn", cAlternateFileName="")) returned 1
	[0233.330] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14933008, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x14933008, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x14933008, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="quz-pe", cAlternateFileName="")) returned 1
	[0233.330] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1018a7a5, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x1018a7a5, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x1149d5d9, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0xa0ec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RemoteAccess.dll", cAlternateFileName="REMOTE~1.DLL")) returned 1
	[0233.330] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16b45b0a, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x16b45b0a, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x16b45b0a, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1
	[0233.330] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x172deef5, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x172deef5, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x172deef5, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1
	[0233.330] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bf5de5, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x17bf5de5, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x17bf5de5, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rw", cAlternateFileName="")) returned 1
	[0233.330] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x126710a5, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x126710a5, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x130c8fc0, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x124b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ScreenshotLogo.png", cAlternateFileName="SCREEN~1.PNG")) returned 1
	[0233.330] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1347c6a3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x1347c6a3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x140b472d, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x6c00a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ScreenshotOptIn.png", cAlternateFileName="SCREEN~2.PNG")) returned 1
	[0233.330] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1986bebc, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x1986bebc, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x1986bebc, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sd-arab", cAlternateFileName="")) returned 1
	[0233.330] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1bc7bb71, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x1bc7bb71, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x1bc7bb71, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sd-arab-pk", cAlternateFileName="SD-ARA~1")) returned 1
	[0233.330] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1478f592, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x1478f592, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x149cb731, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x2ff40, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1
	[0233.330] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16909517, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x16909517, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x16c7693c, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x9ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SqmWrapper.dll", cAlternateFileName="SQMWRA~1.DLL")) returned 1
	[0233.330] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17410332, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x17410332, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x1c297983, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x130000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SyncEngine.dll", cAlternateFileName="SYNCEN~1.DLL")) returned 1
	[0233.330] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.331] FindClose (in: hFindFile=0x79fae8 | out: hFindFile=0x79fae8) returned 1
	[0233.333] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\AutoPlayLogo.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\autoplaylogo.png"), fInfoLevelId=0x0, lpFileInformation=0x1260afa8 | out: lpFileInformation=0x1260afa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd25ab06c, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xd25ab06c, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xd29d7222, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x123c)) returned 1
	[0233.334] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\AutoPlayOptIn.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\autoplayoptin.gif"), fInfoLevelId=0x0, lpFileInformation=0x1260aff8 | out: lpFileInformation=0x1260aff8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5dd86f0, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xd5dd86f0, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xd5e70f71, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x5d8f6)) returned 1
	[0233.334] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\AutoPlayOptIn.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\autoplayoptin.png"), fInfoLevelId=0x0, lpFileInformation=0x1260b048 | out: lpFileInformation=0x1260b048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda5ab377, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xda5ab377, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xda8f2699, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x27f2)) returned 1
	[0233.334] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\CollectOneDriveLogs.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\collectonedrivelogs.bat"), fInfoLevelId=0x0, lpFileInformation=0x1260b098 | out: lpFileInformation=0x1260b098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbb92c03, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xdbb92c03, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xdc26d7fb, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x16da)) returned 1
	[0233.339] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\ETWlog.dll" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\etwlog.dll"), fInfoLevelId=0x0, lpFileInformation=0x1260b0e8 | out: lpFileInformation=0x1260b0e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd4e444, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xdcd4e444, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xdd66554a, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x72c0)) returned 1
	[0233.339] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\ExclusionList.xml" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\exclusionlist.xml"), fInfoLevelId=0x0, lpFileInformation=0x1260b138 | out: lpFileInformation=0x1260b138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42ba1e4, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xe42ba1e4, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xe7c64fd5, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x4e5f)) returned 1
	[0233.339] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\FileSync.LocalizedResources.dll" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\filesync.localizedresources.dll"), fInfoLevelId=0x0, lpFileInformation=0x1260b188 | out: lpFileInformation=0x1260b188*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb1bd98b, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xeb1bd98b, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xeb3ad73a, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x140c0)) returned 1
	[0233.339] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\FileSync.Resources.dll" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\filesync.resources.dll"), fInfoLevelId=0x0, lpFileInformation=0x1260b1d8 | out: lpFileInformation=0x1260b1d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc43b7e, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xecc43b7e, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xf5c4b24e, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x28d8c0)) returned 1
	[0233.341] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\FileSyncApi.dll" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\filesyncapi.dll"), fInfoLevelId=0x0, lpFileInformation=0x1260b228 | out: lpFileInformation=0x1260b228*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf77c8633, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xf77c8633, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xf7d9801d, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x362c0)) returned 1
	[0233.341] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\FileSyncClient.dll" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\filesyncclient.dll"), fInfoLevelId=0x0, lpFileInformation=0x1260b278 | out: lpFileInformation=0x1260b278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8878a7e, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xf8878a7e, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xfc424655, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x1d9ec0)) returned 1
	[0233.342] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\FileSyncConfig.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\filesyncconfig.exe"), fInfoLevelId=0x0, lpFileInformation=0x1260b2c8 | out: lpFileInformation=0x1260b2c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcbbde9d, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xfcbbde9d, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xfd2fec9b, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x238c0)) returned 1
	[0233.342] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\FileSyncSessions.dll" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\filesyncsessions.dll"), fInfoLevelId=0x0, lpFileInformation=0x1260b318 | out: lpFileInformation=0x1260b318*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd704ae4, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xfd704ae4, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x23231a2, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x1464c0)) returned 1
	[0233.343] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\FileSyncShell.dll" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\filesyncshell.dll"), fInfoLevelId=0x0, lpFileInformation=0x1260b368 | out: lpFileInformation=0x1260b368*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2454520, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x2454520, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x253922a, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x182cc0)) returned 1
	[0233.344] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\LoggingPlatform.dll" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\loggingplatform.dll"), fInfoLevelId=0x0, lpFileInformation=0x1260b3b8 | out: lpFileInformation=0x1260b3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32eeba5, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x32eeba5, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x4889ef2, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x1a8c0)) returned 1
	[0233.344] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\OneDrive.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\onedrive.exe"), fInfoLevelId=0x0, lpFileInformation=0x1260b408 | out: lpFileInformation=0x1260b408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f40d, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xe50f40d, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xefa8864, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x5d4c0)) returned 1
	[0233.344] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\RemoteAccess.dll" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\remoteaccess.dll"), fInfoLevelId=0x0, lpFileInformation=0x1260b458 | out: lpFileInformation=0x1260b458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1018a7a5, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x1018a7a5, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x1149d5d9, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0xa0ec0)) returned 1
	[0233.344] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\ScreenshotLogo.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\screenshotlogo.png"), fInfoLevelId=0x0, lpFileInformation=0x1260b4a8 | out: lpFileInformation=0x1260b4a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x126710a5, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x126710a5, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x130c8fc0, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x124b)) returned 1
	[0233.344] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\ScreenshotOptIn.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\screenshotoptin.png"), fInfoLevelId=0x0, lpFileInformation=0x1260b4f8 | out: lpFileInformation=0x1260b4f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1347c6a3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x1347c6a3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x140b472d, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x6c00a)) returned 1
	[0233.344] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\SqmWrapper.dll" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\sqmwrapper.dll"), fInfoLevelId=0x0, lpFileInformation=0x1260b548 | out: lpFileInformation=0x1260b548*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16909517, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x16909517, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x16c7693c, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x9ac0)) returned 1
	[0233.345] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\SyncEngine.dll" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\syncengine.dll"), fInfoLevelId=0x0, lpFileInformation=0x1260b598 | out: lpFileInformation=0x1260b598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17410332, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x17410332, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x1c297983, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x130000)) returned 1
	[0233.346] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\is" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\is"), fInfoLevelId=0x0, lpFileInformation=0x1260b5e8 | out: lpFileInformation=0x1260b5e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2538864, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xd779fe38, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xd779fe38, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.346] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\is" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\is"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.346] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\is\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2538864, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xd2538864, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xd779fe38, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fe28
	[0233.346] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2538864, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xd2538864, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xd779fe38, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.347] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd779fe38, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xd779fe38, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xda79b1fb, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x152c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0233.347] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.347] FindClose (in: hFindFile=0x79fe28 | out: hFindFile=0x79fe28) returned 1
	[0233.347] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\is\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\is\\filesync.localizedresources.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1260b688 | out: lpFileInformation=0x1260b688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd779fe38, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xd779fe38, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xda79b1fb, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x152c0)) returned 1
	[0233.350] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\it" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\it"), fInfoLevelId=0x0, lpFileInformation=0x1260b6d8 | out: lpFileInformation=0x1260b6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdab2e911, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xdbda8c94, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xdbda8c94, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.350] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\it" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\it"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.350] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\it\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdab2e911, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xdab2e911, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xdbda8c94, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fe68
	[0233.350] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdab2e911, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xdab2e911, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xdbda8c94, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.350] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbda8c94, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xdbda8c94, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xdce33339, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x160c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0233.350] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.350] FindClose (in: hFindFile=0x79fe68 | out: hFindFile=0x79fe68) returned 1
	[0233.350] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\it\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\it\\filesync.localizedresources.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1260b778 | out: lpFileInformation=0x1260b778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbda8c94, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xdbda8c94, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xdce33339, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x160c0)) returned 1
	[0233.351] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\ja" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\ja"), fInfoLevelId=0x0, lpFileInformation=0x1260b7c8 | out: lpFileInformation=0x1260b7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe210ce16, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xec58f0d9, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xec58f0d9, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.351] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\ja" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\ja"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.351] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\ja\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe210ce16, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xe210ce16, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xec58f0d9, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f8e8
	[0233.351] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe210ce16, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xe210ce16, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xec58f0d9, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.351] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec58f0d9, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xec58f0d9, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xec9e1598, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0xfcc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0233.351] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.351] FindClose (in: hFindFile=0x79f8e8 | out: hFindFile=0x79f8e8) returned 1
	[0233.352] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\ja\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\ja\\filesync.localizedresources.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1260b868 | out: lpFileInformation=0x1260b868*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec58f0d9, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xec58f0d9, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xec9e1598, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0xfcc0)) returned 1
	[0233.352] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\ka" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\ka"), fInfoLevelId=0x0, lpFileInformation=0x1260b8b8 | out: lpFileInformation=0x1260b8b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecf187d5, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xed5cd1ea, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xed5cd1ea, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.354] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\ka" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\ka"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.354] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\ka\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecf187d5, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xecf187d5, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xed5cd1ea, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fb68
	[0233.354] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecf187d5, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xecf187d5, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xed5cd1ea, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.354] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed5cd1ea, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xed5cd1ea, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xeda459b8, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x164c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0233.354] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.354] FindClose (in: hFindFile=0x79fb68 | out: hFindFile=0x79fb68) returned 1
	[0233.354] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\ka\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\ka\\filesync.localizedresources.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1260b958 | out: lpFileInformation=0x1260b958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed5cd1ea, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xed5cd1ea, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xeda459b8, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x164c0)) returned 1
	[0233.354] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\kk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\kk"), fInfoLevelId=0x0, lpFileInformation=0x1260b9a8 | out: lpFileInformation=0x1260b9a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedade28a, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xede4b9d3, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xede4b9d3, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.354] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\kk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\kk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.355] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\kk\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedade28a, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xedade28a, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xede4b9d3, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ff68
	[0233.355] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedade28a, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xedade28a, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xede4b9d3, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.355] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede4b9d3, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xede4b9d3, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xee29dc95, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x160c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0233.355] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.355] FindClose (in: hFindFile=0x79ff68 | out: hFindFile=0x79ff68) returned 1
	[0233.355] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\kk\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\kk\\filesync.localizedresources.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1260ba48 | out: lpFileInformation=0x1260ba48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede4b9d3, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xede4b9d3, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xee29dc95, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x160c0)) returned 1
	[0233.355] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\km-kh" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\km-kh"), fInfoLevelId=0x0, lpFileInformation=0x1260ba98 | out: lpFileInformation=0x1260ba98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee3f513b, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xeea3742a, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xeea3742a, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.356] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\km-kh" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\km-kh"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.356] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\km-kh\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee3f513b, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xee3f513b, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xeea3742a, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fbe8
	[0233.356] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee3f513b, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xee3f513b, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xeea3742a, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.356] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea3742a, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xeea3742a, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xef0c5c11, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x156c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0233.357] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.357] FindClose (in: hFindFile=0x79fbe8 | out: hFindFile=0x79fbe8) returned 1
	[0233.357] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\km-kh\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\km-kh\\filesync.localizedresources.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1260bb38 | out: lpFileInformation=0x1260bb38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea3742a, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xeea3742a, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xef0c5c11, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x156c0)) returned 1
	[0233.357] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\kn" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\kn"), fInfoLevelId=0x0, lpFileInformation=0x1260bb88 | out: lpFileInformation=0x1260bb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef1846bf, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xf0497564, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xf0497564, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.358] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\kn" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\kn"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.358] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\kn\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef1846bf, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xef1846bf, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xf0497564, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fa68
	[0233.358] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef1846bf, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xef1846bf, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xf0497564, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.358] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0497564, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xf0497564, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xf0dfa874, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x172c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0233.358] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.358] FindClose (in: hFindFile=0x79fa68 | out: hFindFile=0x79fa68) returned 1
	[0233.358] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\kn\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\kn\\filesync.localizedresources.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1260bc28 | out: lpFileInformation=0x1260bc28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0497564, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xf0497564, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xf0dfa874, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x172c0)) returned 1
	[0233.359] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\ko" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\ko"), fInfoLevelId=0x0, lpFileInformation=0x1260bc78 | out: lpFileInformation=0x1260bc78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e933a5, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xf1bfc6d0, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xf1bfc6d0, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.359] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\ko" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\ko"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.359] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\ko\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e933a5, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xf0e933a5, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xf1bfc6d0, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79faa8
	[0233.360] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e933a5, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xf0e933a5, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xf1bfc6d0, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.360] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1bfc6d0, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xf1bfc6d0, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xf1f43a35, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0xf2c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0233.360] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.360] FindClose (in: hFindFile=0x79faa8 | out: hFindFile=0x79faa8) returned 1
	[0233.360] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\ko\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\ko\\filesync.localizedresources.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1260bd18 | out: lpFileInformation=0x1260bd18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1bfc6d0, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xf1bfc6d0, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xf1f43a35, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0xf2c0)) returned 1
	[0233.360] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\kok" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\kok"), fInfoLevelId=0x0, lpFileInformation=0x1260bd68 | out: lpFileInformation=0x1260bd68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2002503, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xf223ea69, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xf223ea69, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.360] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\kok" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\kok"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.360] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\kok\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2002503, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xf2002503, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xf223ea69, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fca8
	[0233.360] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2002503, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xf2002503, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xf223ea69, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.360] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf223ea69, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xf223ea69, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xf24ed57a, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x156c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0233.360] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.360] FindClose (in: hFindFile=0x79fca8 | out: hFindFile=0x79fca8) returned 1
	[0233.361] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\kok\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\kok\\filesync.localizedresources.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1260be08 | out: lpFileInformation=0x1260be08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf223ea69, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xf223ea69, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xf24ed57a, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x156c0)) returned 1
	[0233.361] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\ku-arab" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\ku-arab"), fInfoLevelId=0x0, lpFileInformation=0x1260be58 | out: lpFileInformation=0x1260be58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf25ac394, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xf5b19f9c, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xf5b19f9c, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.362] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\ku-arab" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\ku-arab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.362] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\ku-arab\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf25ac394, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xf25ac394, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xf5b19f9c, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fea8
	[0233.362] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf25ac394, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xf25ac394, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xf5b19f9c, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.362] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5b19f9c, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xf5b19f9c, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xf5d3009a, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x15cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0233.362] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.362] FindClose (in: hFindFile=0x79fea8 | out: hFindFile=0x79fea8) returned 1
	[0233.362] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\ku-arab\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\ku-arab\\filesync.localizedresources.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x1260bef8 | out: lpFileInformation=0x1260bef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5b19f9c, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xf5b19f9c, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xf5d3009a, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x15cc0)) returned 1
	[0233.362] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\ky" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\ky"), fInfoLevelId=0x0, lpFileInformation=0x1260bf48 | out: lpFileInformation=0x1260bf48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf79de4ea, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xf8282d8b, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xf8282d8b, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.366] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\ky" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\ky"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.366] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\ky\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf79de4ea, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xf79de4ea, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xf8282d8b, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0028
	[0233.367] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf79de4ea, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xf79de4ea, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xf8282d8b, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.367] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8282d8b, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xf8282d8b, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xf8878a7e, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x15ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0233.367] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.367] FindClose (in: hFindFile=0x7a0028 | out: hFindFile=0x7a0028) returned 1
	[0233.367] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\ky\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\ky\\filesync.localizedresources.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x12544008 | out: lpFileInformation=0x12544008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8282d8b, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xf8282d8b, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xf8878a7e, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x15ac0)) returned 1
	[0233.368] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\lb-lu" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\lb-lu"), fInfoLevelId=0x0, lpFileInformation=0x12544058 | out: lpFileInformation=0x12544058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf89aa04e, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xf90f72a6, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xf90f72a6, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.369] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\lb-lu" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\lb-lu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.369] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\lb-lu\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf89aa04e, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xf89aa04e, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xf90f72a6, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fe28
	[0233.369] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf89aa04e, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xf89aa04e, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xf90f72a6, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.369] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf90f72a6, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xf90f72a6, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xf9608373, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x174c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0233.369] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.369] FindClose (in: hFindFile=0x79fe28 | out: hFindFile=0x79fe28) returned 1
	[0233.369] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\lb-lu\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\lb-lu\\filesync.localizedresources.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x125440f8 | out: lpFileInformation=0x125440f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf90f72a6, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xf90f72a6, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xf9608373, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x174c0)) returned 1
	[0233.369] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\lt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\lt"), fInfoLevelId=0x0, lpFileInformation=0x12544148 | out: lpFileInformation=0x12544148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9739439, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xfa977fad, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xfa977fad, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.370] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\lt" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\lt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.370] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\lt\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9739439, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xf9739439, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xfa977fad, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0028
	[0233.370] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9739439, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xf9739439, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xfa977fad, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.370] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa977fad, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xfa977fad, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xfaefb782, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x160c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0233.370] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.370] FindClose (in: hFindFile=0x7a0028 | out: hFindFile=0x7a0028) returned 1
	[0233.370] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\lt\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\lt\\filesync.localizedresources.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x125441e8 | out: lpFileInformation=0x125441e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa977fad, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xfa977fad, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xfaefb782, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x160c0)) returned 1
	[0233.370] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\lv" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\lv"), fInfoLevelId=0x0, lpFileInformation=0x12544238 | out: lpFileInformation=0x12544238*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb006851, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xfb3017e0, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xfb3017e0, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.370] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\lv" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\lv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.371] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\lv\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb006851, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xfb006851, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xfb3017e0, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fd28
	[0233.371] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb006851, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xfb006851, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xfb3017e0, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.371] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb3017e0, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xfb3017e0, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xfb622788, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x15ec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0233.371] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0233.371] FindClose (in: hFindFile=0x79fd28 | out: hFindFile=0x79fd28) returned 1
	[0233.371] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\lv\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\lv\\filesync.localizedresources.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x125442d8 | out: lpFileInformation=0x125442d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb3017e0, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xfb3017e0, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xfb622788, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x15ec0)) returned 1
	[0233.371] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\mi-nz" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\mi-nz"), fInfoLevelId=0x0, lpFileInformation=0x12544328 | out: lpFileInformation=0x12544328*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb969ac6, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xfbe2e789, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xfbe2e789, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0233.372] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\mi-nz" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_2\\mi-nz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0233.372] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_2\\mi-nz\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb969ac6, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xfb969ac6, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xfbe2e789, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fe68
	[0233.372] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb969ac6, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xfb969ac6, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xfbe2e789, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0233.373] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbe2e789, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xfbe2e789, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xfbfd20c1, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x156c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1
	[0236.588] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\AC" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.net.native.runtime.1.1_8wekyb3d8bbwe\\ac"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0236.589] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\AC\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5a457e3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5a457e3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5a457e3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fea8
	[0239.085] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12876200*, nNumberOfCharsToWrite=0x39, lpNumberOfCharsWritten=0x12422914, lpReserved=0x0 | out: lpBuffer=0x12876200*, lpNumberOfCharsWritten=0x12422914*=0x39) returned 1
	[0239.135] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Contacts\\desktop.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\contacts\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x1288c058 | out: lpFileInformation=0x1288c058*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435fd682, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x19c)) returned 1
	[0239.135] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Cookies" (normalized: "c:\\users\\rdhj0cnfevzx\\cookies"), fInfoLevelId=0x0, lpFileInformation=0x1288c0a8 | out: lpFileInformation=0x1288c0a8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0239.136] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x1288c0f8 | out: lpFileInformation=0x1288c0f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0239.136] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0239.136] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fd28
	[0239.143] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x124c0f50*, nNumberOfCharsToWrite=0x38, lpNumberOfCharsWritten=0x12422914, lpReserved=0x0 | out: lpBuffer=0x124c0f50*, lpNumberOfCharsWritten=0x12422914*=0x38) returned 1
	[0239.153] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\1svsBULw6E2suU5FLV.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\1svsbulw6e2suu5flv.gif"), fInfoLevelId=0x0, lpFileInformation=0x1288caf8 | out: lpFileInformation=0x1288caf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48044040, ftCreationTime.dwHighDateTime=0x1d8212e, ftLastAccessTime.dwLowDateTime=0x5c19a430, ftLastAccessTime.dwHighDateTime=0x1d826b5, ftLastWriteTime.dwLowDateTime=0x5c19a430, ftLastWriteTime.dwHighDateTime=0x1d826b5, nFileSizeHigh=0x0, nFileSizeLow=0xc13)) returned 1
	[0239.153] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\1svsBULw6E2suU5FLV.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\1svsbulw6e2suu5flv.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0239.154] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0239.154] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\1svsBULw6E2suU5FLV.gif.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\1svsbulw6e2suu5flv.gif.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0239.156] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0239.156] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x12411860 | out: pbBuffer=0x12411860) returned 1
	[0239.157] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x128943e0 | out: pbBuffer=0x128943e0) returned 1
	[0239.157] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x12876301 | out: pbBuffer=0x12876301) returned 1
	[0239.158] WriteFile (in: hFile=0x17c, lpBuffer=0x12897000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12897000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0239.159] VirtualAlloc (lpAddress=0x128c0000, dwSize=0x9d0000, flAllocationType=0x1000, flProtect=0x4) returned 0x128c0000
	[0239.204] VirtualAlloc (lpAddress=0x11096000, dwSize=0x9e000, flAllocationType=0x1000, flProtect=0x4) returned 0x11096000
	[0239.206] VirtualAlloc (lpAddress=0x21e6000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x21e6000
	[0239.214] SetEvent (hEvent=0x14c) returned 1
	[0239.215] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0239.216] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0239.216] SetEvent (hEvent=0x14c) returned 1
	[0239.216] SetEvent (hEvent=0x174) returned 1
	[0239.216] SetEvent (hEvent=0x124) returned 1
	[0239.216] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0239.217] SetEvent (hEvent=0x168) returned 1
	[0239.217] SetEvent (hEvent=0x124) returned 1
	[0239.219] GetProcAddress (hModule=0x75600000, lpProcName="ReadFile") returned 0x75626bb0
	[0239.220] ReadFile (in: hFile=0x178, lpBuffer=0x128c0000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x128c0000*, lpNumberOfBytesRead=0x12422bdc*=0xc13, lpOverlapped=0x0) returned 1
	[0239.296] WriteFile (in: hFile=0x17c, lpBuffer=0x12897000*, nNumberOfBytesToWrite=0xc13, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12897000*, lpNumberOfBytesWritten=0x12422bec*=0xc13, lpOverlapped=0x0) returned 1
	[0239.349] SetEvent (hEvent=0x168) returned 1
	[0239.349] ReadFile (in: hFile=0x178, lpBuffer=0x128c0000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x128c0000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0239.350] CloseHandle (hObject=0x17c) returned 1
	[0239.353] CloseHandle (hObject=0x178) returned 1
	[0239.353] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123c0200*, nNumberOfCharsToWrite=0x39, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x123c0200*, lpNumberOfCharsWritten=0x124228a0*=0x39) returned 1
	[0239.364] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\1svsBULw6E2suU5FLV.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\1svsbulw6e2suu5flv.gif")) returned 1
	[0239.373] SetEvent (hEvent=0x174) returned 1
	[0239.374] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0239.374] SetEvent (hEvent=0x174) returned 1
	[0239.374] SetEvent (hEvent=0x124) returned 1
	[0239.374] SetEvent (hEvent=0x14c) returned 1
	[0239.374] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0239.375] SetEvent (hEvent=0x14c) returned 1
	[0239.413] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0239.417] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0239.417] SetEvent (hEvent=0x168) returned 1
	[0239.418] SetEvent (hEvent=0x14c) returned 1
	[0239.420] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0239.422] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0239.422] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0239.422] SetEvent (hEvent=0x14c) returned 1
	[0239.422] SetEvent (hEvent=0x124) returned 1
	[0239.422] SetEvent (hEvent=0x174) returned 1
	[0239.422] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0239.422] SetEvent (hEvent=0x174) returned 1
	[0239.423] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\1svsBULw6E2suU5FLV.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\1svsbulw6e2suu5flv.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0239.425] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0239.425] WriteFile (in: hFile=0x178, lpBuffer=0x12896000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x12896000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0239.479] CloseHandle (hObject=0x178) returned 1
	[0239.555] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\1svsBULw6E2suU5FLV.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\1svsbulw6e2suu5flv.gif")) returned 1
	[0239.572] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\6ag5kfsiaVq.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\6ag5kfsiavq.mp4"), fInfoLevelId=0x0, lpFileInformation=0x125da008 | out: lpFileInformation=0x125da008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1819d70, ftCreationTime.dwHighDateTime=0x1d82578, ftLastAccessTime.dwLowDateTime=0x9a994e10, ftLastAccessTime.dwHighDateTime=0x1d82807, ftLastWriteTime.dwLowDateTime=0x9a994e10, ftLastWriteTime.dwHighDateTime=0x1d82807, nFileSizeHigh=0x0, nFileSizeLow=0x25a2)) returned 1
	[0239.572] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\6ag5kfsiaVq.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\6ag5kfsiavq.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0239.572] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0239.572] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\6ag5kfsiaVq.mp4.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\6ag5kfsiavq.mp4.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0239.574] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0239.574] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x126c4040 | out: pbBuffer=0x126c4040) returned 1
	[0239.574] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x123ce130 | out: pbBuffer=0x123ce130) returned 1
	[0239.574] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0239.575] WriteFile (in: hFile=0x17c, lpBuffer=0x12891000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12891000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0239.576] VirtualAlloc (lpAddress=0x13290000, dwSize=0x9d0000, flAllocationType=0x1000, flProtect=0x4) returned 0x13290000
	[0239.603] VirtualAlloc (lpAddress=0x10ffa000, dwSize=0x9c000, flAllocationType=0x1000, flProtect=0x4) returned 0x10ffa000
	[0239.605] VirtualAlloc (lpAddress=0x21e7000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x21e7000
	[0239.743] SetEvent (hEvent=0x124) returned 1
	[0239.743] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x25a2, lpOverlapped=0x0) returned 1
	[0239.745] WriteFile (in: hFile=0x17c, lpBuffer=0x12c60000*, nNumberOfBytesToWrite=0x25a2, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesWritten=0x12422be8*=0x25a2, lpOverlapped=0x0) returned 1
	[0239.747] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0239.748] CloseHandle (hObject=0x17c) returned 1
	[0239.753] CloseHandle (hObject=0x178) returned 1
	[0239.754] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x125ce000*, nNumberOfCharsToWrite=0x32, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x125ce000*, lpNumberOfCharsWritten=0x124228a0*=0x32) returned 1
	[0239.772] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0239.774] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\6ag5kfsiaVq.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\6ag5kfsiavq.mp4")) returned 1
	[0239.820] SetEvent (hEvent=0x124) returned 1
	[0239.827] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0239.830] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0239.830] SetEvent (hEvent=0x124) returned 1
	[0239.830] SetEvent (hEvent=0x12c) returned 1
	[0239.830] SetEvent (hEvent=0x14c) returned 1
	[0239.830] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0239.831] SetEvent (hEvent=0x168) returned 1
	[0239.831] SetEvent (hEvent=0x14c) returned 1
	[0239.834] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0239.835] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0239.835] SetEvent (hEvent=0x14c) returned 1
	[0239.835] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0239.836] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0239.836] SetEvent (hEvent=0x14c) returned 1
	[0239.836] SetEvent (hEvent=0x12c) returned 1
	[0239.836] SetEvent (hEvent=0x124) returned 1
	[0239.836] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0239.837] SetEvent (hEvent=0x168) returned 1
	[0239.837] SetEvent (hEvent=0x124) returned 1
	[0239.837] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\6ag5kfsiaVq.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\6ag5kfsiavq.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0239.840] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0239.840] WriteFile (in: hFile=0x178, lpBuffer=0x12c60000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0239.878] CloseHandle (hObject=0x178) returned 1
	[0239.972] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\6ag5kfsiaVq.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\6ag5kfsiavq.mp4")) returned 1
	[0239.995] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\9dmrU1YjBAS.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\9dmru1yjbas.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x125da058 | out: lpFileInformation=0x125da058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca7a88f0, ftCreationTime.dwHighDateTime=0x1d81a7a, ftLastAccessTime.dwLowDateTime=0xfb7fa540, ftLastAccessTime.dwHighDateTime=0x1d81d52, ftLastWriteTime.dwLowDateTime=0xfb7fa540, ftLastWriteTime.dwHighDateTime=0x1d81d52, nFileSizeHigh=0x0, nFileSizeLow=0x12087)) returned 1
	[0239.996] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\9dmrU1YjBAS.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\9dmru1yjbas.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0239.996] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0239.996] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\9dmrU1YjBAS.xlsx.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\9dmru1yjbas.xlsx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0239.998] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0239.998] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x126c4040 | out: pbBuffer=0x126c4040) returned 1
	[0239.998] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124121a0 | out: pbBuffer=0x124121a0) returned 1
	[0239.998] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0239.998] WriteFile (in: hFile=0x17c, lpBuffer=0x12537000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12537000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0240.027] SetEvent (hEvent=0x12c) returned 1
	[0240.027] ReadFile (in: hFile=0x178, lpBuffer=0x12d5a000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12d5a000*, lpNumberOfBytesRead=0x12422bdc*=0x12087, lpOverlapped=0x0) returned 1
	[0240.031] WriteFile (in: hFile=0x17c, lpBuffer=0x12d5a000*, nNumberOfBytesToWrite=0x12087, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12d5a000*, lpNumberOfBytesWritten=0x12422be8*=0x12087, lpOverlapped=0x0) returned 1
	[0240.038] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0240.039] ReadFile (in: hFile=0x178, lpBuffer=0x12d5a000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12d5a000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0240.039] CloseHandle (hObject=0x17c) returned 1
	[0240.044] CloseHandle (hObject=0x178) returned 1
	[0240.044] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123d00e0*, nNumberOfCharsToWrite=0x33, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x123d00e0*, lpNumberOfCharsWritten=0x124228a0*=0x33) returned 1
	[0240.056] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\9dmrU1YjBAS.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\9dmru1yjbas.xlsx")) returned 1
	[0240.068] SetEvent (hEvent=0x12c) returned 1
	[0240.069] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0240.070] SetEvent (hEvent=0x12c) returned 1
	[0240.070] SetEvent (hEvent=0x174) returned 1
	[0240.070] SetEvent (hEvent=0x14c) returned 1
	[0240.070] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0240.070] SetEvent (hEvent=0x168) returned 1
	[0240.070] SetEvent (hEvent=0x14c) returned 1
	[0240.094] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0240.097] SetEvent (hEvent=0x14c) returned 1
	[0240.100] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0240.101] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0240.101] SetEvent (hEvent=0x14c) returned 1
	[0240.101] SetEvent (hEvent=0x174) returned 1
	[0240.101] SetEvent (hEvent=0x12c) returned 1
	[0240.101] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0240.102] SetEvent (hEvent=0x12c) returned 1
	[0240.103] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\9dmrU1YjBAS.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\9dmru1yjbas.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0240.106] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0240.106] WriteFile (in: hFile=0x178, lpBuffer=0x12896000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x12896000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0240.228] CloseHandle (hObject=0x178) returned 1
	[0240.282] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\9dmrU1YjBAS.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\9dmru1yjbas.xlsx")) returned 1
	[0240.324] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A7lg gNk.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a7lg gnk.mkv"), fInfoLevelId=0x0, lpFileInformation=0x125da008 | out: lpFileInformation=0x125da008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1d8c0c0, ftCreationTime.dwHighDateTime=0x1d82079, ftLastAccessTime.dwLowDateTime=0xbc7ce680, ftLastAccessTime.dwHighDateTime=0x1d825b5, ftLastWriteTime.dwLowDateTime=0xbc7ce680, ftLastWriteTime.dwHighDateTime=0x1d825b5, nFileSizeHigh=0x0, nFileSizeLow=0x5b48)) returned 1
	[0240.324] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A7lg gNk.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a7lg gnk.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0240.325] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0240.325] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A7lg gNk.mkv.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a7lg gnk.mkv.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0240.325] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0240.325] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x126c4040 | out: pbBuffer=0x126c4040) returned 1
	[0240.325] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124121a0 | out: pbBuffer=0x124121a0) returned 1
	[0240.325] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0240.325] WriteFile (in: hFile=0x17c, lpBuffer=0x12893000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12893000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0240.328] SetEvent (hEvent=0x174) returned 1
	[0240.328] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x5b48, lpOverlapped=0x0) returned 1
	[0240.329] WriteFile (in: hFile=0x17c, lpBuffer=0x12c60000*, nNumberOfBytesToWrite=0x5b48, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesWritten=0x12422be8*=0x5b48, lpOverlapped=0x0) returned 1
	[0240.333] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0240.333] CloseHandle (hObject=0x17c) returned 1
	[0240.335] CloseHandle (hObject=0x178) returned 1
	[0240.335] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x125d0000*, nNumberOfCharsToWrite=0x2f, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x125d0000*, lpNumberOfCharsWritten=0x124228a0*=0x2f) returned 1
	[0240.349] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0240.361] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A7lg gNk.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a7lg gnk.mkv")) returned 1
	[0240.457] SetEvent (hEvent=0x168) returned 1
	[0240.462] SetEvent (hEvent=0x174) returned 1
	[0240.463] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0240.464] SetEvent (hEvent=0x174) returned 1
	[0240.464] SetEvent (hEvent=0x124) returned 1
	[0240.464] SetEvent (hEvent=0x14c) returned 1
	[0240.464] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0240.466] SetEvent (hEvent=0x14c) returned 1
	[0240.486] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0240.487] SetEvent (hEvent=0x168) returned 1
	[0240.487] SetEvent (hEvent=0x14c) returned 1
	[0240.489] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0240.489] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0240.489] SetEvent (hEvent=0x14c) returned 1
	[0240.490] SetEvent (hEvent=0x124) returned 1
	[0240.490] SetEvent (hEvent=0x174) returned 1
	[0240.490] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0240.490] SetEvent (hEvent=0x174) returned 1
	[0240.491] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A7lg gNk.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a7lg gnk.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0240.492] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0240.492] WriteFile (in: hFile=0x178, lpBuffer=0x12896000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x12896000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0240.531] CloseHandle (hObject=0x178) returned 1
	[0240.651] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A7lg gNk.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a7lg gnk.mkv")) returned 1
	[0240.663] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\C0syXD_bv.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\c0syxd_bv.odt"), fInfoLevelId=0x0, lpFileInformation=0x125da058 | out: lpFileInformation=0x125da058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x121e7030, ftCreationTime.dwHighDateTime=0x1d81e19, ftLastAccessTime.dwLowDateTime=0x7695e8c0, ftLastAccessTime.dwHighDateTime=0x1d8292e, ftLastWriteTime.dwLowDateTime=0x7695e8c0, ftLastWriteTime.dwHighDateTime=0x1d8292e, nFileSizeHigh=0x0, nFileSizeLow=0xff3d)) returned 1
	[0240.663] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\C0syXD_bv.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\c0syxd_bv.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0240.663] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0240.663] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\C0syXD_bv.odt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\c0syxd_bv.odt.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0240.664] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0240.664] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x126c4040 | out: pbBuffer=0x126c4040) returned 1
	[0240.664] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x123ce130 | out: pbBuffer=0x123ce130) returned 1
	[0240.664] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0240.664] WriteFile (in: hFile=0x17c, lpBuffer=0x12891000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12891000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0240.667] SetEvent (hEvent=0x124) returned 1
	[0240.667] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0xff3d, lpOverlapped=0x0) returned 1
	[0240.669] WriteFile (in: hFile=0x17c, lpBuffer=0x12c60000*, nNumberOfBytesToWrite=0xff3d, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesWritten=0x12422be8*=0xff3d, lpOverlapped=0x0) returned 1
	[0240.672] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0240.672] CloseHandle (hObject=0x17c) returned 1
	[0240.675] CloseHandle (hObject=0x178) returned 1
	[0240.675] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x125ce000*, nNumberOfCharsToWrite=0x30, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x125ce000*, lpNumberOfCharsWritten=0x124228a0*=0x30) returned 1
	[0240.686] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0240.687] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\C0syXD_bv.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\c0syxd_bv.odt")) returned 1
	[0240.696] SetEvent (hEvent=0x124) returned 1
	[0240.698] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0240.699] SetEvent (hEvent=0x124) returned 1
	[0240.699] SetEvent (hEvent=0x12c) returned 1
	[0240.699] SetEvent (hEvent=0x14c) returned 1
	[0240.699] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0240.700] SetEvent (hEvent=0x14c) returned 1
	[0240.732] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0240.734] SetEvent (hEvent=0x168) returned 1
	[0240.734] SetEvent (hEvent=0x14c) returned 1
	[0240.740] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0240.741] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0240.741] SetEvent (hEvent=0x14c) returned 1
	[0240.741] SetEvent (hEvent=0x12c) returned 1
	[0240.741] SetEvent (hEvent=0x124) returned 1
	[0240.741] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0240.742] SetEvent (hEvent=0x168) returned 1
	[0240.742] SetEvent (hEvent=0x124) returned 1
	[0240.743] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\C0syXD_bv.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\c0syxd_bv.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0240.745] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0240.745] WriteFile (in: hFile=0x178, lpBuffer=0x12896000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x12896000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0241.109] CloseHandle (hObject=0x178) returned 1
	[0241.145] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\C0syXD_bv.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\c0syxd_bv.odt")) returned 1
	[0241.196] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\DiFuL.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\diful.swf"), fInfoLevelId=0x0, lpFileInformation=0x125da008 | out: lpFileInformation=0x125da008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x671e1060, ftCreationTime.dwHighDateTime=0x1d81b65, ftLastAccessTime.dwLowDateTime=0x774ae990, ftLastAccessTime.dwHighDateTime=0x1d8206a, ftLastWriteTime.dwLowDateTime=0x774ae990, ftLastWriteTime.dwHighDateTime=0x1d8206a, nFileSizeHigh=0x0, nFileSizeLow=0x17abf)) returned 1
	[0241.196] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\DiFuL.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\diful.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0241.196] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0241.196] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\DiFuL.swf.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\diful.swf.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0241.197] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0241.197] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x126c4040 | out: pbBuffer=0x126c4040) returned 1
	[0241.197] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124121a0 | out: pbBuffer=0x124121a0) returned 1
	[0241.197] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0241.197] WriteFile (in: hFile=0x17c, lpBuffer=0x12891000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12891000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0241.200] SetEvent (hEvent=0x12c) returned 1
	[0241.200] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x17abf, lpOverlapped=0x0) returned 1
	[0241.203] WriteFile (in: hFile=0x17c, lpBuffer=0x12c60000*, nNumberOfBytesToWrite=0x17abf, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesWritten=0x12422be8*=0x17abf, lpOverlapped=0x0) returned 1
	[0241.259] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0241.259] CloseHandle (hObject=0x17c) returned 1
	[0241.262] CloseHandle (hObject=0x178) returned 1
	[0241.263] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x125ce000*, nNumberOfCharsToWrite=0x2c, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x125ce000*, lpNumberOfCharsWritten=0x124228a0*=0x2c) returned 1
	[0241.414] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0242.816] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\DiFuL.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\diful.swf")) returned 1
	[0242.861] SetEvent (hEvent=0x12c) returned 1
	[0242.886] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0242.891] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0242.891] SetEvent (hEvent=0x12c) returned 1
	[0242.892] SetEvent (hEvent=0x174) returned 1
	[0242.892] SetEvent (hEvent=0x14c) returned 1
	[0242.892] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0242.895] SetEvent (hEvent=0x168) returned 1
	[0242.895] SetEvent (hEvent=0x14c) returned 1
	[0242.924] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0242.936] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0242.936] SetEvent (hEvent=0x14c) returned 1
	[0242.939] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0242.970] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0242.970] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0243.044] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0243.044] SetEvent (hEvent=0x14c) returned 1
	[0243.044] SetEvent (hEvent=0x174) returned 1
	[0243.044] SetEvent (hEvent=0x12c) returned 1
	[0243.044] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0243.053] SetEvent (hEvent=0x168) returned 1
	[0243.053] SetEvent (hEvent=0x12c) returned 1
	[0243.054] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\DiFuL.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\diful.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0243.070] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0243.070] WriteFile (in: hFile=0x178, lpBuffer=0x12896000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x12896000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0243.168] CloseHandle (hObject=0x178) returned 1
	[0243.266] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\DiFuL.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\diful.swf")) returned 1
	[0243.279] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Dyb9xZeWpRv.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\dyb9xzewprv.swf"), fInfoLevelId=0x0, lpFileInformation=0x125da058 | out: lpFileInformation=0x125da058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ec45a40, ftCreationTime.dwHighDateTime=0x1d8282d, ftLastAccessTime.dwLowDateTime=0x439df780, ftLastAccessTime.dwHighDateTime=0x1d82953, ftLastWriteTime.dwLowDateTime=0x439df780, ftLastWriteTime.dwHighDateTime=0x1d82953, nFileSizeHigh=0x0, nFileSizeLow=0x3eb4)) returned 1
	[0243.279] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Dyb9xZeWpRv.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\dyb9xzewprv.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0243.279] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0243.279] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Dyb9xZeWpRv.swf.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\dyb9xzewprv.swf.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0243.280] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0243.280] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x126c4040 | out: pbBuffer=0x126c4040) returned 1
	[0243.280] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x123ce130 | out: pbBuffer=0x123ce130) returned 1
	[0243.280] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0243.280] WriteFile (in: hFile=0x17c, lpBuffer=0x12891000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12891000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0243.288] SetEvent (hEvent=0x174) returned 1
	[0243.288] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x3eb4, lpOverlapped=0x0) returned 1
	[0243.290] WriteFile (in: hFile=0x17c, lpBuffer=0x12c60000*, nNumberOfBytesToWrite=0x3eb4, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesWritten=0x12422be8*=0x3eb4, lpOverlapped=0x0) returned 1
	[0243.341] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0243.395] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0243.395] CloseHandle (hObject=0x17c) returned 1
	[0243.397] CloseHandle (hObject=0x178) returned 1
	[0243.398] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123d00e0*, nNumberOfCharsToWrite=0x32, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x123d00e0*, lpNumberOfCharsWritten=0x124228a0*=0x32) returned 1
	[0243.456] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Dyb9xZeWpRv.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\dyb9xzewprv.swf")) returned 1
	[0243.464] SetEvent (hEvent=0x174) returned 1
	[0243.467] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0243.497] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0243.497] SetEvent (hEvent=0x174) returned 1
	[0243.497] SetEvent (hEvent=0x124) returned 1
	[0243.497] SetEvent (hEvent=0x14c) returned 1
	[0243.497] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0243.557] SetEvent (hEvent=0x168) returned 1
	[0243.558] SetEvent (hEvent=0x14c) returned 1
	[0243.590] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0243.629] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0243.629] SetEvent (hEvent=0x14c) returned 1
	[0243.632] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0243.675] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0243.675] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0243.943] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0243.943] SetEvent (hEvent=0x14c) returned 1
	[0243.943] SetEvent (hEvent=0x124) returned 1
	[0243.943] SetEvent (hEvent=0x174) returned 1
	[0243.944] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0244.029] SetEvent (hEvent=0x168) returned 1
	[0244.029] SetEvent (hEvent=0x174) returned 1
	[0244.030] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Dyb9xZeWpRv.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\dyb9xzewprv.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0244.031] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0244.031] WriteFile (in: hFile=0x178, lpBuffer=0x12896000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x12896000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0244.095] CloseHandle (hObject=0x178) returned 1
	[0244.121] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Dyb9xZeWpRv.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\dyb9xzewprv.swf")) returned 1
	[0244.131] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\L1OM5.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\l1om5.png"), fInfoLevelId=0x0, lpFileInformation=0x125da008 | out: lpFileInformation=0x125da008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7149650, ftCreationTime.dwHighDateTime=0x1d81f3c, ftLastAccessTime.dwLowDateTime=0x92571f80, ftLastAccessTime.dwHighDateTime=0x1d8292d, ftLastWriteTime.dwLowDateTime=0x92571f80, ftLastWriteTime.dwHighDateTime=0x1d8292d, nFileSizeHigh=0x0, nFileSizeLow=0x58a0)) returned 1
	[0244.131] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\L1OM5.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\l1om5.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0244.131] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0244.131] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\L1OM5.png.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\l1om5.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0244.131] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0244.131] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x126c4040 | out: pbBuffer=0x126c4040) returned 1
	[0244.131] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x123ce130 | out: pbBuffer=0x123ce130) returned 1
	[0244.132] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0244.132] WriteFile (in: hFile=0x17c, lpBuffer=0x12517000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12517000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0244.134] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0244.176] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0244.176] SetEvent (hEvent=0x174) returned 1
	[0244.176] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x58a0, lpOverlapped=0x0) returned 1
	[0244.178] WriteFile (in: hFile=0x17c, lpBuffer=0x12c60000*, nNumberOfBytesToWrite=0x58a0, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesWritten=0x12422be8*=0x58a0, lpOverlapped=0x0) returned 1
	[0244.211] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0244.211] CloseHandle (hObject=0x17c) returned 1
	[0244.244] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0244.344] CloseHandle (hObject=0x178) returned 1
	[0244.345] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12504000*, nNumberOfCharsToWrite=0x2c, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x12504000*, lpNumberOfCharsWritten=0x124228a0*=0x2c) returned 1
	[0244.360] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\L1OM5.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\l1om5.png")) returned 1
	[0244.404] SetEvent (hEvent=0x174) returned 1
	[0244.406] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0244.457] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0244.457] SetEvent (hEvent=0x174) returned 1
	[0244.457] SetEvent (hEvent=0x12c) returned 1
	[0244.457] SetEvent (hEvent=0x14c) returned 1
	[0244.457] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0244.471] SetEvent (hEvent=0x168) returned 1
	[0244.471] SetEvent (hEvent=0x14c) returned 1
	[0244.494] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0244.553] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0244.553] SetEvent (hEvent=0x14c) returned 1
	[0244.555] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0244.560] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0244.560] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0244.588] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0244.588] SetEvent (hEvent=0x14c) returned 1
	[0244.588] SetEvent (hEvent=0x12c) returned 1
	[0244.588] SetEvent (hEvent=0x174) returned 1
	[0244.588] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0244.697] SetEvent (hEvent=0x168) returned 1
	[0244.697] SetEvent (hEvent=0x174) returned 1
	[0244.698] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\L1OM5.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\l1om5.png"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0244.733] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0244.733] WriteFile (in: hFile=0x178, lpBuffer=0x12896000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x12896000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0244.779] CloseHandle (hObject=0x178) returned 1
	[0244.818] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\L1OM5.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\l1om5.png")) returned 1
	[0244.893] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\L_C0b.m4a" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\l_c0b.m4a"), fInfoLevelId=0x0, lpFileInformation=0x125da058 | out: lpFileInformation=0x125da058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a5d1c0, ftCreationTime.dwHighDateTime=0x1d826d7, ftLastAccessTime.dwLowDateTime=0x20e721f0, ftLastAccessTime.dwHighDateTime=0x1d827b2, ftLastWriteTime.dwLowDateTime=0x20e721f0, ftLastWriteTime.dwHighDateTime=0x1d827b2, nFileSizeHigh=0x0, nFileSizeLow=0xf312)) returned 1
	[0244.893] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\LcNUIHK9IEvgMQ7.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\lcnuihk9ievgmq7.jpg"), fInfoLevelId=0x0, lpFileInformation=0x125da0a8 | out: lpFileInformation=0x125da0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c86bc50, ftCreationTime.dwHighDateTime=0x1d81f4c, ftLastAccessTime.dwLowDateTime=0xfa1edde0, ftLastAccessTime.dwHighDateTime=0x1d82312, ftLastWriteTime.dwLowDateTime=0xfa1edde0, ftLastWriteTime.dwHighDateTime=0x1d82312, nFileSizeHigh=0x0, nFileSizeLow=0x392f)) returned 1
	[0244.894] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\LcNUIHK9IEvgMQ7.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\lcnuihk9ievgmq7.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0244.894] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0244.894] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\LcNUIHK9IEvgMQ7.jpg.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\lcnuihk9ievgmq7.jpg.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0244.894] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0244.894] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x126c4080 | out: pbBuffer=0x126c4080) returned 1
	[0244.894] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x123ce230 | out: pbBuffer=0x123ce230) returned 1
	[0244.894] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0281 | out: pbBuffer=0x123c0281) returned 1
	[0244.894] WriteFile (in: hFile=0x17c, lpBuffer=0x1288f000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x1288f000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0244.900] SetEvent (hEvent=0x12c) returned 1
	[0244.900] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x392f, lpOverlapped=0x0) returned 1
	[0244.902] WriteFile (in: hFile=0x17c, lpBuffer=0x12c60000*, nNumberOfBytesToWrite=0x392f, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesWritten=0x12422be8*=0x392f, lpOverlapped=0x0) returned 1
	[0244.944] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0244.944] CloseHandle (hObject=0x17c) returned 1
	[0244.946] CloseHandle (hObject=0x178) returned 1
	[0244.946] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12428000*, nNumberOfCharsToWrite=0x36, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x12428000*, lpNumberOfCharsWritten=0x124228a0*=0x36) returned 1
	[0244.988] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0245.032] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\LcNUIHK9IEvgMQ7.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\lcnuihk9ievgmq7.jpg")) returned 1
	[0245.065] SetEvent (hEvent=0x12c) returned 1
	[0245.066] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0245.096] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0245.096] SetEvent (hEvent=0x12c) returned 1
	[0245.096] SetEvent (hEvent=0x124) returned 1
	[0245.096] SetEvent (hEvent=0x14c) returned 1
	[0245.096] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0245.129] SetEvent (hEvent=0x168) returned 1
	[0245.129] SetEvent (hEvent=0x14c) returned 1
	[0245.152] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0245.195] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0245.195] SetEvent (hEvent=0x14c) returned 1
	[0245.198] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0245.241] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0245.241] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0245.282] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0245.282] SetEvent (hEvent=0x14c) returned 1
	[0245.283] SetEvent (hEvent=0x124) returned 1
	[0245.283] SetEvent (hEvent=0x12c) returned 1
	[0245.283] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0245.326] SetEvent (hEvent=0x168) returned 1
	[0245.326] SetEvent (hEvent=0x12c) returned 1
	[0245.328] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\LcNUIHK9IEvgMQ7.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\lcnuihk9ievgmq7.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0245.368] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0245.368] WriteFile (in: hFile=0x178, lpBuffer=0x12896000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x12896000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0245.719] CloseHandle (hObject=0x178) returned 1
	[0245.897] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\LcNUIHK9IEvgMQ7.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\lcnuihk9ievgmq7.jpg")) returned 1
	[0245.968] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Lvtr1Ydb7MIz.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\lvtr1ydb7miz.mkv"), fInfoLevelId=0x0, lpFileInformation=0x125da008 | out: lpFileInformation=0x125da008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d2a6ce0, ftCreationTime.dwHighDateTime=0x1d81b96, ftLastAccessTime.dwLowDateTime=0x7bd50d90, ftLastAccessTime.dwHighDateTime=0x1d829d6, ftLastWriteTime.dwLowDateTime=0x7bd50d90, ftLastWriteTime.dwHighDateTime=0x1d829d6, nFileSizeHigh=0x0, nFileSizeLow=0x600d)) returned 1
	[0245.968] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Lvtr1Ydb7MIz.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\lvtr1ydb7miz.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0245.968] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0245.968] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Lvtr1Ydb7MIz.mkv.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\lvtr1ydb7miz.mkv.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0245.974] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0245.974] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x126c4040 | out: pbBuffer=0x126c4040) returned 1
	[0245.974] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124121a0 | out: pbBuffer=0x124121a0) returned 1
	[0245.974] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0245.974] WriteFile (in: hFile=0x17c, lpBuffer=0x12537000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12537000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0245.977] SetEvent (hEvent=0x124) returned 1
	[0245.977] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x600d, lpOverlapped=0x0) returned 1
	[0245.979] WriteFile (in: hFile=0x17c, lpBuffer=0x12c60000*, nNumberOfBytesToWrite=0x600d, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesWritten=0x12422be8*=0x600d, lpOverlapped=0x0) returned 1
	[0246.011] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0246.011] CloseHandle (hObject=0x17c) returned 1
	[0246.029] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0246.082] CloseHandle (hObject=0x178) returned 1
	[0246.082] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123d00e0*, nNumberOfCharsToWrite=0x33, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x123d00e0*, lpNumberOfCharsWritten=0x124228a0*=0x33) returned 1
	[0246.132] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Lvtr1Ydb7MIz.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\lvtr1ydb7miz.mkv")) returned 1
	[0246.166] SetEvent (hEvent=0x124) returned 1
	[0246.168] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0246.345] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0246.345] SetEvent (hEvent=0x124) returned 1
	[0246.345] SetEvent (hEvent=0x174) returned 1
	[0246.345] SetEvent (hEvent=0x14c) returned 1
	[0246.345] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0246.412] SetEvent (hEvent=0x168) returned 1
	[0246.413] SetEvent (hEvent=0x14c) returned 1
	[0246.447] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0246.517] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0246.517] SetEvent (hEvent=0x14c) returned 1
	[0246.520] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0246.529] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0246.529] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0246.566] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0246.566] SetEvent (hEvent=0x14c) returned 1
	[0246.566] SetEvent (hEvent=0x174) returned 1
	[0246.566] SetEvent (hEvent=0x124) returned 1
	[0246.566] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0246.611] SetEvent (hEvent=0x168) returned 1
	[0246.611] SetEvent (hEvent=0x124) returned 1
	[0246.612] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Lvtr1Ydb7MIz.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\lvtr1ydb7miz.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0246.615] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0246.615] WriteFile (in: hFile=0x178, lpBuffer=0x12896000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x12896000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0246.656] CloseHandle (hObject=0x178) returned 1
	[0246.696] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Lvtr1Ydb7MIz.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\lvtr1ydb7miz.mkv")) returned 1
	[0246.741] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\MJtStno" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\mjtstno"), fInfoLevelId=0x0, lpFileInformation=0x125da058 | out: lpFileInformation=0x125da058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x753d4920, ftCreationTime.dwHighDateTime=0x1d81f13, ftLastAccessTime.dwLowDateTime=0xdaceece0, ftLastAccessTime.dwHighDateTime=0x1d81fb7, ftLastWriteTime.dwLowDateTime=0xdaceece0, ftLastWriteTime.dwHighDateTime=0x1d81fb7, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0246.741] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\MJtStno" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\mjtstno"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0246.741] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\MJtStno\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x753d4920, ftCreationTime.dwHighDateTime=0x1d81f13, ftLastAccessTime.dwLowDateTime=0xdaceece0, ftLastAccessTime.dwHighDateTime=0x1d81fb7, ftLastWriteTime.dwLowDateTime=0xdaceece0, ftLastWriteTime.dwHighDateTime=0x1d81fb7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fa68
	[0246.742] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x753d4920, ftCreationTime.dwHighDateTime=0x1d81f13, ftLastAccessTime.dwLowDateTime=0xdaceece0, ftLastAccessTime.dwHighDateTime=0x1d81fb7, ftLastWriteTime.dwLowDateTime=0xdaceece0, ftLastWriteTime.dwHighDateTime=0x1d81fb7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0246.742] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2e97fa0, ftCreationTime.dwHighDateTime=0x1d821ad, ftLastAccessTime.dwLowDateTime=0x12c0add0, ftLastAccessTime.dwHighDateTime=0x1d82794, ftLastWriteTime.dwLowDateTime=0x12c0add0, ftLastWriteTime.dwHighDateTime=0x1d82794, nFileSizeHigh=0x0, nFileSizeLow=0xc0fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="0RzD7W9keho8x2.gif", cAlternateFileName="0RZD7W~1.GIF")) returned 1
	[0246.742] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a2dcd30, ftCreationTime.dwHighDateTime=0x1d82480, ftLastAccessTime.dwLowDateTime=0xea1948d0, ftLastAccessTime.dwHighDateTime=0x1d8267e, ftLastWriteTime.dwLowDateTime=0xea1948d0, ftLastWriteTime.dwHighDateTime=0x1d8267e, nFileSizeHigh=0x0, nFileSizeLow=0xa92f, dwReserved0=0x0, dwReserved1=0x0, cFileName="UQjVL.png", cAlternateFileName="")) returned 1
	[0246.742] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0246.742] FindClose (in: hFindFile=0x79fa68 | out: hFindFile=0x79fa68) returned 1
	[0246.742] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\MJtStno\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\mjtstno\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0246.743] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d30 | out: lpMode=0x12422d30) returned 0
	[0246.743] WriteFile (in: hFile=0x178, lpBuffer=0x12694000*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d20, lpOverlapped=0x0 | out: lpBuffer=0x12694000*, lpNumberOfBytesWritten=0x12422d20*=0xc85, lpOverlapped=0x0) returned 1
	[0246.744] CloseHandle (hObject=0x178) returned 1
	[0246.745] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123c0200*, nNumberOfCharsToWrite=0x40, lpNumberOfCharsWritten=0x124228b0, lpReserved=0x0 | out: lpBuffer=0x123c0200*, lpNumberOfCharsWritten=0x124228b0*=0x40) returned 1
	[0246.770] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\MJtStno\\0RzD7W9keho8x2.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\mjtstno\\0rzd7w9keho8x2.gif"), fInfoLevelId=0x0, lpFileInformation=0x125da148 | out: lpFileInformation=0x125da148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2e97fa0, ftCreationTime.dwHighDateTime=0x1d821ad, ftLastAccessTime.dwLowDateTime=0x12c0add0, ftLastAccessTime.dwHighDateTime=0x1d82794, ftLastWriteTime.dwLowDateTime=0x12c0add0, ftLastWriteTime.dwHighDateTime=0x1d82794, nFileSizeHigh=0x0, nFileSizeLow=0xc0fa)) returned 1
	[0246.770] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\MJtStno\\0RzD7W9keho8x2.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\mjtstno\\0rzd7w9keho8x2.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0246.771] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0246.771] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\MJtStno\\0RzD7W9keho8x2.gif.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\mjtstno\\0rzd7w9keho8x2.gif.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0246.774] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0246.774] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x126c40a0 | out: pbBuffer=0x126c40a0) returned 1
	[0246.775] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124122e0 | out: pbBuffer=0x124122e0) returned 1
	[0246.775] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0401 | out: pbBuffer=0x123c0401) returned 1
	[0246.775] WriteFile (in: hFile=0x17c, lpBuffer=0x12537000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x12537000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0246.793] SetEvent (hEvent=0x174) returned 1
	[0246.793] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422b78*=0xc0fa, lpOverlapped=0x0) returned 1
	[0246.796] WriteFile (in: hFile=0x17c, lpBuffer=0x12c60000*, nNumberOfBytesToWrite=0xc0fa, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesWritten=0x12422b84*=0xc0fa, lpOverlapped=0x0) returned 1
	[0246.987] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0246.987] CloseHandle (hObject=0x17c) returned 1
	[0246.990] CloseHandle (hObject=0x178) returned 1
	[0246.990] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123fc080*, nNumberOfCharsToWrite=0x3d, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x123fc080*, lpNumberOfCharsWritten=0x1242283c*=0x3d) returned 1
	[0247.065] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0247.169] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\MJtStno\\0RzD7W9keho8x2.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\mjtstno\\0rzd7w9keho8x2.gif")) returned 1
	[0247.183] SetEvent (hEvent=0x174) returned 1
	[0247.185] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0247.220] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0247.220] SetEvent (hEvent=0x174) returned 1
	[0247.220] SetEvent (hEvent=0x12c) returned 1
	[0247.220] SetEvent (hEvent=0x14c) returned 1
	[0247.220] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0247.312] SetEvent (hEvent=0x168) returned 1
	[0247.312] SetEvent (hEvent=0x14c) returned 1
	[0247.345] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0247.440] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0247.440] SetEvent (hEvent=0x14c) returned 1
	[0247.443] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0247.450] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0247.450] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0247.478] SetEvent (hEvent=0x14c) returned 1
	[0247.478] SetEvent (hEvent=0x12c) returned 1
	[0247.478] SetEvent (hEvent=0x174) returned 1
	[0247.478] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0247.510] SetEvent (hEvent=0x168) returned 1
	[0247.510] SetEvent (hEvent=0x174) returned 1
	[0247.511] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\MJtStno\\0RzD7W9keho8x2.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\mjtstno\\0rzd7w9keho8x2.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0247.520] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0247.520] WriteFile (in: hFile=0x178, lpBuffer=0x12896000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x12896000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0247.934] CloseHandle (hObject=0x178) returned 1
	[0247.965] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\MJtStno\\0RzD7W9keho8x2.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\mjtstno\\0rzd7w9keho8x2.gif")) returned 1
	[0248.016] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\MJtStno\\UQjVL.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\mjtstno\\uqjvl.png"), fInfoLevelId=0x0, lpFileInformation=0x125da008 | out: lpFileInformation=0x125da008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a2dcd30, ftCreationTime.dwHighDateTime=0x1d82480, ftLastAccessTime.dwLowDateTime=0xea1948d0, ftLastAccessTime.dwHighDateTime=0x1d8267e, ftLastWriteTime.dwLowDateTime=0xea1948d0, ftLastWriteTime.dwHighDateTime=0x1d8267e, nFileSizeHigh=0x0, nFileSizeLow=0xa92f)) returned 1
	[0248.016] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\MJtStno\\UQjVL.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\mjtstno\\uqjvl.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0248.016] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0248.017] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\MJtStno\\UQjVL.png.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\mjtstno\\uqjvl.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0248.017] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0248.017] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x126c4060 | out: pbBuffer=0x126c4060) returned 1
	[0248.017] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x123ce130 | out: pbBuffer=0x123ce130) returned 1
	[0248.017] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc181 | out: pbBuffer=0x123fc181) returned 1
	[0248.017] WriteFile (in: hFile=0x17c, lpBuffer=0x12891000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x12891000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0248.022] SetEvent (hEvent=0x12c) returned 1
	[0248.022] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422b78*=0xa92f, lpOverlapped=0x0) returned 1
	[0248.025] WriteFile (in: hFile=0x17c, lpBuffer=0x12c60000*, nNumberOfBytesToWrite=0xa92f, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesWritten=0x12422b84*=0xa92f, lpOverlapped=0x0) returned 1
	[0248.098] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0248.157] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0248.158] CloseHandle (hObject=0x17c) returned 1
	[0248.160] CloseHandle (hObject=0x178) returned 1
	[0248.160] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123d00e0*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x123d00e0*, lpNumberOfCharsWritten=0x1242283c*=0x34) returned 1
	[0248.177] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\MJtStno\\UQjVL.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\mjtstno\\uqjvl.png")) returned 1
	[0248.202] SetEvent (hEvent=0x12c) returned 1
	[0248.204] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0248.232] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0248.232] SetEvent (hEvent=0x12c) returned 1
	[0248.232] SetEvent (hEvent=0x124) returned 1
	[0248.233] SetEvent (hEvent=0x14c) returned 1
	[0248.233] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0248.278] SetEvent (hEvent=0x168) returned 1
	[0248.278] SetEvent (hEvent=0x14c) returned 1
	[0248.314] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0248.346] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0248.346] SetEvent (hEvent=0x14c) returned 1
	[0248.349] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0248.358] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0248.358] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0248.391] SetEvent (hEvent=0x14c) returned 1
	[0248.391] SetEvent (hEvent=0x124) returned 1
	[0248.391] SetEvent (hEvent=0x12c) returned 1
	[0248.391] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0248.456] SetEvent (hEvent=0x168) returned 1
	[0248.456] SetEvent (hEvent=0x12c) returned 1
	[0248.457] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\MJtStno\\UQjVL.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\mjtstno\\uqjvl.png"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0248.559] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0248.559] WriteFile (in: hFile=0x178, lpBuffer=0x12896000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x12896000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0248.601] CloseHandle (hObject=0x178) returned 1
	[0248.667] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\MJtStno\\UQjVL.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\mjtstno\\uqjvl.png")) returned 1
	[0248.745] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\QixwzNlhzqpngSpTJiG.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\qixwznlhzqpngsptjig.avi"), fInfoLevelId=0x0, lpFileInformation=0x125da0a8 | out: lpFileInformation=0x125da0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42a82800, ftCreationTime.dwHighDateTime=0x1d8220f, ftLastAccessTime.dwLowDateTime=0x1c2acb40, ftLastAccessTime.dwHighDateTime=0x1d824a5, ftLastWriteTime.dwLowDateTime=0x1c2acb40, ftLastWriteTime.dwHighDateTime=0x1d824a5, nFileSizeHigh=0x0, nFileSizeLow=0xe608)) returned 1
	[0248.745] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\QixwzNlhzqpngSpTJiG.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\qixwznlhzqpngsptjig.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0248.745] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0248.745] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\QixwzNlhzqpngSpTJiG.avi.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\qixwznlhzqpngsptjig.avi.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0248.790] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0248.790] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x126c4060 | out: pbBuffer=0x126c4060) returned 1
	[0248.790] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124121b0 | out: pbBuffer=0x124121b0) returned 1
	[0248.790] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc101 | out: pbBuffer=0x123fc101) returned 1
	[0248.790] WriteFile (in: hFile=0x17c, lpBuffer=0x12893000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12893000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0248.794] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0248.797] SetEvent (hEvent=0x168) returned 1
	[0248.797] SetEvent (hEvent=0x124) returned 1
	[0248.797] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0xe608, lpOverlapped=0x0) returned 1
	[0248.800] WriteFile (in: hFile=0x17c, lpBuffer=0x12c60000*, nNumberOfBytesToWrite=0xe608, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesWritten=0x12422be8*=0xe608, lpOverlapped=0x0) returned 1
	[0248.836] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0248.836] CloseHandle (hObject=0x17c) returned 1
	[0248.880] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0249.044] CloseHandle (hObject=0x178) returned 1
	[0249.044] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123fc080*, nNumberOfCharsToWrite=0x3a, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x123fc080*, lpNumberOfCharsWritten=0x124228a0*=0x3a) returned 1
	[0249.061] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\QixwzNlhzqpngSpTJiG.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\qixwznlhzqpngsptjig.avi")) returned 1
	[0249.097] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0249.152] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0249.152] SetEvent (hEvent=0x168) returned 1
	[0249.152] SetEvent (hEvent=0x124) returned 1
	[0249.153] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0249.160] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0249.160] SetEvent (hEvent=0x124) returned 1
	[0249.160] SetEvent (hEvent=0x174) returned 1
	[0249.160] SetEvent (hEvent=0x14c) returned 1
	[0249.160] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0249.216] SetEvent (hEvent=0x168) returned 1
	[0249.216] SetEvent (hEvent=0x14c) returned 1
	[0249.238] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0249.266] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0249.266] SetEvent (hEvent=0x14c) returned 1
	[0249.270] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0249.423] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0249.509] SetEvent (hEvent=0x14c) returned 1
	[0249.509] SetEvent (hEvent=0x174) returned 1
	[0249.509] SetEvent (hEvent=0x124) returned 1
	[0249.509] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0249.546] SetEvent (hEvent=0x168) returned 1
	[0249.546] SetEvent (hEvent=0x124) returned 1
	[0249.547] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\QixwzNlhzqpngSpTJiG.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\qixwznlhzqpngsptjig.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0249.562] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0249.562] WriteFile (in: hFile=0x178, lpBuffer=0x12896000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x12896000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0249.607] CloseHandle (hObject=0x178) returned 1
	[0249.678] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\QixwzNlhzqpngSpTJiG.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\qixwznlhzqpngsptjig.avi")) returned 1
	[0249.692] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\R3 MdJzJmTt.ods" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r3 mdjzjmtt.ods"), fInfoLevelId=0x0, lpFileInformation=0x125da008 | out: lpFileInformation=0x125da008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c4f3480, ftCreationTime.dwHighDateTime=0x1d81ce2, ftLastAccessTime.dwLowDateTime=0x6eff9930, ftLastAccessTime.dwHighDateTime=0x1d82483, ftLastWriteTime.dwLowDateTime=0x6eff9930, ftLastWriteTime.dwHighDateTime=0x1d82483, nFileSizeHigh=0x0, nFileSizeLow=0x17577)) returned 1
	[0249.692] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\R3 MdJzJmTt.ods" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r3 mdjzjmtt.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0249.692] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0249.692] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\R3 MdJzJmTt.ods.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r3 mdjzjmtt.ods.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0249.693] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0249.693] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x126c4040 | out: pbBuffer=0x126c4040) returned 1
	[0249.693] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x123ce130 | out: pbBuffer=0x123ce130) returned 1
	[0249.693] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0249.693] WriteFile (in: hFile=0x17c, lpBuffer=0x12891000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12891000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0249.695] SetEvent (hEvent=0x174) returned 1
	[0249.695] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x17577, lpOverlapped=0x0) returned 1
	[0249.700] WriteFile (in: hFile=0x17c, lpBuffer=0x12c60000*, nNumberOfBytesToWrite=0x17577, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesWritten=0x12422be8*=0x17577, lpOverlapped=0x0) returned 1
	[0249.728] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0249.728] CloseHandle (hObject=0x17c) returned 1
	[0249.731] CloseHandle (hObject=0x178) returned 1
	[0249.732] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12428000*, nNumberOfCharsToWrite=0x32, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x12428000*, lpNumberOfCharsWritten=0x124228a0*=0x32) returned 1
	[0249.763] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0249.901] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\R3 MdJzJmTt.ods" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r3 mdjzjmtt.ods")) returned 1
	[0249.939] SetEvent (hEvent=0x174) returned 1
	[0249.941] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0249.953] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0249.953] SetEvent (hEvent=0x174) returned 1
	[0249.953] SetEvent (hEvent=0x12c) returned 1
	[0249.953] SetEvent (hEvent=0x14c) returned 1
	[0249.953] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0250.053] SetEvent (hEvent=0x168) returned 1
	[0250.053] SetEvent (hEvent=0x14c) returned 1
	[0250.106] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0250.137] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0250.137] SetEvent (hEvent=0x14c) returned 1
	[0250.139] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0250.166] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0250.166] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0250.192] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0250.192] SetEvent (hEvent=0x14c) returned 1
	[0250.192] SetEvent (hEvent=0x12c) returned 1
	[0250.192] SetEvent (hEvent=0x174) returned 1
	[0250.192] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0250.227] SetEvent (hEvent=0x168) returned 1
	[0250.228] SetEvent (hEvent=0x174) returned 1
	[0250.228] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\R3 MdJzJmTt.ods" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r3 mdjzjmtt.ods"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0250.265] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0250.265] WriteFile (in: hFile=0x178, lpBuffer=0x12896000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x12896000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0250.300] CloseHandle (hObject=0x178) returned 1
	[0250.374] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\R3 MdJzJmTt.ods" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\r3 mdjzjmtt.ods")) returned 1
	[0250.467] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\S-eoW0hMerDLmPid.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\s-eow0hmerdlmpid.mp4"), fInfoLevelId=0x0, lpFileInformation=0x125da058 | out: lpFileInformation=0x125da058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d631a50, ftCreationTime.dwHighDateTime=0x1d821b6, ftLastAccessTime.dwLowDateTime=0x8e826d80, ftLastAccessTime.dwHighDateTime=0x1d825cf, ftLastWriteTime.dwLowDateTime=0x8e826d80, ftLastWriteTime.dwHighDateTime=0x1d825cf, nFileSizeHigh=0x0, nFileSizeLow=0x447c)) returned 1
	[0250.467] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\S-eoW0hMerDLmPid.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\s-eow0hmerdlmpid.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0250.467] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0250.467] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\S-eoW0hMerDLmPid.mp4.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\s-eow0hmerdlmpid.mp4.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0250.468] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0250.468] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x126c4040 | out: pbBuffer=0x126c4040) returned 1
	[0250.468] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124121a0 | out: pbBuffer=0x124121a0) returned 1
	[0250.468] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0281 | out: pbBuffer=0x123c0281) returned 1
	[0250.469] WriteFile (in: hFile=0x17c, lpBuffer=0x12891000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12891000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0250.472] SetEvent (hEvent=0x12c) returned 1
	[0250.472] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x447c, lpOverlapped=0x0) returned 1
	[0250.474] WriteFile (in: hFile=0x17c, lpBuffer=0x12c60000*, nNumberOfBytesToWrite=0x447c, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesWritten=0x12422be8*=0x447c, lpOverlapped=0x0) returned 1
	[0250.487] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0250.487] CloseHandle (hObject=0x17c) returned 1
	[0250.489] CloseHandle (hObject=0x178) returned 1
	[0250.489] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123d00e0*, nNumberOfCharsToWrite=0x37, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x123d00e0*, lpNumberOfCharsWritten=0x124228a0*=0x37) returned 1
	[0250.511] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0250.737] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\S-eoW0hMerDLmPid.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\s-eow0hmerdlmpid.mp4")) returned 1
	[0250.760] SetEvent (hEvent=0x12c) returned 1
	[0250.762] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0250.797] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0250.797] SetEvent (hEvent=0x12c) returned 1
	[0250.797] SetEvent (hEvent=0x124) returned 1
	[0250.797] SetEvent (hEvent=0x14c) returned 1
	[0250.797] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0250.839] SetEvent (hEvent=0x14c) returned 1
	[0250.875] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0250.886] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0250.886] SetEvent (hEvent=0x168) returned 1
	[0250.886] SetEvent (hEvent=0x14c) returned 1
	[0250.889] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0250.983] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0250.983] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0251.028] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0251.028] SetEvent (hEvent=0x14c) returned 1
	[0251.028] SetEvent (hEvent=0x124) returned 1
	[0251.028] SetEvent (hEvent=0x12c) returned 1
	[0251.028] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0251.087] SetEvent (hEvent=0x168) returned 1
	[0251.087] SetEvent (hEvent=0x12c) returned 1
	[0251.087] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\S-eoW0hMerDLmPid.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\s-eow0hmerdlmpid.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0251.096] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0251.096] WriteFile (in: hFile=0x178, lpBuffer=0x12896000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x12896000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0251.140] CloseHandle (hObject=0x178) returned 1
	[0251.190] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\S-eoW0hMerDLmPid.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\s-eow0hmerdlmpid.mp4")) returned 1
	[0251.206] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\SFjU-GGjjEg.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\sfju-ggjjeg.wav"), fInfoLevelId=0x0, lpFileInformation=0x125da008 | out: lpFileInformation=0x125da008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eba1e10, ftCreationTime.dwHighDateTime=0x1d8231e, ftLastAccessTime.dwLowDateTime=0xa6472670, ftLastAccessTime.dwHighDateTime=0x1d825c7, ftLastWriteTime.dwLowDateTime=0xa6472670, ftLastWriteTime.dwHighDateTime=0x1d825c7, nFileSizeHigh=0x0, nFileSizeLow=0x10a77)) returned 1
	[0251.206] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\SFjU-GGjjEg.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\sfju-ggjjeg.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0251.207] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0251.207] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\SFjU-GGjjEg.wav.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\sfju-ggjjeg.wav.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0251.207] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0251.207] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x126c4040 | out: pbBuffer=0x126c4040) returned 1
	[0251.207] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x123ce130 | out: pbBuffer=0x123ce130) returned 1
	[0251.207] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0251.208] WriteFile (in: hFile=0x17c, lpBuffer=0x12893000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12893000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0251.211] SetEvent (hEvent=0x124) returned 1
	[0251.211] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x10a77, lpOverlapped=0x0) returned 1
	[0251.215] WriteFile (in: hFile=0x17c, lpBuffer=0x12c60000*, nNumberOfBytesToWrite=0x10a77, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesWritten=0x12422be8*=0x10a77, lpOverlapped=0x0) returned 1
	[0251.221] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0251.221] CloseHandle (hObject=0x17c) returned 1
	[0251.226] CloseHandle (hObject=0x178) returned 1
	[0251.226] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12428000*, nNumberOfCharsToWrite=0x32, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x12428000*, lpNumberOfCharsWritten=0x124228a0*=0x32) returned 1
	[0251.273] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0251.332] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\SFjU-GGjjEg.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\sfju-ggjjeg.wav")) returned 1
	[0251.423] SetEvent (hEvent=0x124) returned 1
	[0251.425] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0251.496] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0251.496] SetEvent (hEvent=0x124) returned 1
	[0251.496] SetEvent (hEvent=0x174) returned 1
	[0251.496] SetEvent (hEvent=0x14c) returned 1
	[0251.496] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0251.563] SetEvent (hEvent=0x168) returned 1
	[0251.563] SetEvent (hEvent=0x14c) returned 1
	[0251.589] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0251.612] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0251.612] SetEvent (hEvent=0x14c) returned 1
	[0251.614] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0251.704] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0251.704] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0251.711] SetEvent (hEvent=0x14c) returned 1
	[0251.711] SetEvent (hEvent=0x174) returned 1
	[0251.711] SetEvent (hEvent=0x124) returned 1
	[0251.711] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0251.750] SetEvent (hEvent=0x168) returned 1
	[0251.750] SetEvent (hEvent=0x124) returned 1
	[0251.751] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\SFjU-GGjjEg.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\sfju-ggjjeg.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0251.795] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0251.795] WriteFile (in: hFile=0x178, lpBuffer=0x12896000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x12896000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0251.846] CloseHandle (hObject=0x178) returned 1
	[0251.987] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\SFjU-GGjjEg.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\sfju-ggjjeg.wav")) returned 1
	[0252.039] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\SJsz9b80pOXI.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\sjsz9b80poxi.wav"), fInfoLevelId=0x0, lpFileInformation=0x125da058 | out: lpFileInformation=0x125da058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13b80350, ftCreationTime.dwHighDateTime=0x1d81ba5, ftLastAccessTime.dwLowDateTime=0xe5008f0, ftLastAccessTime.dwHighDateTime=0x1d821d0, ftLastWriteTime.dwLowDateTime=0xe5008f0, ftLastWriteTime.dwHighDateTime=0x1d821d0, nFileSizeHigh=0x0, nFileSizeLow=0x148a6)) returned 1
	[0252.039] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\SJsz9b80pOXI.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\sjsz9b80poxi.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0252.039] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0252.039] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\SJsz9b80pOXI.wav.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\sjsz9b80poxi.wav.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0252.079] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0252.079] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x126c4040 | out: pbBuffer=0x126c4040) returned 1
	[0252.079] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x123ce130 | out: pbBuffer=0x123ce130) returned 1
	[0252.079] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0252.079] WriteFile (in: hFile=0x17c, lpBuffer=0x12539000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12539000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0252.083] SetEvent (hEvent=0x174) returned 1
	[0252.083] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x148a6, lpOverlapped=0x0) returned 1
	[0252.087] WriteFile (in: hFile=0x17c, lpBuffer=0x12c60000*, nNumberOfBytesToWrite=0x148a6, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesWritten=0x12422be8*=0x148a6, lpOverlapped=0x0) returned 1
	[0252.118] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0252.119] CloseHandle (hObject=0x17c) returned 1
	[0252.157] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0252.283] CloseHandle (hObject=0x178) returned 1
	[0252.284] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12428000*, nNumberOfCharsToWrite=0x33, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x12428000*, lpNumberOfCharsWritten=0x124228a0*=0x33) returned 1
	[0252.412] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\SJsz9b80pOXI.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\sjsz9b80poxi.wav")) returned 1
	[0252.443] SetEvent (hEvent=0x174) returned 1
	[0252.446] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0252.473] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0252.473] SetEvent (hEvent=0x174) returned 1
	[0252.474] SetEvent (hEvent=0x12c) returned 1
	[0252.474] SetEvent (hEvent=0x14c) returned 1
	[0252.474] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0252.484] SetEvent (hEvent=0x168) returned 1
	[0252.484] SetEvent (hEvent=0x14c) returned 1
	[0252.518] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0252.521] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0252.521] SetEvent (hEvent=0x14c) returned 1
	[0252.523] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0252.526] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0252.526] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0252.552] SetEvent (hEvent=0x14c) returned 1
	[0252.552] SetEvent (hEvent=0x12c) returned 1
	[0252.552] SetEvent (hEvent=0x174) returned 1
	[0252.552] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0252.556] SetEvent (hEvent=0x168) returned 1
	[0252.556] SetEvent (hEvent=0x174) returned 1
	[0252.557] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\SJsz9b80pOXI.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\sjsz9b80poxi.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0252.577] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0252.577] WriteFile (in: hFile=0x178, lpBuffer=0x12896000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x12896000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0252.612] CloseHandle (hObject=0x178) returned 1
	[0252.743] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\SJsz9b80pOXI.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\sjsz9b80poxi.wav")) returned 1
	[0252.761] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Sp32K2MJT8oGwSN.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\sp32k2mjt8ogwsn.gif"), fInfoLevelId=0x0, lpFileInformation=0x125da008 | out: lpFileInformation=0x125da008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2afd2e0, ftCreationTime.dwHighDateTime=0x1d81c9a, ftLastAccessTime.dwLowDateTime=0x30067700, ftLastAccessTime.dwHighDateTime=0x1d82067, ftLastWriteTime.dwLowDateTime=0x30067700, ftLastWriteTime.dwHighDateTime=0x1d82067, nFileSizeHigh=0x0, nFileSizeLow=0xe8f3)) returned 1
	[0252.761] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Sp32K2MJT8oGwSN.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\sp32k2mjt8ogwsn.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0252.761] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0252.761] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Sp32K2MJT8oGwSN.gif.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\sp32k2mjt8ogwsn.gif.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0252.762] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0252.762] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x126c4040 | out: pbBuffer=0x126c4040) returned 1
	[0252.762] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x123ce130 | out: pbBuffer=0x123ce130) returned 1
	[0252.762] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0281 | out: pbBuffer=0x123c0281) returned 1
	[0252.762] WriteFile (in: hFile=0x17c, lpBuffer=0x12891000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12891000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0252.765] SetEvent (hEvent=0x12c) returned 1
	[0252.765] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0xe8f3, lpOverlapped=0x0) returned 1
	[0252.769] WriteFile (in: hFile=0x17c, lpBuffer=0x12c60000*, nNumberOfBytesToWrite=0xe8f3, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesWritten=0x12422be8*=0xe8f3, lpOverlapped=0x0) returned 1
	[0252.773] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0252.774] CloseHandle (hObject=0x17c) returned 1
	[0252.779] CloseHandle (hObject=0x178) returned 1
	[0252.779] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123d00e0*, nNumberOfCharsToWrite=0x36, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x123d00e0*, lpNumberOfCharsWritten=0x124228a0*=0x36) returned 1
	[0252.801] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0252.818] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Sp32K2MJT8oGwSN.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\sp32k2mjt8ogwsn.gif")) returned 1
	[0252.829] SetEvent (hEvent=0x12c) returned 1
	[0252.831] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0252.863] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0252.863] SetEvent (hEvent=0x12c) returned 1
	[0252.863] SetEvent (hEvent=0x124) returned 1
	[0252.863] SetEvent (hEvent=0x14c) returned 1
	[0252.863] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0252.870] SetEvent (hEvent=0x168) returned 1
	[0252.872] SetEvent (hEvent=0x14c) returned 1
	[0252.908] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0252.927] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0252.927] SetEvent (hEvent=0x14c) returned 1
	[0253.025] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0253.119] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0253.119] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0253.171] SetEvent (hEvent=0x14c) returned 1
	[0253.171] SetEvent (hEvent=0x124) returned 1
	[0253.171] SetEvent (hEvent=0x12c) returned 1
	[0253.171] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0253.326] SetEvent (hEvent=0x168) returned 1
	[0253.326] SetEvent (hEvent=0x12c) returned 1
	[0253.327] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Sp32K2MJT8oGwSN.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\sp32k2mjt8ogwsn.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0253.370] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0253.370] WriteFile (in: hFile=0x178, lpBuffer=0x12896000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x12896000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0253.413] CloseHandle (hObject=0x178) returned 1
	[0253.455] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Sp32K2MJT8oGwSN.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\sp32k2mjt8ogwsn.gif")) returned 1
	[0253.478] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WYG6ic.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\wyg6ic.jpg"), fInfoLevelId=0x0, lpFileInformation=0x125da058 | out: lpFileInformation=0x125da058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf378f7f0, ftCreationTime.dwHighDateTime=0x1d81b29, ftLastAccessTime.dwLowDateTime=0x41b547e0, ftLastAccessTime.dwHighDateTime=0x1d82933, ftLastWriteTime.dwLowDateTime=0x41b547e0, ftLastWriteTime.dwHighDateTime=0x1d82933, nFileSizeHigh=0x0, nFileSizeLow=0x36bc)) returned 1
	[0253.478] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WYG6ic.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\wyg6ic.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0253.479] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0253.479] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WYG6ic.jpg.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\wyg6ic.jpg.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0253.479] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0253.479] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x126c4040 | out: pbBuffer=0x126c4040) returned 1
	[0253.479] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124121a0 | out: pbBuffer=0x124121a0) returned 1
	[0253.479] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0253.480] WriteFile (in: hFile=0x17c, lpBuffer=0x12893000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12893000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0253.482] SetEvent (hEvent=0x124) returned 1
	[0253.482] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x36bc, lpOverlapped=0x0) returned 1
	[0253.484] WriteFile (in: hFile=0x17c, lpBuffer=0x12c60000*, nNumberOfBytesToWrite=0x36bc, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesWritten=0x12422be8*=0x36bc, lpOverlapped=0x0) returned 1
	[0253.517] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0253.517] CloseHandle (hObject=0x17c) returned 1
	[0253.526] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0253.716] CloseHandle (hObject=0x178) returned 1
	[0253.716] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12504000*, nNumberOfCharsToWrite=0x2d, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x12504000*, lpNumberOfCharsWritten=0x124228a0*=0x2d) returned 1
	[0253.778] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WYG6ic.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\wyg6ic.jpg")) returned 1
	[0253.792] SetEvent (hEvent=0x124) returned 1
	[0253.793] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0253.825] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0253.825] SetEvent (hEvent=0x124) returned 1
	[0253.826] SetEvent (hEvent=0x174) returned 1
	[0253.826] SetEvent (hEvent=0x14c) returned 1
	[0253.826] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0253.886] SetEvent (hEvent=0x168) returned 1
	[0253.887] SetEvent (hEvent=0x14c) returned 1
	[0253.909] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0253.923] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0253.923] SetEvent (hEvent=0x14c) returned 1
	[0253.925] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0253.950] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0253.950] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0253.980] SetEvent (hEvent=0x14c) returned 1
	[0253.980] SetEvent (hEvent=0x174) returned 1
	[0253.980] SetEvent (hEvent=0x124) returned 1
	[0253.980] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0254.014] SetEvent (hEvent=0x168) returned 1
	[0254.014] SetEvent (hEvent=0x124) returned 1
	[0254.015] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WYG6ic.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\wyg6ic.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0254.017] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0254.018] WriteFile (in: hFile=0x178, lpBuffer=0x12896000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x12896000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0254.050] CloseHandle (hObject=0x178) returned 1
	[0254.082] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WYG6ic.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\wyg6ic.jpg")) returned 1
	[0254.120] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\YUi--Xwk3SNHRau.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\yui--xwk3snhrau.bmp"), fInfoLevelId=0x0, lpFileInformation=0x125da008 | out: lpFileInformation=0x125da008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ef61ad0, ftCreationTime.dwHighDateTime=0x1d825cb, ftLastAccessTime.dwLowDateTime=0x80cf5280, ftLastAccessTime.dwHighDateTime=0x1d8274f, ftLastWriteTime.dwLowDateTime=0x80cf5280, ftLastWriteTime.dwHighDateTime=0x1d8274f, nFileSizeHigh=0x0, nFileSizeLow=0x1564e)) returned 1
	[0254.120] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\YUi--Xwk3SNHRau.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\yui--xwk3snhrau.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0254.120] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0254.120] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\YUi--Xwk3SNHRau.bmp.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\yui--xwk3snhrau.bmp.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0254.120] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0254.120] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x126c4040 | out: pbBuffer=0x126c4040) returned 1
	[0254.121] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124121a0 | out: pbBuffer=0x124121a0) returned 1
	[0254.121] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0281 | out: pbBuffer=0x123c0281) returned 1
	[0254.121] WriteFile (in: hFile=0x17c, lpBuffer=0x12891000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12891000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0254.124] SetEvent (hEvent=0x174) returned 1
	[0254.124] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x1564e, lpOverlapped=0x0) returned 1
	[0254.133] WriteFile (in: hFile=0x17c, lpBuffer=0x12c60000*, nNumberOfBytesToWrite=0x1564e, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesWritten=0x12422be8*=0x1564e, lpOverlapped=0x0) returned 1
	[0254.193] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0254.230] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0254.230] CloseHandle (hObject=0x17c) returned 1
	[0254.246] CloseHandle (hObject=0x178) returned 1
	[0254.246] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123d00e0*, nNumberOfCharsToWrite=0x36, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x123d00e0*, lpNumberOfCharsWritten=0x124228a0*=0x36) returned 1
	[0254.294] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\YUi--Xwk3SNHRau.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\yui--xwk3snhrau.bmp")) returned 1
	[0254.314] SetEvent (hEvent=0x174) returned 1
	[0254.318] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0254.342] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0254.342] SetEvent (hEvent=0x174) returned 1
	[0254.342] SetEvent (hEvent=0x14c) returned 1
	[0254.342] SetEvent (hEvent=0x124) returned 1
	[0254.342] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0254.353] SetEvent (hEvent=0x168) returned 1
	[0254.353] SetEvent (hEvent=0x124) returned 1
	[0254.374] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0254.418] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0254.418] SetEvent (hEvent=0x124) returned 1
	[0254.420] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0254.446] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0254.447] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0254.478] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0254.478] SetEvent (hEvent=0x124) returned 1
	[0254.479] SetEvent (hEvent=0x14c) returned 1
	[0254.479] SetEvent (hEvent=0x174) returned 1
	[0254.479] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0254.513] SetEvent (hEvent=0x168) returned 1
	[0254.513] SetEvent (hEvent=0x174) returned 1
	[0254.514] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\YUi--Xwk3SNHRau.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\yui--xwk3snhrau.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0254.539] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0254.539] WriteFile (in: hFile=0x178, lpBuffer=0x12896000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x12896000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0254.569] CloseHandle (hObject=0x178) returned 1
	[0254.650] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\YUi--Xwk3SNHRau.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\yui--xwk3snhrau.bmp")) returned 1
	[0254.710] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\ZKt7SKs8.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\zkt7sks8.mp4"), fInfoLevelId=0x0, lpFileInformation=0x125da058 | out: lpFileInformation=0x125da058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc26a4280, ftCreationTime.dwHighDateTime=0x1d82917, ftLastAccessTime.dwLowDateTime=0x5f56be70, ftLastAccessTime.dwHighDateTime=0x1d82981, ftLastWriteTime.dwLowDateTime=0x5f56be70, ftLastWriteTime.dwHighDateTime=0x1d82981, nFileSizeHigh=0x0, nFileSizeLow=0x28bc)) returned 1
	[0254.711] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\ZKt7SKs8.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\zkt7sks8.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0254.711] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0254.711] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\ZKt7SKs8.mp4.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\zkt7sks8.mp4.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0254.746] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0254.746] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x126c4040 | out: pbBuffer=0x126c4040) returned 1
	[0254.746] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x123ce130 | out: pbBuffer=0x123ce130) returned 1
	[0254.746] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0254.747] WriteFile (in: hFile=0x17c, lpBuffer=0x12537000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12537000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0254.750] SetEvent (hEvent=0x14c) returned 1
	[0254.750] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x28bc, lpOverlapped=0x0) returned 1
	[0254.752] WriteFile (in: hFile=0x17c, lpBuffer=0x12c60000*, nNumberOfBytesToWrite=0x28bc, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesWritten=0x12422be8*=0x28bc, lpOverlapped=0x0) returned 1
	[0254.795] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0254.795] CloseHandle (hObject=0x17c) returned 1
	[0254.805] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0254.899] CloseHandle (hObject=0x178) returned 1
	[0254.899] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12504000*, nNumberOfCharsToWrite=0x2f, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x12504000*, lpNumberOfCharsWritten=0x124228a0*=0x2f) returned 1
	[0254.951] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\ZKt7SKs8.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\zkt7sks8.mp4")) returned 1
	[0254.981] SetEvent (hEvent=0x14c) returned 1
	[0254.983] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0254.986] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0254.986] SetEvent (hEvent=0x14c) returned 1
	[0254.986] SetEvent (hEvent=0x12c) returned 1
	[0254.986] SetEvent (hEvent=0x124) returned 1
	[0254.986] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0255.018] SetEvent (hEvent=0x168) returned 1
	[0255.019] SetEvent (hEvent=0x124) returned 1
	[0255.046] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0255.076] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0255.076] SetEvent (hEvent=0x124) returned 1
	[0255.078] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0255.132] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0255.132] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0255.138] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0255.138] SetEvent (hEvent=0x124) returned 1
	[0255.138] SetEvent (hEvent=0x12c) returned 1
	[0255.138] SetEvent (hEvent=0x14c) returned 1
	[0255.138] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0255.141] SetEvent (hEvent=0x168) returned 1
	[0255.141] SetEvent (hEvent=0x14c) returned 1
	[0255.142] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\ZKt7SKs8.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\zkt7sks8.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0255.146] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0255.147] WriteFile (in: hFile=0x178, lpBuffer=0x12896000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x12896000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0255.623] CloseHandle (hObject=0x178) returned 1
	[0256.095] SetEvent (hEvent=0x168) returned 1
	[0256.095] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\ZKt7SKs8.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\zkt7sks8.mp4")) returned 1
	[0256.167] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aOaBV.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\aoabv.bmp"), fInfoLevelId=0x0, lpFileInformation=0x125da008 | out: lpFileInformation=0x125da008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaacc7d0, ftCreationTime.dwHighDateTime=0x1d82792, ftLastAccessTime.dwLowDateTime=0x40e5cdc0, ftLastAccessTime.dwHighDateTime=0x1d827d1, ftLastWriteTime.dwLowDateTime=0x40e5cdc0, ftLastWriteTime.dwHighDateTime=0x1d827d1, nFileSizeHigh=0x0, nFileSizeLow=0x4120)) returned 1
	[0256.167] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aOaBV.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\aoabv.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0256.167] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0256.168] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aOaBV.bmp.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\aoabv.bmp.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0256.168] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0256.168] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x126c4040 | out: pbBuffer=0x126c4040) returned 1
	[0256.168] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x123ce130 | out: pbBuffer=0x123ce130) returned 1
	[0256.168] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0256.168] WriteFile (in: hFile=0x17c, lpBuffer=0x12891000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12891000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0256.171] SetEvent (hEvent=0x12c) returned 1
	[0256.171] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x4120, lpOverlapped=0x0) returned 1
	[0256.173] WriteFile (in: hFile=0x17c, lpBuffer=0x12c60000*, nNumberOfBytesToWrite=0x4120, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesWritten=0x12422be8*=0x4120, lpOverlapped=0x0) returned 1
	[0256.199] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0256.200] CloseHandle (hObject=0x17c) returned 1
	[0256.204] CloseHandle (hObject=0x178) returned 1
	[0256.204] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12506000*, nNumberOfCharsToWrite=0x2c, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x12506000*, lpNumberOfCharsWritten=0x124228a0*=0x2c) returned 1
	[0256.222] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0256.234] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aOaBV.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\aoabv.bmp")) returned 1
	[0256.250] SetEvent (hEvent=0x12c) returned 1
	[0256.252] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0256.255] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0256.255] SetEvent (hEvent=0x12c) returned 1
	[0256.255] SetEvent (hEvent=0x174) returned 1
	[0256.255] SetEvent (hEvent=0x124) returned 1
	[0256.255] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0256.282] SetEvent (hEvent=0x168) returned 1
	[0256.282] SetEvent (hEvent=0x124) returned 1
	[0256.313] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0256.315] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0256.315] SetEvent (hEvent=0x124) returned 1
	[0256.318] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0256.319] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0256.319] SetEvent (hEvent=0x124) returned 1
	[0256.319] SetEvent (hEvent=0x174) returned 1
	[0256.319] SetEvent (hEvent=0x12c) returned 1
	[0256.319] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0256.319] SetEvent (hEvent=0x12c) returned 1
	[0256.320] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aOaBV.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\aoabv.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0256.321] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0256.321] WriteFile (in: hFile=0x178, lpBuffer=0x12896000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x12896000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0256.438] CloseHandle (hObject=0x178) returned 1
	[0256.478] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aOaBV.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\aoabv.bmp")) returned 1
	[0256.492] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe"), fInfoLevelId=0x0, lpFileInformation=0x125da058 | out: lpFileInformation=0x125da058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7553c700, ftCreationTime.dwHighDateTime=0x1d83aa1, ftLastAccessTime.dwLowDateTime=0x7553c700, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xc8268200, ftLastWriteTime.dwHighDateTime=0x1d83a93, nFileSizeHigh=0x0, nFileSizeLow=0x31f000)) returned 1
	[0256.492] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\bYMSr1.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\bymsr1.mkv"), fInfoLevelId=0x0, lpFileInformation=0x125da0a8 | out: lpFileInformation=0x125da0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f386aa0, ftCreationTime.dwHighDateTime=0x1d819fc, ftLastAccessTime.dwLowDateTime=0x659b8460, ftLastAccessTime.dwHighDateTime=0x1d81cec, ftLastWriteTime.dwLowDateTime=0x659b8460, ftLastWriteTime.dwHighDateTime=0x1d81cec, nFileSizeHigh=0x0, nFileSizeLow=0x62b5)) returned 1
	[0256.492] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\bYMSr1.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\bymsr1.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0256.492] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0256.492] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\bYMSr1.mkv.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\bymsr1.mkv.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0256.492] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0256.492] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x126c4080 | out: pbBuffer=0x126c4080) returned 1
	[0256.493] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124122a0 | out: pbBuffer=0x124122a0) returned 1
	[0256.493] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0256.493] WriteFile (in: hFile=0x17c, lpBuffer=0x12893000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12893000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0256.495] SetEvent (hEvent=0x174) returned 1
	[0256.496] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x62b5, lpOverlapped=0x0) returned 1
	[0256.498] WriteFile (in: hFile=0x17c, lpBuffer=0x12c60000*, nNumberOfBytesToWrite=0x62b5, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesWritten=0x12422be8*=0x62b5, lpOverlapped=0x0) returned 1
	[0256.501] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0256.501] CloseHandle (hObject=0x17c) returned 1
	[0256.504] CloseHandle (hObject=0x178) returned 1
	[0256.504] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12508000*, nNumberOfCharsToWrite=0x2d, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x12508000*, lpNumberOfCharsWritten=0x124228a0*=0x2d) returned 1
	[0256.516] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0256.518] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\bYMSr1.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\bymsr1.mkv")) returned 1
	[0256.525] SetEvent (hEvent=0x174) returned 1
	[0256.526] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0256.526] SetEvent (hEvent=0x174) returned 1
	[0256.526] SetEvent (hEvent=0x14c) returned 1
	[0256.526] SetEvent (hEvent=0x124) returned 1
	[0256.526] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0256.527] SetEvent (hEvent=0x124) returned 1
	[0256.553] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0256.555] SetEvent (hEvent=0x168) returned 1
	[0256.555] SetEvent (hEvent=0x124) returned 1
	[0256.557] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0256.558] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0256.558] SetEvent (hEvent=0x124) returned 1
	[0256.558] SetEvent (hEvent=0x14c) returned 1
	[0256.558] SetEvent (hEvent=0x174) returned 1
	[0256.558] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0256.559] SetEvent (hEvent=0x174) returned 1
	[0256.559] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\bYMSr1.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\bymsr1.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0256.560] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0256.561] WriteFile (in: hFile=0x178, lpBuffer=0x12896000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x12896000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0256.686] CloseHandle (hObject=0x178) returned 1
	[0256.723] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\bYMSr1.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\bymsr1.mkv")) returned 1
	[0256.752] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\cDIqglnt.pps" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cdiqglnt.pps"), fInfoLevelId=0x0, lpFileInformation=0x125da008 | out: lpFileInformation=0x125da008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdee1adc0, ftCreationTime.dwHighDateTime=0x1d81bcc, ftLastAccessTime.dwLowDateTime=0x89737250, ftLastAccessTime.dwHighDateTime=0x1d824d8, ftLastWriteTime.dwLowDateTime=0x89737250, ftLastWriteTime.dwHighDateTime=0x1d824d8, nFileSizeHigh=0x0, nFileSizeLow=0x94d7)) returned 1
	[0256.752] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\cDIqglnt.pps" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cdiqglnt.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0256.753] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0256.784] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\cDIqglnt.pps.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cdiqglnt.pps.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0256.785] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0256.785] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x126c4040 | out: pbBuffer=0x126c4040) returned 1
	[0256.785] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x123ce130 | out: pbBuffer=0x123ce130) returned 1
	[0256.785] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0256.785] WriteFile (in: hFile=0x17c, lpBuffer=0x12891000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12891000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0256.787] SetEvent (hEvent=0x14c) returned 1
	[0256.787] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x94d7, lpOverlapped=0x0) returned 1
	[0256.794] WriteFile (in: hFile=0x17c, lpBuffer=0x12c60000*, nNumberOfBytesToWrite=0x94d7, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesWritten=0x12422be8*=0x94d7, lpOverlapped=0x0) returned 1
	[0257.114] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0257.114] CloseHandle (hObject=0x17c) returned 1
	[0257.252] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0258.062] CloseHandle (hObject=0x178) returned 1
	[0258.063] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12504000*, nNumberOfCharsToWrite=0x2f, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x12504000*, lpNumberOfCharsWritten=0x124228a0*=0x2f) returned 1
	[0258.118] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\cDIqglnt.pps" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cdiqglnt.pps")) returned 1
	[0258.188] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0258.221] SetEvent (hEvent=0x168) returned 1
	[0258.221] SetEvent (hEvent=0x14c) returned 1
	[0258.223] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0258.258] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0258.258] SetEvent (hEvent=0x14c) returned 1
	[0258.258] SetEvent (hEvent=0x12c) returned 1
	[0258.258] SetEvent (hEvent=0x124) returned 1
	[0258.258] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0258.290] SetEvent (hEvent=0x168) returned 1
	[0258.290] SetEvent (hEvent=0x124) returned 1
	[0258.312] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0258.341] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0258.342] SetEvent (hEvent=0x124) returned 1
	[0258.343] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0258.396] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0258.396] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0258.401] SetEvent (hEvent=0x124) returned 1
	[0258.401] SetEvent (hEvent=0x12c) returned 1
	[0258.401] SetEvent (hEvent=0x14c) returned 1
	[0258.401] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0258.537] SetEvent (hEvent=0x168) returned 1
	[0258.537] SetEvent (hEvent=0x14c) returned 1
	[0258.537] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\cDIqglnt.pps" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cdiqglnt.pps"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0258.546] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0258.547] WriteFile (in: hFile=0x178, lpBuffer=0x12896000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x12896000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0258.822] CloseHandle (hObject=0x178) returned 1
	[0258.868] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\cDIqglnt.pps" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\cdiqglnt.pps")) returned 1
	[0258.887] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\desktop.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x125da058 | out: lpFileInformation=0x125da058*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435fd682, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a)) returned 1
	[0258.887] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\joFK1K4FpCy.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jofk1k4fpcy.odt"), fInfoLevelId=0x0, lpFileInformation=0x125da0a8 | out: lpFileInformation=0x125da0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e0cb320, ftCreationTime.dwHighDateTime=0x1d81f17, ftLastAccessTime.dwLowDateTime=0x52430a30, ftLastAccessTime.dwHighDateTime=0x1d8215d, ftLastWriteTime.dwLowDateTime=0x52430a30, ftLastWriteTime.dwHighDateTime=0x1d8215d, nFileSizeHigh=0x0, nFileSizeLow=0x6c8e)) returned 1
	[0258.887] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\joFK1K4FpCy.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jofk1k4fpcy.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0258.887] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0258.887] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\joFK1K4FpCy.odt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jofk1k4fpcy.odt.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0258.888] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0258.888] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x126c4040 | out: pbBuffer=0x126c4040) returned 1
	[0258.888] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x12412260 | out: pbBuffer=0x12412260) returned 1
	[0258.888] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0258.888] WriteFile (in: hFile=0x17c, lpBuffer=0x12893000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12893000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0258.891] SetEvent (hEvent=0x12c) returned 1
	[0258.891] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x6c8e, lpOverlapped=0x0) returned 1
	[0258.894] WriteFile (in: hFile=0x17c, lpBuffer=0x12c60000*, nNumberOfBytesToWrite=0x6c8e, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesWritten=0x12422be8*=0x6c8e, lpOverlapped=0x0) returned 1
	[0258.949] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0258.949] CloseHandle (hObject=0x17c) returned 1
	[0258.951] CloseHandle (hObject=0x178) returned 1
	[0258.952] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123d00e0*, nNumberOfCharsToWrite=0x32, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x123d00e0*, lpNumberOfCharsWritten=0x124228a0*=0x32) returned 1
	[0258.974] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0259.330] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\joFK1K4FpCy.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jofk1k4fpcy.odt")) returned 1
	[0259.357] SetEvent (hEvent=0x12c) returned 1
	[0259.361] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0259.375] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0259.375] SetEvent (hEvent=0x12c) returned 1
	[0259.375] SetEvent (hEvent=0x174) returned 1
	[0259.375] SetEvent (hEvent=0x124) returned 1
	[0259.375] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0259.422] SetEvent (hEvent=0x168) returned 1
	[0259.422] SetEvent (hEvent=0x124) returned 1
	[0259.463] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0259.477] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0259.477] SetEvent (hEvent=0x124) returned 1
	[0259.480] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0259.537] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0259.537] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0259.553] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0259.553] SetEvent (hEvent=0x124) returned 1
	[0259.553] SetEvent (hEvent=0x174) returned 1
	[0259.553] SetEvent (hEvent=0x12c) returned 1
	[0259.553] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0259.565] SetEvent (hEvent=0x168) returned 1
	[0259.565] SetEvent (hEvent=0x12c) returned 1
	[0259.565] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\joFK1K4FpCy.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jofk1k4fpcy.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0259.575] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0259.575] WriteFile (in: hFile=0x178, lpBuffer=0x12896000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x12896000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0259.602] CloseHandle (hObject=0x178) returned 1
	[0259.633] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\joFK1K4FpCy.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jofk1k4fpcy.odt")) returned 1
	[0259.705] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jqRKACl6" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jqrkacl6"), fInfoLevelId=0x0, lpFileInformation=0x125da008 | out: lpFileInformation=0x125da008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8d7de990, ftCreationTime.dwHighDateTime=0x1d82210, ftLastAccessTime.dwLowDateTime=0xbb0f5fe0, ftLastAccessTime.dwHighDateTime=0x1d8235c, ftLastWriteTime.dwLowDateTime=0xbb0f5fe0, ftLastWriteTime.dwHighDateTime=0x1d8235c, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0259.706] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jqRKACl6" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jqrkacl6"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0259.706] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jqRKACl6\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8d7de990, ftCreationTime.dwHighDateTime=0x1d82210, ftLastAccessTime.dwLowDateTime=0xbb0f5fe0, ftLastAccessTime.dwHighDateTime=0x1d8235c, ftLastWriteTime.dwLowDateTime=0xbb0f5fe0, ftLastWriteTime.dwHighDateTime=0x1d8235c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79faa8
	[0259.706] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8d7de990, ftCreationTime.dwHighDateTime=0x1d82210, ftLastAccessTime.dwLowDateTime=0xbb0f5fe0, ftLastAccessTime.dwHighDateTime=0x1d8235c, ftLastWriteTime.dwLowDateTime=0xbb0f5fe0, ftLastWriteTime.dwHighDateTime=0x1d8235c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0259.706] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5934a370, ftCreationTime.dwHighDateTime=0x1d827b7, ftLastAccessTime.dwLowDateTime=0x2070a4e0, ftLastAccessTime.dwHighDateTime=0x1d8281f, ftLastWriteTime.dwLowDateTime=0x2070a4e0, ftLastWriteTime.dwHighDateTime=0x1d8281f, nFileSizeHigh=0x0, nFileSizeLow=0x41f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="27JfCEVulMHbbO.mp3", cAlternateFileName="27JFCE~1.MP3")) returned 1
	[0259.706] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1fbc980, ftCreationTime.dwHighDateTime=0x1d81c91, ftLastAccessTime.dwLowDateTime=0x351d70c0, ftLastAccessTime.dwHighDateTime=0x1d826a9, ftLastWriteTime.dwLowDateTime=0x351d70c0, ftLastWriteTime.dwHighDateTime=0x1d826a9, nFileSizeHigh=0x0, nFileSizeLow=0xd3b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="9Vntf.mkv", cAlternateFileName="")) returned 1
	[0259.706] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8492c680, ftCreationTime.dwHighDateTime=0x1d81b43, ftLastAccessTime.dwLowDateTime=0xdf940fc0, ftLastAccessTime.dwHighDateTime=0x1d823cd, ftLastWriteTime.dwLowDateTime=0xdf940fc0, ftLastWriteTime.dwHighDateTime=0x1d823cd, nFileSizeHigh=0x0, nFileSizeLow=0xbde9, dwReserved0=0x0, dwReserved1=0x0, cFileName="kfCcoa0Kn4e.mp3", cAlternateFileName="KFCCOA~1.MP3")) returned 1
	[0259.706] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5aaf80, ftCreationTime.dwHighDateTime=0x1d8294d, ftLastAccessTime.dwLowDateTime=0x90911730, ftLastAccessTime.dwHighDateTime=0x1d829ca, ftLastWriteTime.dwLowDateTime=0x90911730, ftLastWriteTime.dwHighDateTime=0x1d829ca, nFileSizeHigh=0x0, nFileSizeLow=0x211d, dwReserved0=0x0, dwReserved1=0x0, cFileName="lkG90.jpg", cAlternateFileName="")) returned 1
	[0259.706] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd59b04e0, ftCreationTime.dwHighDateTime=0x1d82992, ftLastAccessTime.dwLowDateTime=0x3e23e450, ftLastAccessTime.dwHighDateTime=0x1d829a2, ftLastWriteTime.dwLowDateTime=0x3e23e450, ftLastWriteTime.dwHighDateTime=0x1d829a2, nFileSizeHigh=0x0, nFileSizeLow=0x17cd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="w8O0bav5Ww_S.pdf", cAlternateFileName="W8O0BA~1.PDF")) returned 1
	[0259.706] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0259.707] FindClose (in: hFindFile=0x79faa8 | out: hFindFile=0x79faa8) returned 1
	[0259.707] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jqRKACl6\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jqrkacl6\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0259.707] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d30 | out: lpMode=0x12422d30) returned 0
	[0259.707] WriteFile (in: hFile=0x178, lpBuffer=0x12694000*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d20, lpOverlapped=0x0 | out: lpBuffer=0x12694000*, lpNumberOfBytesWritten=0x12422d20*=0xc85, lpOverlapped=0x0) returned 1
	[0259.709] CloseHandle (hObject=0x178) returned 1
	[0259.709] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12642000*, nNumberOfCharsToWrite=0x41, lpNumberOfCharsWritten=0x124228b0, lpReserved=0x0 | out: lpBuffer=0x12642000*, lpNumberOfCharsWritten=0x124228b0*=0x41) returned 1
	[0259.737] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jqRKACl6\\27JfCEVulMHbbO.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jqrkacl6\\27jfcevulmhbbo.mp3"), fInfoLevelId=0x0, lpFileInformation=0x125da238 | out: lpFileInformation=0x125da238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5934a370, ftCreationTime.dwHighDateTime=0x1d827b7, ftLastAccessTime.dwLowDateTime=0x2070a4e0, ftLastAccessTime.dwHighDateTime=0x1d8281f, ftLastWriteTime.dwLowDateTime=0x2070a4e0, ftLastWriteTime.dwHighDateTime=0x1d8281f, nFileSizeHigh=0x0, nFileSizeLow=0x41f6)) returned 1
	[0259.737] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jqRKACl6\\27JfCEVulMHbbO.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jqrkacl6\\27jfcevulmhbbo.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0259.737] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0259.737] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jqRKACl6\\27JfCEVulMHbbO.mp3.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jqrkacl6\\27jfcevulmhbbo.mp3.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0259.738] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0259.738] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x126c40e0 | out: pbBuffer=0x126c40e0) returned 1
	[0259.738] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124122f0 | out: pbBuffer=0x124122f0) returned 1
	[0259.738] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0381 | out: pbBuffer=0x123c0381) returned 1
	[0259.739] WriteFile (in: hFile=0x17c, lpBuffer=0x1253d000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x1253d000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0259.741] SetEvent (hEvent=0x174) returned 1
	[0259.742] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422b78*=0x41f6, lpOverlapped=0x0) returned 1
	[0259.743] WriteFile (in: hFile=0x17c, lpBuffer=0x12c60000*, nNumberOfBytesToWrite=0x41f6, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesWritten=0x12422b84*=0x41f6, lpOverlapped=0x0) returned 1
	[0259.760] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0259.760] CloseHandle (hObject=0x17c) returned 1
	[0259.764] CloseHandle (hObject=0x178) returned 1
	[0259.764] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123fc080*, nNumberOfCharsToWrite=0x3e, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x123fc080*, lpNumberOfCharsWritten=0x1242283c*=0x3e) returned 1
	[0259.817] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0259.890] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jqRKACl6\\27JfCEVulMHbbO.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jqrkacl6\\27jfcevulmhbbo.mp3")) returned 1
	[0259.906] SetEvent (hEvent=0x174) returned 1
	[0259.909] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0259.955] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0259.956] SetEvent (hEvent=0x174) returned 1
	[0259.956] SetEvent (hEvent=0x14c) returned 1
	[0259.956] SetEvent (hEvent=0x124) returned 1
	[0259.956] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0259.991] SetEvent (hEvent=0x168) returned 1
	[0259.991] SetEvent (hEvent=0x124) returned 1
	[0260.018] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0260.046] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0260.046] SetEvent (hEvent=0x124) returned 1
	[0260.048] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0260.131] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0260.132] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0260.204] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0260.204] SetEvent (hEvent=0x124) returned 1
	[0260.204] SetEvent (hEvent=0x14c) returned 1
	[0260.204] SetEvent (hEvent=0x174) returned 1
	[0260.204] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0260.243] SetEvent (hEvent=0x168) returned 1
	[0260.243] SetEvent (hEvent=0x174) returned 1
	[0260.244] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jqRKACl6\\27JfCEVulMHbbO.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jqrkacl6\\27jfcevulmhbbo.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0260.254] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0260.254] WriteFile (in: hFile=0x178, lpBuffer=0x12896000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x12896000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0260.300] CloseHandle (hObject=0x178) returned 1
	[0260.331] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jqRKACl6\\27JfCEVulMHbbO.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jqrkacl6\\27jfcevulmhbbo.mp3")) returned 1
	[0260.390] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jqRKACl6\\9Vntf.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jqrkacl6\\9vntf.mkv"), fInfoLevelId=0x0, lpFileInformation=0x125da058 | out: lpFileInformation=0x125da058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1fbc980, ftCreationTime.dwHighDateTime=0x1d81c91, ftLastAccessTime.dwLowDateTime=0x351d70c0, ftLastAccessTime.dwHighDateTime=0x1d826a9, ftLastWriteTime.dwLowDateTime=0x351d70c0, ftLastWriteTime.dwHighDateTime=0x1d826a9, nFileSizeHigh=0x0, nFileSizeLow=0xd3b1)) returned 1
	[0260.390] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jqRKACl6\\9Vntf.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jqrkacl6\\9vntf.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0260.390] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0260.391] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jqRKACl6\\9Vntf.mkv.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jqrkacl6\\9vntf.mkv.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0260.391] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0260.391] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x126c40a0 | out: pbBuffer=0x126c40a0) returned 1
	[0260.391] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124121c0 | out: pbBuffer=0x124121c0) returned 1
	[0260.391] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0260.392] WriteFile (in: hFile=0x17c, lpBuffer=0x12537000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x12537000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0260.398] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0260.479] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0260.479] SetEvent (hEvent=0x168) returned 1
	[0260.479] SetEvent (hEvent=0x14c) returned 1
	[0260.479] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422b78*=0xd3b1, lpOverlapped=0x0) returned 1
	[0260.482] WriteFile (in: hFile=0x17c, lpBuffer=0x12c60000*, nNumberOfBytesToWrite=0xd3b1, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesWritten=0x12422b84*=0xd3b1, lpOverlapped=0x0) returned 1
	[0260.520] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0260.520] CloseHandle (hObject=0x17c) returned 1
	[0260.558] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0260.654] CloseHandle (hObject=0x178) returned 1
	[0260.655] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123d00e0*, nNumberOfCharsToWrite=0x35, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x123d00e0*, lpNumberOfCharsWritten=0x1242283c*=0x35) returned 1
	[0260.700] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jqRKACl6\\9Vntf.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jqrkacl6\\9vntf.mkv")) returned 1
	[0260.750] SetEvent (hEvent=0x14c) returned 1
	[0260.752] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0260.779] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0260.779] SetEvent (hEvent=0x14c) returned 1
	[0260.779] SetEvent (hEvent=0x12c) returned 1
	[0260.779] SetEvent (hEvent=0x124) returned 1
	[0260.779] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0260.823] SetEvent (hEvent=0x168) returned 1
	[0260.823] SetEvent (hEvent=0x124) returned 1
	[0260.857] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0260.885] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0260.885] SetEvent (hEvent=0x124) returned 1
	[0260.887] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0260.936] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0260.936] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0260.954] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0260.954] SetEvent (hEvent=0x124) returned 1
	[0260.954] SetEvent (hEvent=0x12c) returned 1
	[0260.954] SetEvent (hEvent=0x14c) returned 1
	[0260.954] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0261.029] SetEvent (hEvent=0x168) returned 1
	[0261.029] SetEvent (hEvent=0x14c) returned 1
	[0261.030] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jqRKACl6\\9Vntf.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jqrkacl6\\9vntf.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0261.103] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0261.103] WriteFile (in: hFile=0x178, lpBuffer=0x12896000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x12896000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0261.170] CloseHandle (hObject=0x178) returned 1
	[0261.292] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jqRKACl6\\9Vntf.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jqrkacl6\\9vntf.mkv")) returned 1
	[0261.378] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jqRKACl6\\kfCcoa0Kn4e.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jqrkacl6\\kfccoa0kn4e.mp3"), fInfoLevelId=0x0, lpFileInformation=0x125da0a8 | out: lpFileInformation=0x125da0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8492c680, ftCreationTime.dwHighDateTime=0x1d81b43, ftLastAccessTime.dwLowDateTime=0xdf940fc0, ftLastAccessTime.dwHighDateTime=0x1d823cd, ftLastWriteTime.dwLowDateTime=0xdf940fc0, ftLastWriteTime.dwHighDateTime=0x1d823cd, nFileSizeHigh=0x0, nFileSizeLow=0xbde9)) returned 1
	[0261.379] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jqRKACl6\\kfCcoa0Kn4e.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jqrkacl6\\kfccoa0kn4e.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0261.379] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0261.379] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jqRKACl6\\kfCcoa0Kn4e.mp3.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jqrkacl6\\kfccoa0kn4e.mp3.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0261.412] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0261.412] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x126c40a0 | out: pbBuffer=0x126c40a0) returned 1
	[0261.412] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124121c0 | out: pbBuffer=0x124121c0) returned 1
	[0261.412] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0281 | out: pbBuffer=0x123c0281) returned 1
	[0261.413] WriteFile (in: hFile=0x17c, lpBuffer=0x12893000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x12893000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0261.811] SetEvent (hEvent=0x168) returned 1
	[0261.812] SetEvent (hEvent=0x12c) returned 1
	[0261.812] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422b78*=0xbde9, lpOverlapped=0x0) returned 1
	[0261.815] WriteFile (in: hFile=0x17c, lpBuffer=0x12c60000*, nNumberOfBytesToWrite=0xbde9, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesWritten=0x12422b84*=0xbde9, lpOverlapped=0x0) returned 1
	[0261.818] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0261.818] CloseHandle (hObject=0x17c) returned 1
	[0261.821] CloseHandle (hObject=0x178) returned 1
	[0261.821] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123fc080*, nNumberOfCharsToWrite=0x3b, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x123fc080*, lpNumberOfCharsWritten=0x1242283c*=0x3b) returned 1
	[0261.832] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0261.836] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jqRKACl6\\kfCcoa0Kn4e.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jqrkacl6\\kfccoa0kn4e.mp3")) returned 1
	[0261.848] SetEvent (hEvent=0x12c) returned 1
	[0261.850] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0261.851] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0261.851] SetEvent (hEvent=0x12c) returned 1
	[0261.851] SetEvent (hEvent=0x174) returned 1
	[0261.851] SetEvent (hEvent=0x124) returned 1
	[0261.851] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0261.852] SetEvent (hEvent=0x168) returned 1
	[0261.852] SetEvent (hEvent=0x124) returned 1
	[0261.891] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0261.893] SetEvent (hEvent=0x124) returned 1
	[0261.896] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0261.897] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0261.897] SetEvent (hEvent=0x124) returned 1
	[0261.897] SetEvent (hEvent=0x174) returned 1
	[0261.897] SetEvent (hEvent=0x12c) returned 1
	[0261.897] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0261.898] SetEvent (hEvent=0x12c) returned 1
	[0261.899] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jqRKACl6\\kfCcoa0Kn4e.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jqrkacl6\\kfccoa0kn4e.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0261.900] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0261.900] WriteFile (in: hFile=0x178, lpBuffer=0x12896000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x12896000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0261.951] CloseHandle (hObject=0x178) returned 1
	[0262.005] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jqRKACl6\\kfCcoa0Kn4e.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jqrkacl6\\kfccoa0kn4e.mp3")) returned 1
	[0262.030] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jqRKACl6\\lkG90.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jqrkacl6\\lkg90.jpg"), fInfoLevelId=0x0, lpFileInformation=0x125da058 | out: lpFileInformation=0x125da058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5aaf80, ftCreationTime.dwHighDateTime=0x1d8294d, ftLastAccessTime.dwLowDateTime=0x90911730, ftLastAccessTime.dwHighDateTime=0x1d829ca, ftLastWriteTime.dwLowDateTime=0x90911730, ftLastWriteTime.dwHighDateTime=0x1d829ca, nFileSizeHigh=0x0, nFileSizeLow=0x211d)) returned 1
	[0262.030] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jqRKACl6\\lkG90.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jqrkacl6\\lkg90.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0262.030] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0262.030] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jqRKACl6\\lkG90.jpg.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jqrkacl6\\lkg90.jpg.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0262.031] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0262.031] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x126c40a0 | out: pbBuffer=0x126c40a0) returned 1
	[0262.031] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c110 | out: pbBuffer=0x1251c110) returned 1
	[0262.031] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc081 | out: pbBuffer=0x123fc081) returned 1
	[0262.031] WriteFile (in: hFile=0x17c, lpBuffer=0x12891000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x12891000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0262.033] SetEvent (hEvent=0x174) returned 1
	[0262.033] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422b78*=0x211d, lpOverlapped=0x0) returned 1
	[0262.035] WriteFile (in: hFile=0x17c, lpBuffer=0x12c60000*, nNumberOfBytesToWrite=0x211d, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesWritten=0x12422b84*=0x211d, lpOverlapped=0x0) returned 1
	[0262.038] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0262.039] CloseHandle (hObject=0x17c) returned 1
	[0262.040] CloseHandle (hObject=0x178) returned 1
	[0262.040] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0262.046] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0262.046] SetEvent (hEvent=0x174) returned 1
	[0262.046] SetEvent (hEvent=0x12c) returned 1
	[0262.046] SetEvent (hEvent=0x124) returned 1
	[0262.046] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0262.047] SetEvent (hEvent=0x168) returned 1
	[0262.047] SetEvent (hEvent=0x124) returned 1
	[0262.047] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12428000*, nNumberOfCharsToWrite=0x35, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x12428000*, lpNumberOfCharsWritten=0x1242283c*=0x35) returned 1
	[0262.066] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jqRKACl6\\lkG90.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jqrkacl6\\lkg90.jpg")) returned 1
	[0262.290] SetEvent (hEvent=0x12c) returned 1
	[0262.298] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0262.365] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0262.365] SetEvent (hEvent=0x12c) returned 1
	[0262.365] SetEvent (hEvent=0x124) returned 1
	[0262.365] SetEvent (hEvent=0x174) returned 1
	[0262.365] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0262.420] SetEvent (hEvent=0x168) returned 1
	[0262.420] SetEvent (hEvent=0x174) returned 1
	[0262.425] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0262.502] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0262.502] SetEvent (hEvent=0x168) returned 1
	[0262.502] SetEvent (hEvent=0x174) returned 1
	[0262.505] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0262.592] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0262.592] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0262.597] SetEvent (hEvent=0x174) returned 1
	[0262.597] SetEvent (hEvent=0x124) returned 1
	[0262.597] SetEvent (hEvent=0x12c) returned 1
	[0262.597] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0262.637] SetEvent (hEvent=0x168) returned 1
	[0262.637] SetEvent (hEvent=0x12c) returned 1
	[0262.638] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jqRKACl6\\lkG90.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jqrkacl6\\lkg90.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0262.645] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0262.645] WriteFile (in: hFile=0x178, lpBuffer=0x12c60000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0262.690] CloseHandle (hObject=0x178) returned 1
	[0262.729] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jqRKACl6\\lkG90.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jqrkacl6\\lkg90.jpg")) returned 1
	[0262.790] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jqRKACl6\\w8O0bav5Ww_S.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jqrkacl6\\w8o0bav5ww_s.pdf"), fInfoLevelId=0x0, lpFileInformation=0x125da0a8 | out: lpFileInformation=0x125da0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd59b04e0, ftCreationTime.dwHighDateTime=0x1d82992, ftLastAccessTime.dwLowDateTime=0x3e23e450, ftLastAccessTime.dwHighDateTime=0x1d829a2, ftLastWriteTime.dwLowDateTime=0x3e23e450, ftLastWriteTime.dwHighDateTime=0x1d829a2, nFileSizeHigh=0x0, nFileSizeLow=0x17cd9)) returned 1
	[0262.791] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jqRKACl6\\w8O0bav5Ww_S.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jqrkacl6\\w8o0bav5ww_s.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0262.791] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0262.791] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jqRKACl6\\w8O0bav5Ww_S.pdf.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jqrkacl6\\w8o0bav5ww_s.pdf.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0262.791] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0262.791] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x126c40a0 | out: pbBuffer=0x126c40a0) returned 1
	[0262.791] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c110 | out: pbBuffer=0x1251c110) returned 1
	[0262.792] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc101 | out: pbBuffer=0x123fc101) returned 1
	[0262.792] WriteFile (in: hFile=0x17c, lpBuffer=0x12891000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x12891000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0262.794] SetEvent (hEvent=0x124) returned 1
	[0262.794] ReadFile (in: hFile=0x178, lpBuffer=0x12d5a000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12d5a000*, lpNumberOfBytesRead=0x12422b78*=0x17cd9, lpOverlapped=0x0) returned 1
	[0262.797] WriteFile (in: hFile=0x17c, lpBuffer=0x12d5a000*, nNumberOfBytesToWrite=0x17cd9, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12d5a000*, lpNumberOfBytesWritten=0x12422b84*=0x17cd9, lpOverlapped=0x0) returned 1
	[0262.850] ReadFile (in: hFile=0x178, lpBuffer=0x12d5a000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12d5a000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0262.850] CloseHandle (hObject=0x17c) returned 1
	[0262.866] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0262.961] CloseHandle (hObject=0x178) returned 1
	[0262.962] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123fc080*, nNumberOfCharsToWrite=0x3c, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x123fc080*, lpNumberOfCharsWritten=0x1242283c*=0x3c) returned 1
	[0263.012] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jqRKACl6\\w8O0bav5Ww_S.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jqrkacl6\\w8o0bav5ww_s.pdf")) returned 1
	[0263.027] SetEvent (hEvent=0x124) returned 1
	[0263.028] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0263.150] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0263.150] SetEvent (hEvent=0x124) returned 1
	[0263.150] SetEvent (hEvent=0x14c) returned 1
	[0263.150] SetEvent (hEvent=0x174) returned 1
	[0263.150] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0263.185] SetEvent (hEvent=0x168) returned 1
	[0263.186] SetEvent (hEvent=0x174) returned 1
	[0263.212] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0263.272] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0263.272] SetEvent (hEvent=0x174) returned 1
	[0263.276] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0263.316] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0263.316] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0263.369] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0263.370] SetEvent (hEvent=0x174) returned 1
	[0263.370] SetEvent (hEvent=0x14c) returned 1
	[0263.370] SetEvent (hEvent=0x124) returned 1
	[0263.370] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0263.419] SetEvent (hEvent=0x168) returned 1
	[0263.419] SetEvent (hEvent=0x124) returned 1
	[0263.420] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jqRKACl6\\w8O0bav5Ww_S.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jqrkacl6\\w8o0bav5ww_s.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0263.475] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0263.475] WriteFile (in: hFile=0x178, lpBuffer=0x12896000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x12896000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0263.510] CloseHandle (hObject=0x178) returned 1
	[0263.541] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jqRKACl6\\w8O0bav5Ww_S.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jqrkacl6\\w8o0bav5ww_s.pdf")) returned 1
	[0263.640] SetEvent (hEvent=0x168) returned 1
	[0263.641] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\l2CI" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\l2ci"), fInfoLevelId=0x0, lpFileInformation=0x125da058 | out: lpFileInformation=0x125da058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8d939500, ftCreationTime.dwHighDateTime=0x1d8227f, ftLastAccessTime.dwLowDateTime=0x1eadf90, ftLastAccessTime.dwHighDateTime=0x1d82662, ftLastWriteTime.dwLowDateTime=0x1eadf90, ftLastWriteTime.dwHighDateTime=0x1d82662, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0263.641] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\l2CI" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\l2ci"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0263.641] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\l2CI\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8d939500, ftCreationTime.dwHighDateTime=0x1d8227f, ftLastAccessTime.dwLowDateTime=0x1eadf90, ftLastAccessTime.dwHighDateTime=0x1d82662, ftLastWriteTime.dwLowDateTime=0x1eadf90, ftLastWriteTime.dwHighDateTime=0x1d82662, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0068
	[0263.642] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8d939500, ftCreationTime.dwHighDateTime=0x1d8227f, ftLastAccessTime.dwLowDateTime=0x1eadf90, ftLastAccessTime.dwHighDateTime=0x1d82662, ftLastWriteTime.dwLowDateTime=0x1eadf90, ftLastWriteTime.dwHighDateTime=0x1d82662, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0263.642] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a3e0cf0, ftCreationTime.dwHighDateTime=0x1d81cf7, ftLastAccessTime.dwLowDateTime=0x12e23a50, ftLastAccessTime.dwHighDateTime=0x1d82117, ftLastWriteTime.dwLowDateTime=0x12e23a50, ftLastWriteTime.dwHighDateTime=0x1d82117, nFileSizeHigh=0x0, nFileSizeLow=0x130b, dwReserved0=0x0, dwReserved1=0x0, cFileName="D-Cg-mvfsgn.flv", cAlternateFileName="D-CG-M~1.FLV")) returned 1
	[0263.642] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cf4e380, ftCreationTime.dwHighDateTime=0x1d82655, ftLastAccessTime.dwLowDateTime=0xad543cd0, ftLastAccessTime.dwHighDateTime=0x1d82885, ftLastWriteTime.dwLowDateTime=0xad543cd0, ftLastWriteTime.dwHighDateTime=0x1d82885, nFileSizeHigh=0x0, nFileSizeLow=0x39c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="KBe56raX.jpg", cAlternateFileName="")) returned 1
	[0263.642] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb103e310, ftCreationTime.dwHighDateTime=0x1d8262f, ftLastAccessTime.dwLowDateTime=0xf463ca80, ftLastAccessTime.dwHighDateTime=0x1d827c9, ftLastWriteTime.dwLowDateTime=0xf463ca80, ftLastWriteTime.dwHighDateTime=0x1d827c9, nFileSizeHigh=0x0, nFileSizeLow=0x148a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="pmRHoZn51.avi", cAlternateFileName="PMRHOZ~1.AVI")) returned 1
	[0263.642] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de916b0, ftCreationTime.dwHighDateTime=0x1d8227a, ftLastAccessTime.dwLowDateTime=0x95843170, ftLastAccessTime.dwHighDateTime=0x1d82699, ftLastWriteTime.dwLowDateTime=0x95843170, ftLastWriteTime.dwHighDateTime=0x1d82699, nFileSizeHigh=0x0, nFileSizeLow=0xe40c, dwReserved0=0x0, dwReserved1=0x0, cFileName="R-lj hADEM9rHI.m4a", cAlternateFileName="R-LJHA~1.M4A")) returned 1
	[0263.642] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67c67f80, ftCreationTime.dwHighDateTime=0x1d81a1f, ftLastAccessTime.dwLowDateTime=0x73c0e640, ftLastAccessTime.dwHighDateTime=0x1d826fe, ftLastWriteTime.dwLowDateTime=0x73c0e640, ftLastWriteTime.dwHighDateTime=0x1d826fe, nFileSizeHigh=0x0, nFileSizeLow=0x47d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="UyGAh1goU67sQ4n_bFy.mp3", cAlternateFileName="UYGAH1~1.MP3")) returned 1
	[0263.642] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0263.642] FindClose (in: hFindFile=0x7a0068 | out: hFindFile=0x7a0068) returned 1
	[0263.643] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\l2CI\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\l2ci\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0263.650] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d30 | out: lpMode=0x12422d30) returned 0
	[0263.650] WriteFile (in: hFile=0x178, lpBuffer=0x12694000*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d20, lpOverlapped=0x0 | out: lpBuffer=0x12694000*, lpNumberOfBytesWritten=0x12422d20*=0xc85, lpOverlapped=0x0) returned 1
	[0263.651] CloseHandle (hObject=0x178) returned 1
	[0263.688] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123fc080*, nNumberOfCharsToWrite=0x3d, lpNumberOfCharsWritten=0x124228b0, lpReserved=0x0 | out: lpBuffer=0x123fc080*, lpNumberOfCharsWritten=0x124228b0*=0x3d) returned 1
	[0263.749] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\l2CI\\D-Cg-mvfsgn.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\l2ci\\d-cg-mvfsgn.flv"), fInfoLevelId=0x0, lpFileInformation=0x125da288 | out: lpFileInformation=0x125da288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a3e0cf0, ftCreationTime.dwHighDateTime=0x1d81cf7, ftLastAccessTime.dwLowDateTime=0x12e23a50, ftLastAccessTime.dwHighDateTime=0x1d82117, ftLastWriteTime.dwLowDateTime=0x12e23a50, ftLastWriteTime.dwHighDateTime=0x1d82117, nFileSizeHigh=0x0, nFileSizeLow=0x130b)) returned 1
	[0263.749] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\l2CI\\D-Cg-mvfsgn.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\l2ci\\d-cg-mvfsgn.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0263.749] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0263.750] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\l2CI\\D-Cg-mvfsgn.flv.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\l2ci\\d-cg-mvfsgn.flv.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0263.789] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0263.789] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x126c4140 | out: pbBuffer=0x126c4140) returned 1
	[0263.790] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c260 | out: pbBuffer=0x1251c260) returned 1
	[0263.790] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc181 | out: pbBuffer=0x123fc181) returned 1
	[0263.790] WriteFile (in: hFile=0x17c, lpBuffer=0x12539000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x12539000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0263.819] SetEvent (hEvent=0x14c) returned 1
	[0263.819] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422b78*=0x130b, lpOverlapped=0x0) returned 1
	[0263.820] WriteFile (in: hFile=0x17c, lpBuffer=0x12c60000*, nNumberOfBytesToWrite=0x130b, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesWritten=0x12422b84*=0x130b, lpOverlapped=0x0) returned 1
	[0263.824] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0263.824] CloseHandle (hObject=0x17c) returned 1
	[0263.851] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0264.001] CloseHandle (hObject=0x178) returned 1
	[0264.001] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12428000*, nNumberOfCharsToWrite=0x37, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x12428000*, lpNumberOfCharsWritten=0x1242283c*=0x37) returned 1
	[0264.036] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\l2CI\\D-Cg-mvfsgn.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\l2ci\\d-cg-mvfsgn.flv")) returned 1
	[0264.190] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0264.193] SetEvent (hEvent=0x168) returned 1
	[0264.193] SetEvent (hEvent=0x14c) returned 1
	[0264.195] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0264.220] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0264.220] SetEvent (hEvent=0x14c) returned 1
	[0264.220] SetEvent (hEvent=0x12c) returned 1
	[0264.220] SetEvent (hEvent=0x174) returned 1
	[0264.220] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0264.262] SetEvent (hEvent=0x168) returned 1
	[0264.262] SetEvent (hEvent=0x174) returned 1
	[0264.306] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0264.343] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0264.343] SetEvent (hEvent=0x174) returned 1
	[0264.348] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0264.365] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0264.365] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0264.370] SetEvent (hEvent=0x174) returned 1
	[0264.370] SetEvent (hEvent=0x12c) returned 1
	[0264.370] SetEvent (hEvent=0x14c) returned 1
	[0264.370] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0264.405] SetEvent (hEvent=0x168) returned 1
	[0264.405] SetEvent (hEvent=0x14c) returned 1
	[0264.409] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\l2CI\\D-Cg-mvfsgn.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\l2ci\\d-cg-mvfsgn.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0264.421] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0264.421] WriteFile (in: hFile=0x178, lpBuffer=0x12896000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x12896000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0265.393] CloseHandle (hObject=0x178) returned 1
	[0265.454] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\l2CI\\D-Cg-mvfsgn.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\l2ci\\d-cg-mvfsgn.flv")) returned 1
	[0265.590] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\l2CI\\KBe56raX.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\l2ci\\kbe56rax.jpg"), fInfoLevelId=0x0, lpFileInformation=0x125da008 | out: lpFileInformation=0x125da008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cf4e380, ftCreationTime.dwHighDateTime=0x1d82655, ftLastAccessTime.dwLowDateTime=0xad543cd0, ftLastAccessTime.dwHighDateTime=0x1d82885, ftLastWriteTime.dwLowDateTime=0xad543cd0, ftLastWriteTime.dwHighDateTime=0x1d82885, nFileSizeHigh=0x0, nFileSizeLow=0x39c4)) returned 1
	[0265.590] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\l2CI\\KBe56raX.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\l2ci\\kbe56rax.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0265.591] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0265.591] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\l2CI\\KBe56raX.jpg.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\l2ci\\kbe56rax.jpg.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0265.591] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0265.592] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x126c4040 | out: pbBuffer=0x126c4040) returned 1
	[0265.592] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124121a0 | out: pbBuffer=0x124121a0) returned 1
	[0265.592] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc081 | out: pbBuffer=0x123fc081) returned 1
	[0265.593] WriteFile (in: hFile=0x17c, lpBuffer=0x12893000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x12893000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0265.607] SetEvent (hEvent=0x12c) returned 1
	[0265.607] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422b78*=0x39c4, lpOverlapped=0x0) returned 1
	[0265.609] WriteFile (in: hFile=0x17c, lpBuffer=0x12c60000*, nNumberOfBytesToWrite=0x39c4, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesWritten=0x12422b84*=0x39c4, lpOverlapped=0x0) returned 1
	[0265.735] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0265.735] CloseHandle (hObject=0x17c) returned 1
	[0265.737] CloseHandle (hObject=0x178) returned 1
	[0265.737] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123d00e0*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x123d00e0*, lpNumberOfCharsWritten=0x1242283c*=0x34) returned 1
	[0265.770] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0266.918] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\l2CI\\KBe56raX.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\l2ci\\kbe56rax.jpg")) returned 1
	[0266.956] SetEvent (hEvent=0x12c) returned 1
	[0266.958] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0266.980] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0266.980] SetEvent (hEvent=0x12c) returned 1
	[0266.980] SetEvent (hEvent=0x124) returned 1
	[0266.980] SetEvent (hEvent=0x174) returned 1
	[0266.980] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0267.021] SetEvent (hEvent=0x168) returned 1
	[0267.021] SetEvent (hEvent=0x174) returned 1
	[0267.055] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0267.103] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0267.104] SetEvent (hEvent=0x174) returned 1
	[0267.107] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0267.204] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0267.204] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0267.236] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0267.236] SetEvent (hEvent=0x174) returned 1
	[0267.236] SetEvent (hEvent=0x124) returned 1
	[0267.237] SetEvent (hEvent=0x12c) returned 1
	[0267.237] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0267.312] SetEvent (hEvent=0x168) returned 1
	[0267.312] SetEvent (hEvent=0x12c) returned 1
	[0267.315] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\l2CI\\KBe56raX.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\l2ci\\kbe56rax.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0267.337] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0267.337] WriteFile (in: hFile=0x178, lpBuffer=0x12896000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x12896000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0267.382] CloseHandle (hObject=0x178) returned 1
	[0267.468] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\l2CI\\KBe56raX.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\l2ci\\kbe56rax.jpg")) returned 1
	[0267.539] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\l2CI\\R-lj hADEM9rHI.m4a" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\l2ci\\r-lj hadem9rhi.m4a"), fInfoLevelId=0x0, lpFileInformation=0x125da0a8 | out: lpFileInformation=0x125da0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de916b0, ftCreationTime.dwHighDateTime=0x1d8227a, ftLastAccessTime.dwLowDateTime=0x95843170, ftLastAccessTime.dwHighDateTime=0x1d82699, ftLastWriteTime.dwLowDateTime=0x95843170, ftLastWriteTime.dwHighDateTime=0x1d82699, nFileSizeHigh=0x0, nFileSizeLow=0xe40c)) returned 1
	[0267.540] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\l2CI\\UyGAh1goU67sQ4n_bFy.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\l2ci\\uygah1gou67sq4n_bfy.mp3"), fInfoLevelId=0x0, lpFileInformation=0x125da0f8 | out: lpFileInformation=0x125da0f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67c67f80, ftCreationTime.dwHighDateTime=0x1d81a1f, ftLastAccessTime.dwLowDateTime=0x73c0e640, ftLastAccessTime.dwHighDateTime=0x1d826fe, ftLastWriteTime.dwLowDateTime=0x73c0e640, ftLastWriteTime.dwHighDateTime=0x1d826fe, nFileSizeHigh=0x0, nFileSizeLow=0x47d1)) returned 1
	[0267.540] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\l2CI\\UyGAh1goU67sQ4n_bFy.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\l2ci\\uygah1gou67sq4n_bfy.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0267.541] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0267.541] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\l2CI\\UyGAh1goU67sQ4n_bFy.mp3.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\l2ci\\uygah1gou67sq4n_bfy.mp3.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0267.573] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0267.573] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x126c40e0 | out: pbBuffer=0x126c40e0) returned 1
	[0267.573] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124122a0 | out: pbBuffer=0x124122a0) returned 1
	[0267.574] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc181 | out: pbBuffer=0x123fc181) returned 1
	[0267.574] WriteFile (in: hFile=0x17c, lpBuffer=0x12893000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x12893000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0267.578] SetEvent (hEvent=0x124) returned 1
	[0267.578] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422b78*=0x47d1, lpOverlapped=0x0) returned 1
	[0267.581] WriteFile (in: hFile=0x17c, lpBuffer=0x12c60000*, nNumberOfBytesToWrite=0x47d1, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesWritten=0x12422b84*=0x47d1, lpOverlapped=0x0) returned 1
	[0267.585] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0267.585] CloseHandle (hObject=0x17c) returned 1
	[0267.618] CloseHandle (hObject=0x178) returned 1
	[0267.618] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123c0200*, nNumberOfCharsToWrite=0x3f, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x123c0200*, lpNumberOfCharsWritten=0x1242283c*=0x3f) returned 1
	[0267.738] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\l2CI\\UyGAh1goU67sQ4n_bFy.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\l2ci\\uygah1gou67sq4n_bfy.mp3")) returned 1
	[0267.778] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0267.917] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0267.975] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0267.975] SetEvent (hEvent=0x168) returned 1
	[0267.976] SetEvent (hEvent=0x124) returned 1
	[0267.981] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0268.042] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0268.042] SetEvent (hEvent=0x124) returned 1
	[0268.042] SetEvent (hEvent=0x14c) returned 1
	[0268.042] SetEvent (hEvent=0x174) returned 1
	[0268.042] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0268.096] SetEvent (hEvent=0x168) returned 1
	[0268.096] SetEvent (hEvent=0x174) returned 1
	[0268.104] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0268.151] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0268.151] SetEvent (hEvent=0x174) returned 1
	[0268.152] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0268.212] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0268.245] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0268.285] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0268.285] SetEvent (hEvent=0x174) returned 1
	[0268.285] SetEvent (hEvent=0x14c) returned 1
	[0268.285] SetEvent (hEvent=0x124) returned 1
	[0268.285] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0268.545] SetEvent (hEvent=0x168) returned 1
	[0268.545] SetEvent (hEvent=0x124) returned 1
	[0268.546] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\l2CI\\UyGAh1goU67sQ4n_bFy.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\l2ci\\uygah1gou67sq4n_bfy.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0268.595] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0268.595] WriteFile (in: hFile=0x178, lpBuffer=0x12c60000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0268.671] CloseHandle (hObject=0x178) returned 1
	[0268.707] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\l2CI\\UyGAh1goU67sQ4n_bFy.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\l2ci\\uygah1gou67sq4n_bfy.mp3")) returned 1
	[0268.734] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\l2CI\\pmRHoZn51.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\l2ci\\pmrhozn51.avi"), fInfoLevelId=0x0, lpFileInformation=0x125da008 | out: lpFileInformation=0x125da008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb103e310, ftCreationTime.dwHighDateTime=0x1d8262f, ftLastAccessTime.dwLowDateTime=0xf463ca80, ftLastAccessTime.dwHighDateTime=0x1d827c9, ftLastWriteTime.dwLowDateTime=0xf463ca80, ftLastWriteTime.dwHighDateTime=0x1d827c9, nFileSizeHigh=0x0, nFileSizeLow=0x148a3)) returned 1
	[0268.734] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\l2CI\\pmRHoZn51.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\l2ci\\pmrhozn51.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0268.734] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0268.735] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\l2CI\\pmRHoZn51.avi.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\l2ci\\pmrhozn51.avi.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0268.735] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0268.735] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x126c4040 | out: pbBuffer=0x126c4040) returned 1
	[0268.735] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x123ce130 | out: pbBuffer=0x123ce130) returned 1
	[0268.736] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0301 | out: pbBuffer=0x123c0301) returned 1
	[0268.736] WriteFile (in: hFile=0x17c, lpBuffer=0x12891000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x12891000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0268.836] SetEvent (hEvent=0x14c) returned 1
	[0268.837] ReadFile (in: hFile=0x178, lpBuffer=0x12d5a000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12d5a000*, lpNumberOfBytesRead=0x12422b78*=0x148a3, lpOverlapped=0x0) returned 1
	[0268.842] WriteFile (in: hFile=0x17c, lpBuffer=0x12d5a000*, nNumberOfBytesToWrite=0x148a3, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12d5a000*, lpNumberOfBytesWritten=0x12422b84*=0x148a3, lpOverlapped=0x0) returned 1
	[0269.705] ReadFile (in: hFile=0x178, lpBuffer=0x12d5a000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12d5a000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0269.713] CloseHandle (hObject=0x17c) returned 1
	[0269.718] CloseHandle (hObject=0x178) returned 1
	[0269.719] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12428000*, nNumberOfCharsToWrite=0x35, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x12428000*, lpNumberOfCharsWritten=0x1242283c*=0x35) returned 1
	[0269.772] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0269.940] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\l2CI\\pmRHoZn51.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\l2ci\\pmrhozn51.avi")) returned 1
	[0269.978] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0270.018] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0270.018] SetEvent (hEvent=0x168) returned 1
	[0270.018] SetEvent (hEvent=0x14c) returned 1
	[0270.021] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0270.032] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0270.032] SetEvent (hEvent=0x14c) returned 1
	[0270.032] SetEvent (hEvent=0x12c) returned 1
	[0270.032] SetEvent (hEvent=0x174) returned 1
	[0270.032] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0270.096] SetEvent (hEvent=0x168) returned 1
	[0270.096] SetEvent (hEvent=0x174) returned 1
	[0270.140] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0270.206] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0270.206] SetEvent (hEvent=0x174) returned 1
	[0270.228] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0270.262] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0270.262] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0270.272] SetEvent (hEvent=0x174) returned 1
	[0270.273] SetEvent (hEvent=0x12c) returned 1
	[0270.273] SetEvent (hEvent=0x14c) returned 1
	[0270.273] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0270.337] SetEvent (hEvent=0x168) returned 1
	[0270.337] SetEvent (hEvent=0x14c) returned 1
	[0270.343] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\l2CI\\pmRHoZn51.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\l2ci\\pmrhozn51.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0270.376] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0270.376] WriteFile (in: hFile=0x178, lpBuffer=0x12896000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x12896000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0270.811] CloseHandle (hObject=0x178) returned 1
	[0270.963] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\l2CI\\pmRHoZn51.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\l2ci\\pmrhozn51.avi")) returned 1
	[0271.048] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\pgIQZ6vV6.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\pgiqz6vv6.mkv"), fInfoLevelId=0x0, lpFileInformation=0x125da0a8 | out: lpFileInformation=0x125da0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6515ab0, ftCreationTime.dwHighDateTime=0x1d8207f, ftLastAccessTime.dwLowDateTime=0x9a0f3d60, ftLastAccessTime.dwHighDateTime=0x1d826d1, ftLastWriteTime.dwLowDateTime=0x9a0f3d60, ftLastWriteTime.dwHighDateTime=0x1d826d1, nFileSizeHigh=0x0, nFileSizeLow=0x106bf)) returned 1
	[0271.049] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\pgIQZ6vV6.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\pgiqz6vv6.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0271.049] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0271.049] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\pgIQZ6vV6.mkv.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\pgiqz6vv6.mkv.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0271.065] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0271.065] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x126c4040 | out: pbBuffer=0x126c4040) returned 1
	[0271.066] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124121a0 | out: pbBuffer=0x124121a0) returned 1
	[0271.066] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0271.066] WriteFile (in: hFile=0x17c, lpBuffer=0x12893000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12893000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0271.080] SetEvent (hEvent=0x12c) returned 1
	[0271.080] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x106bf, lpOverlapped=0x0) returned 1
	[0271.085] WriteFile (in: hFile=0x17c, lpBuffer=0x12c60000*, nNumberOfBytesToWrite=0x106bf, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesWritten=0x12422be8*=0x106bf, lpOverlapped=0x0) returned 1
	[0271.149] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0271.515] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0271.515] CloseHandle (hObject=0x17c) returned 1
	[0271.535] CloseHandle (hObject=0x178) returned 1
	[0271.535] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12504000*, nNumberOfCharsToWrite=0x30, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x12504000*, lpNumberOfCharsWritten=0x124228a0*=0x30) returned 1
	[0271.587] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\pgIQZ6vV6.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\pgiqz6vv6.mkv")) returned 1
	[0271.882] SetEvent (hEvent=0x168) returned 1
	[0271.997] SetEvent (hEvent=0x12c) returned 1
	[0271.999] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0272.086] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0272.086] SetEvent (hEvent=0x12c) returned 1
	[0272.086] SetEvent (hEvent=0x124) returned 1
	[0272.087] SetEvent (hEvent=0x174) returned 1
	[0272.087] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0272.102] SetEvent (hEvent=0x168) returned 1
	[0272.102] SetEvent (hEvent=0x174) returned 1
	[0272.127] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0272.203] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0272.203] SetEvent (hEvent=0x174) returned 1
	[0272.205] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0272.260] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0272.260] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0272.293] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0272.293] SetEvent (hEvent=0x174) returned 1
	[0272.293] SetEvent (hEvent=0x124) returned 1
	[0272.293] SetEvent (hEvent=0x12c) returned 1
	[0272.293] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0272.332] SetEvent (hEvent=0x168) returned 1
	[0272.332] SetEvent (hEvent=0x12c) returned 1
	[0272.333] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\pgIQZ6vV6.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\pgiqz6vv6.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0272.488] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0272.488] WriteFile (in: hFile=0x178, lpBuffer=0x12896000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x12896000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0272.695] CloseHandle (hObject=0x178) returned 1
	[0272.749] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\pgIQZ6vV6.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\pgiqz6vv6.mkv")) returned 1
	[0272.784] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\uFbh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ufbh"), fInfoLevelId=0x0, lpFileInformation=0x125da008 | out: lpFileInformation=0x125da008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4605770, ftCreationTime.dwHighDateTime=0x1d81d35, ftLastAccessTime.dwLowDateTime=0xad23c50, ftLastAccessTime.dwHighDateTime=0x1d81d7c, ftLastWriteTime.dwLowDateTime=0xad23c50, ftLastWriteTime.dwHighDateTime=0x1d81d7c, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0272.785] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\uFbh" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ufbh"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0272.785] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\uFbh\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4605770, ftCreationTime.dwHighDateTime=0x1d81d35, ftLastAccessTime.dwLowDateTime=0xad23c50, ftLastAccessTime.dwHighDateTime=0x1d81d7c, ftLastWriteTime.dwLowDateTime=0xad23c50, ftLastWriteTime.dwHighDateTime=0x1d81d7c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fde8
	[0272.786] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4605770, ftCreationTime.dwHighDateTime=0x1d81d35, ftLastAccessTime.dwLowDateTime=0xad23c50, ftLastAccessTime.dwHighDateTime=0x1d81d7c, ftLastWriteTime.dwLowDateTime=0xad23c50, ftLastWriteTime.dwHighDateTime=0x1d81d7c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0272.787] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5a8ac0, ftCreationTime.dwHighDateTime=0x1d81d54, ftLastAccessTime.dwLowDateTime=0xa1f8d670, ftLastAccessTime.dwHighDateTime=0x1d824c0, ftLastWriteTime.dwLowDateTime=0xa1f8d670, ftLastWriteTime.dwHighDateTime=0x1d824c0, nFileSizeHigh=0x0, nFileSizeLow=0x17f2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="4m1VwisQwNYyO.mp3", cAlternateFileName="4M1VWI~1.MP3")) returned 1
	[0272.787] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8d0d55e0, ftCreationTime.dwHighDateTime=0x1d823af, ftLastAccessTime.dwLowDateTime=0x86ea53d0, ftLastAccessTime.dwHighDateTime=0x1d827b4, ftLastWriteTime.dwLowDateTime=0x86ea53d0, ftLastWriteTime.dwHighDateTime=0x1d827b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="q0drlHYf6Q54DMKd0A", cAlternateFileName="Q0DRLH~1")) returned 1
	[0272.787] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0272.787] FindClose (in: hFindFile=0x79fde8 | out: hFindFile=0x79fde8) returned 1
	[0272.788] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\uFbh\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ufbh\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0272.846] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d30 | out: lpMode=0x12422d30) returned 0
	[0272.846] WriteFile (in: hFile=0x178, lpBuffer=0x12694000*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d20, lpOverlapped=0x0 | out: lpBuffer=0x12694000*, lpNumberOfBytesWritten=0x12422d20*=0xc85, lpOverlapped=0x0) returned 1
	[0272.847] CloseHandle (hObject=0x178) returned 1
	[0272.874] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123c0200*, nNumberOfCharsToWrite=0x3d, lpNumberOfCharsWritten=0x124228b0, lpReserved=0x0 | out: lpBuffer=0x123c0200*, lpNumberOfCharsWritten=0x124228b0*=0x3d) returned 1
	[0272.990] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\uFbh\\4m1VwisQwNYyO.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ufbh\\4m1vwisqwnyyo.mp3"), fInfoLevelId=0x0, lpFileInformation=0x124a6008 | out: lpFileInformation=0x124a6008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5a8ac0, ftCreationTime.dwHighDateTime=0x1d81d54, ftLastAccessTime.dwLowDateTime=0xa1f8d670, ftLastAccessTime.dwHighDateTime=0x1d824c0, ftLastWriteTime.dwLowDateTime=0xa1f8d670, ftLastWriteTime.dwHighDateTime=0x1d824c0, nFileSizeHigh=0x0, nFileSizeLow=0x17f2b)) returned 1
	[0272.991] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\uFbh\\4m1VwisQwNYyO.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ufbh\\4m1vwisqwnyyo.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0272.991] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0272.991] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\uFbh\\4m1VwisQwNYyO.mp3.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ufbh\\4m1vwisqwnyyo.mp3.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0273.006] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0273.006] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc240 | out: pbBuffer=0x123cc240) returned 1
	[0273.006] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x123ce130 | out: pbBuffer=0x123ce130) returned 1
	[0273.006] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0301 | out: pbBuffer=0x123c0301) returned 1
	[0273.006] WriteFile (in: hFile=0x17c, lpBuffer=0x12507000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x12507000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0273.009] SetEvent (hEvent=0x124) returned 1
	[0273.009] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422b78*=0x17f2b, lpOverlapped=0x0) returned 1
	[0273.015] WriteFile (in: hFile=0x17c, lpBuffer=0x12c60000*, nNumberOfBytesToWrite=0x17f2b, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesWritten=0x12422b84*=0x17f2b, lpOverlapped=0x0) returned 1
	[0273.047] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0273.048] CloseHandle (hObject=0x17c) returned 1
	[0273.091] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0273.181] CloseHandle (hObject=0x178) returned 1
	[0273.181] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123c0200*, nNumberOfCharsToWrite=0x39, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x123c0200*, lpNumberOfCharsWritten=0x1242283c*=0x39) returned 1
	[0273.283] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\uFbh\\4m1VwisQwNYyO.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ufbh\\4m1vwisqwnyyo.mp3")) returned 1
	[0273.295] SetEvent (hEvent=0x124) returned 1
	[0273.296] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0273.297] SetEvent (hEvent=0x124) returned 1
	[0273.297] SetEvent (hEvent=0x14c) returned 1
	[0273.297] SetEvent (hEvent=0x174) returned 1
	[0273.297] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0273.297] SetEvent (hEvent=0x168) returned 1
	[0273.298] SetEvent (hEvent=0x174) returned 1
	[0273.325] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0273.326] SetEvent (hEvent=0x174) returned 1
	[0273.328] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0273.329] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0273.329] SetEvent (hEvent=0x174) returned 1
	[0273.329] SetEvent (hEvent=0x14c) returned 1
	[0273.329] SetEvent (hEvent=0x124) returned 1
	[0273.329] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0273.330] SetEvent (hEvent=0x168) returned 1
	[0273.330] SetEvent (hEvent=0x124) returned 1
	[0273.330] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\uFbh\\4m1VwisQwNYyO.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ufbh\\4m1vwisqwnyyo.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0273.332] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0273.332] WriteFile (in: hFile=0x178, lpBuffer=0x12896000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x12896000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0273.887] CloseHandle (hObject=0x178) returned 1
	[0273.939] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\uFbh\\4m1VwisQwNYyO.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ufbh\\4m1vwisqwnyyo.mp3")) returned 1
	[0273.965] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\uFbh\\q0drlHYf6Q54DMKd0A" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ufbh\\q0drlhyf6q54dmkd0a"), fInfoLevelId=0x0, lpFileInformation=0x124a6058 | out: lpFileInformation=0x124a6058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8d0d55e0, ftCreationTime.dwHighDateTime=0x1d823af, ftLastAccessTime.dwLowDateTime=0x86ea53d0, ftLastAccessTime.dwHighDateTime=0x1d827b4, ftLastWriteTime.dwLowDateTime=0x86ea53d0, ftLastWriteTime.dwHighDateTime=0x1d827b4, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0273.965] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\uFbh\\q0drlHYf6Q54DMKd0A" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ufbh\\q0drlhyf6q54dmkd0a"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0273.965] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\uFbh\\q0drlHYf6Q54DMKd0A\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8d0d55e0, ftCreationTime.dwHighDateTime=0x1d823af, ftLastAccessTime.dwLowDateTime=0x86ea53d0, ftLastAccessTime.dwHighDateTime=0x1d827b4, ftLastWriteTime.dwLowDateTime=0x86ea53d0, ftLastWriteTime.dwHighDateTime=0x1d827b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fee8
	[0273.965] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8d0d55e0, ftCreationTime.dwHighDateTime=0x1d823af, ftLastAccessTime.dwLowDateTime=0x86ea53d0, ftLastAccessTime.dwHighDateTime=0x1d827b4, ftLastWriteTime.dwLowDateTime=0x86ea53d0, ftLastWriteTime.dwHighDateTime=0x1d827b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0273.965] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x645a3260, ftCreationTime.dwHighDateTime=0x1d8260e, ftLastAccessTime.dwLowDateTime=0x4d1302a0, ftLastAccessTime.dwHighDateTime=0x1d8272e, ftLastWriteTime.dwLowDateTime=0x4d1302a0, ftLastWriteTime.dwHighDateTime=0x1d8272e, nFileSizeHigh=0x0, nFileSizeLow=0x110f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="3_vtHE.pptx", cAlternateFileName="3_VTHE~1.PPT")) returned 1
	[0273.966] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe609f4f0, ftCreationTime.dwHighDateTime=0x1d81ab3, ftLastAccessTime.dwLowDateTime=0xcd96c660, ftLastAccessTime.dwHighDateTime=0x1d8275a, ftLastWriteTime.dwLowDateTime=0xcd96c660, ftLastWriteTime.dwHighDateTime=0x1d8275a, nFileSizeHigh=0x0, nFileSizeLow=0x2e11, dwReserved0=0x0, dwReserved1=0x0, cFileName="664ei1-x8f0_Yk6d9oEE.png", cAlternateFileName="664EI1~1.PNG")) returned 1
	[0273.966] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x615ffc50, ftCreationTime.dwHighDateTime=0x1d81d96, ftLastAccessTime.dwLowDateTime=0x4497bcf0, ftLastAccessTime.dwHighDateTime=0x1d820a4, ftLastWriteTime.dwLowDateTime=0x4497bcf0, ftLastWriteTime.dwHighDateTime=0x1d820a4, nFileSizeHigh=0x0, nFileSizeLow=0x13af4, dwReserved0=0x0, dwReserved1=0x0, cFileName="zeUh4bIJhKCdE8.swf", cAlternateFileName="ZEUH4B~1.SWF")) returned 1
	[0273.966] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0273.966] FindClose (in: hFindFile=0x79fee8 | out: hFindFile=0x79fee8) returned 1
	[0273.966] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\uFbh\\q0drlHYf6Q54DMKd0A\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ufbh\\q0drlhyf6q54dmkd0a\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0273.991] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422ccc | out: lpMode=0x12422ccc) returned 0
	[0273.991] WriteFile (in: hFile=0x178, lpBuffer=0x12694000*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422cbc, lpOverlapped=0x0 | out: lpBuffer=0x12694000*, lpNumberOfBytesWritten=0x12422cbc*=0xc85, lpOverlapped=0x0) returned 1
	[0273.993] CloseHandle (hObject=0x178) returned 1
	[0274.001] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12644000*, nNumberOfCharsToWrite=0x50, lpNumberOfCharsWritten=0x1242284c, lpReserved=0x0 | out: lpBuffer=0x12644000*, lpNumberOfCharsWritten=0x1242284c*=0x50) returned 1
	[0274.030] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\uFbh\\q0drlHYf6Q54DMKd0A\\3_vtHE.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ufbh\\q0drlhyf6q54dmkd0a\\3_vthe.pptx"), fInfoLevelId=0x0, lpFileInformation=0x124a6198 | out: lpFileInformation=0x124a6198*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x645a3260, ftCreationTime.dwHighDateTime=0x1d8260e, ftLastAccessTime.dwLowDateTime=0x4d1302a0, ftLastAccessTime.dwHighDateTime=0x1d8272e, ftLastWriteTime.dwLowDateTime=0x4d1302a0, ftLastWriteTime.dwHighDateTime=0x1d8272e, nFileSizeHigh=0x0, nFileSizeLow=0x110f2)) returned 1
	[0274.031] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\uFbh\\q0drlHYf6Q54DMKd0A\\3_vtHE.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ufbh\\q0drlhyf6q54dmkd0a\\3_vthe.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0274.031] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b48 | out: lpMode=0x12422b48) returned 0
	[0274.031] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\uFbh\\q0drlHYf6Q54DMKd0A\\3_vtHE.pptx.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ufbh\\q0drlhyf6q54dmkd0a\\3_vthe.pptx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0274.070] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422b48 | out: lpMode=0x12422b48) returned 0
	[0274.070] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc2c0 | out: pbBuffer=0x123cc2c0) returned 1
	[0274.070] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x123ce270 | out: pbBuffer=0x123ce270) returned 1
	[0274.070] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0274.070] WriteFile (in: hFile=0x17c, lpBuffer=0x12537000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b24, lpOverlapped=0x0 | out: lpBuffer=0x12537000*, lpNumberOfBytesWritten=0x12422b24*=0x80, lpOverlapped=0x0) returned 1
	[0274.080] SetEvent (hEvent=0x14c) returned 1
	[0274.080] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b14, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422b14*=0x110f2, lpOverlapped=0x0) returned 1
	[0274.084] WriteFile (in: hFile=0x17c, lpBuffer=0x12c60000*, nNumberOfBytesToWrite=0x110f2, lpNumberOfBytesWritten=0x12422b20, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesWritten=0x12422b20*=0x110f2, lpOverlapped=0x0) returned 1
	[0274.099] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b14, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422b14*=0x0, lpOverlapped=0x0) returned 1
	[0274.100] CloseHandle (hObject=0x17c) returned 1
	[0274.118] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0274.163] CloseHandle (hObject=0x178) returned 1
	[0274.163] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12642000*, nNumberOfCharsToWrite=0x46, lpNumberOfCharsWritten=0x124227d8, lpReserved=0x0 | out: lpBuffer=0x12642000*, lpNumberOfCharsWritten=0x124227d8*=0x46) returned 1
	[0274.178] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\uFbh\\q0drlHYf6Q54DMKd0A\\3_vtHE.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ufbh\\q0drlhyf6q54dmkd0a\\3_vthe.pptx")) returned 1
	[0274.198] SetEvent (hEvent=0x14c) returned 1
	[0274.200] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0274.207] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0274.207] SetEvent (hEvent=0x14c) returned 1
	[0274.207] SetEvent (hEvent=0x12c) returned 1
	[0274.207] SetEvent (hEvent=0x174) returned 1
	[0274.207] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0274.231] SetEvent (hEvent=0x168) returned 1
	[0274.231] SetEvent (hEvent=0x174) returned 1
	[0274.264] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0274.270] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0274.270] SetEvent (hEvent=0x174) returned 1
	[0274.275] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0274.276] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0274.279] SetEvent (hEvent=0x174) returned 1
	[0274.279] SetEvent (hEvent=0x12c) returned 1
	[0274.279] SetEvent (hEvent=0x14c) returned 1
	[0274.279] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0274.280] SetEvent (hEvent=0x168) returned 1
	[0274.280] SetEvent (hEvent=0x14c) returned 1
	[0274.281] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\uFbh\\q0drlHYf6Q54DMKd0A\\3_vtHE.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ufbh\\q0drlhyf6q54dmkd0a\\3_vthe.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0274.295] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c34 | out: lpMode=0x12422c34) returned 0
	[0274.296] WriteFile (in: hFile=0x178, lpBuffer=0x12896000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c24, lpOverlapped=0x0 | out: lpBuffer=0x12896000*, lpNumberOfBytesWritten=0x12422c24*=0xfa000, lpOverlapped=0x0) returned 1
	[0275.117] CloseHandle (hObject=0x178) returned 1
	[0275.190] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\uFbh\\q0drlHYf6Q54DMKd0A\\3_vtHE.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ufbh\\q0drlhyf6q54dmkd0a\\3_vthe.pptx")) returned 1
	[0275.239] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\uFbh\\q0drlHYf6Q54DMKd0A\\664ei1-x8f0_Yk6d9oEE.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ufbh\\q0drlhyf6q54dmkd0a\\664ei1-x8f0_yk6d9oee.png"), fInfoLevelId=0x0, lpFileInformation=0x124a6008 | out: lpFileInformation=0x124a6008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe609f4f0, ftCreationTime.dwHighDateTime=0x1d81ab3, ftLastAccessTime.dwLowDateTime=0xcd96c660, ftLastAccessTime.dwHighDateTime=0x1d8275a, ftLastWriteTime.dwLowDateTime=0xcd96c660, ftLastWriteTime.dwHighDateTime=0x1d8275a, nFileSizeHigh=0x0, nFileSizeLow=0x2e11)) returned 1
	[0275.239] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\uFbh\\q0drlHYf6Q54DMKd0A\\664ei1-x8f0_Yk6d9oEE.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ufbh\\q0drlhyf6q54dmkd0a\\664ei1-x8f0_yk6d9oee.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0275.239] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b48 | out: lpMode=0x12422b48) returned 0
	[0275.239] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\uFbh\\q0drlHYf6Q54DMKd0A\\664ei1-x8f0_Yk6d9oEE.png.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ufbh\\q0drlhyf6q54dmkd0a\\664ei1-x8f0_yk6d9oee.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0275.244] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422b48 | out: lpMode=0x12422b48) returned 0
	[0275.244] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc280 | out: pbBuffer=0x123cc280) returned 1
	[0275.244] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124121a0 | out: pbBuffer=0x124121a0) returned 1
	[0275.244] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0275.244] WriteFile (in: hFile=0x17c, lpBuffer=0x12539000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b24, lpOverlapped=0x0 | out: lpBuffer=0x12539000*, lpNumberOfBytesWritten=0x12422b24*=0x80, lpOverlapped=0x0) returned 1
	[0275.247] SetEvent (hEvent=0x12c) returned 1
	[0275.247] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b14, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422b14*=0x2e11, lpOverlapped=0x0) returned 1
	[0275.248] WriteFile (in: hFile=0x17c, lpBuffer=0x12c60000*, nNumberOfBytesToWrite=0x2e11, lpNumberOfBytesWritten=0x12422b20, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesWritten=0x12422b20*=0x2e11, lpOverlapped=0x0) returned 1
	[0275.292] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b14, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422b14*=0x0, lpOverlapped=0x0) returned 1
	[0275.292] CloseHandle (hObject=0x17c) returned 1
	[0275.426] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0275.447] CloseHandle (hObject=0x178) returned 1
	[0275.447] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12426000*, nNumberOfCharsToWrite=0x53, lpNumberOfCharsWritten=0x124227d8, lpReserved=0x0 | out: lpBuffer=0x12426000*, lpNumberOfCharsWritten=0x124227d8*=0x53) returned 1
	[0275.458] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\uFbh\\q0drlHYf6Q54DMKd0A\\664ei1-x8f0_Yk6d9oEE.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ufbh\\q0drlhyf6q54dmkd0a\\664ei1-x8f0_yk6d9oee.png")) returned 1
	[0275.501] SetEvent (hEvent=0x12c) returned 1
	[0275.502] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0275.503] SetEvent (hEvent=0x12c) returned 1
	[0275.503] SetEvent (hEvent=0x124) returned 1
	[0275.503] SetEvent (hEvent=0x174) returned 1
	[0275.503] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0275.503] SetEvent (hEvent=0x174) returned 1
	[0275.522] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0275.523] SetEvent (hEvent=0x168) returned 1
	[0275.523] SetEvent (hEvent=0x174) returned 1
	[0275.528] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0275.529] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0275.529] SetEvent (hEvent=0x174) returned 1
	[0275.529] SetEvent (hEvent=0x124) returned 1
	[0275.529] SetEvent (hEvent=0x12c) returned 1
	[0275.529] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0275.530] SetEvent (hEvent=0x12c) returned 1
	[0275.532] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0275.533] SetEvent (hEvent=0x168) returned 1
	[0275.533] SetEvent (hEvent=0x12c) returned 1
	[0275.533] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0275.534] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0275.534] SetEvent (hEvent=0x12c) returned 1
	[0275.534] SetEvent (hEvent=0x124) returned 1
	[0275.534] SetEvent (hEvent=0x174) returned 1
	[0275.534] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0275.534] SetEvent (hEvent=0x174) returned 1
	[0275.535] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\uFbh\\q0drlHYf6Q54DMKd0A\\664ei1-x8f0_Yk6d9oEE.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ufbh\\q0drlhyf6q54dmkd0a\\664ei1-x8f0_yk6d9oee.png"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0275.536] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c34 | out: lpMode=0x12422c34) returned 0
	[0275.536] WriteFile (in: hFile=0x178, lpBuffer=0x12c60000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c24, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesWritten=0x12422c24*=0xfa000, lpOverlapped=0x0) returned 1
	[0275.563] CloseHandle (hObject=0x178) returned 1
	[0275.597] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\uFbh\\q0drlHYf6Q54DMKd0A\\664ei1-x8f0_Yk6d9oEE.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ufbh\\q0drlhyf6q54dmkd0a\\664ei1-x8f0_yk6d9oee.png")) returned 1
	[0275.610] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\uFbh\\q0drlHYf6Q54DMKd0A\\zeUh4bIJhKCdE8.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ufbh\\q0drlhyf6q54dmkd0a\\zeuh4bijhkcde8.swf"), fInfoLevelId=0x0, lpFileInformation=0x124a60a8 | out: lpFileInformation=0x124a60a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x615ffc50, ftCreationTime.dwHighDateTime=0x1d81d96, ftLastAccessTime.dwLowDateTime=0x4497bcf0, ftLastAccessTime.dwHighDateTime=0x1d820a4, ftLastWriteTime.dwLowDateTime=0x4497bcf0, ftLastWriteTime.dwHighDateTime=0x1d820a4, nFileSizeHigh=0x0, nFileSizeLow=0x13af4)) returned 1
	[0275.611] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\uFbh\\q0drlHYf6Q54DMKd0A\\zeUh4bIJhKCdE8.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ufbh\\q0drlhyf6q54dmkd0a\\zeuh4bijhkcde8.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0275.611] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b48 | out: lpMode=0x12422b48) returned 0
	[0275.611] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\uFbh\\q0drlHYf6Q54DMKd0A\\zeUh4bIJhKCdE8.swf.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ufbh\\q0drlhyf6q54dmkd0a\\zeuh4bijhkcde8.swf.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0275.612] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422b48 | out: lpMode=0x12422b48) returned 0
	[0275.612] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc280 | out: pbBuffer=0x123cc280) returned 1
	[0275.612] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x123ce140 | out: pbBuffer=0x123ce140) returned 1
	[0275.612] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0275.613] WriteFile (in: hFile=0x17c, lpBuffer=0x12537000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b24, lpOverlapped=0x0 | out: lpBuffer=0x12537000*, lpNumberOfBytesWritten=0x12422b24*=0x80, lpOverlapped=0x0) returned 1
	[0275.616] SetEvent (hEvent=0x124) returned 1
	[0275.617] ReadFile (in: hFile=0x178, lpBuffer=0x12d5a000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b14, lpOverlapped=0x0 | out: lpBuffer=0x12d5a000*, lpNumberOfBytesRead=0x12422b14*=0x13af4, lpOverlapped=0x0) returned 1
	[0275.620] WriteFile (in: hFile=0x17c, lpBuffer=0x12d5a000*, nNumberOfBytesToWrite=0x13af4, lpNumberOfBytesWritten=0x12422b20, lpOverlapped=0x0 | out: lpBuffer=0x12d5a000*, lpNumberOfBytesWritten=0x12422b20*=0x13af4, lpOverlapped=0x0) returned 1
	[0275.626] SetEvent (hEvent=0x168) returned 1
	[0275.626] ReadFile (in: hFile=0x178, lpBuffer=0x12d5a000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b14, lpOverlapped=0x0 | out: lpBuffer=0x12d5a000*, lpNumberOfBytesRead=0x12422b14*=0x0, lpOverlapped=0x0) returned 1
	[0275.626] CloseHandle (hObject=0x17c) returned 1
	[0275.630] CloseHandle (hObject=0x178) returned 1
	[0275.630] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12644000*, nNumberOfCharsToWrite=0x4d, lpNumberOfCharsWritten=0x124227d8, lpReserved=0x0 | out: lpBuffer=0x12644000*, lpNumberOfCharsWritten=0x124227d8*=0x4d) returned 1
	[0275.644] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\uFbh\\q0drlHYf6Q54DMKd0A\\zeUh4bIJhKCdE8.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ufbh\\q0drlhyf6q54dmkd0a\\zeuh4bijhkcde8.swf")) returned 1
	[0275.653] SetEvent (hEvent=0x14c) returned 1
	[0275.654] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0275.656] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0275.656] SetEvent (hEvent=0x14c) returned 1
	[0275.656] SetEvent (hEvent=0x124) returned 1
	[0275.656] SetEvent (hEvent=0x12c) returned 1
	[0275.656] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0275.657] SetEvent (hEvent=0x168) returned 1
	[0275.657] SetEvent (hEvent=0x12c) returned 1
	[0275.689] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0275.690] SetEvent (hEvent=0x12c) returned 1
	[0275.694] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0275.694] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0275.694] SetEvent (hEvent=0x12c) returned 1
	[0275.694] SetEvent (hEvent=0x124) returned 1
	[0275.694] SetEvent (hEvent=0x14c) returned 1
	[0275.694] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0275.695] SetEvent (hEvent=0x14c) returned 1
	[0275.696] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\uFbh\\q0drlHYf6Q54DMKd0A\\zeUh4bIJhKCdE8.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ufbh\\q0drlhyf6q54dmkd0a\\zeuh4bijhkcde8.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0275.698] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c34 | out: lpMode=0x12422c34) returned 0
	[0275.698] WriteFile (in: hFile=0x178, lpBuffer=0x12896000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c24, lpOverlapped=0x0 | out: lpBuffer=0x12896000*, lpNumberOfBytesWritten=0x12422c24*=0xfa000, lpOverlapped=0x0) returned 1
	[0275.729] CloseHandle (hObject=0x178) returned 1
	[0275.766] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\uFbh\\q0drlHYf6Q54DMKd0A\\zeUh4bIJhKCdE8.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ufbh\\q0drlhyf6q54dmkd0a\\zeuh4bijhkcde8.swf")) returned 1
	[0275.779] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents" (normalized: "c:\\users\\rdhj0cnfevzx\\documents"), fInfoLevelId=0x0, lpFileInformation=0x124a6008 | out: lpFileInformation=0x124a6008*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf61622b2, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf61622b2, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0275.779] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents" (normalized: "c:\\users\\rdhj0cnfevzx\\documents"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0275.779] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf61622b2, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf61622b2, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f8e8
	[0275.780] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf61622b2, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf61622b2, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0275.780] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa20cb0, ftCreationTime.dwHighDateTime=0x1d7bfa8, ftLastAccessTime.dwLowDateTime=0x63ae7ab0, ftLastAccessTime.dwHighDateTime=0x1d80df4, ftLastWriteTime.dwLowDateTime=0x63ae7ab0, ftLastWriteTime.dwHighDateTime=0x1d80df4, nFileSizeHigh=0x0, nFileSizeLow=0xbc5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="2kmOhs9S25.xlsx", cAlternateFileName="2KMOHS~1.XLS")) returned 1
	[0275.780] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc523630, ftCreationTime.dwHighDateTime=0x1d81e4b, ftLastAccessTime.dwLowDateTime=0x51163df0, ftLastAccessTime.dwHighDateTime=0x1d82787, ftLastWriteTime.dwLowDateTime=0x51163df0, ftLastWriteTime.dwHighDateTime=0x1d82787, nFileSizeHigh=0x0, nFileSizeLow=0xbe8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="5pf90.rtf", cAlternateFileName="")) returned 1
	[0275.780] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd57b71a0, ftCreationTime.dwHighDateTime=0x1d79d3a, ftLastAccessTime.dwLowDateTime=0xf481c960, ftLastAccessTime.dwHighDateTime=0x1d7ce9e, ftLastWriteTime.dwLowDateTime=0xf481c960, ftLastWriteTime.dwHighDateTime=0x1d7ce9e, nFileSizeHigh=0x0, nFileSizeLow=0x23e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="6gmL5X_4slK-0_B6U.xlsx", cAlternateFileName="6GML5X~1.XLS")) returned 1
	[0275.780] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89a89330, ftCreationTime.dwHighDateTime=0x1d7dc36, ftLastAccessTime.dwLowDateTime=0xec96b410, ftLastAccessTime.dwHighDateTime=0x1d7e684, ftLastWriteTime.dwLowDateTime=0xec96b410, ftLastWriteTime.dwHighDateTime=0x1d7e684, nFileSizeHigh=0x0, nFileSizeLow=0x8821, dwReserved0=0x0, dwReserved1=0x0, cFileName="7GBj_BHQB3gjCk60.docx", cAlternateFileName="7GBJ_B~1.DOC")) returned 1
	[0275.780] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc38743b0, ftCreationTime.dwHighDateTime=0x1d7f33f, ftLastAccessTime.dwLowDateTime=0xbbf30240, ftLastAccessTime.dwHighDateTime=0x1d82974, ftLastWriteTime.dwLowDateTime=0xbbf30240, ftLastWriteTime.dwHighDateTime=0x1d82974, nFileSizeHigh=0x0, nFileSizeLow=0x7340, dwReserved0=0x0, dwReserved1=0x0, cFileName="8Y_umCxlI.xlsx", cAlternateFileName="8Y_UMC~1.XLS")) returned 1
	[0275.780] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43649a85, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43649a85, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x4372e947, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0275.780] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63079f0, ftCreationTime.dwHighDateTime=0x1d82540, ftLastAccessTime.dwLowDateTime=0x7e38fe20, ftLastAccessTime.dwHighDateTime=0x1d829ea, ftLastWriteTime.dwLowDateTime=0x7e38fe20, ftLastWriteTime.dwHighDateTime=0x1d829ea, nFileSizeHigh=0x0, nFileSizeLow=0xb686, dwReserved0=0x0, dwReserved1=0x0, cFileName="eau-Oo1pPUvz4w8PX.ppt", cAlternateFileName="EAU-OO~1.PPT")) returned 1
	[0275.780] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd945c640, ftCreationTime.dwHighDateTime=0x1d80afa, ftLastAccessTime.dwLowDateTime=0xa0c9b430, ftLastAccessTime.dwHighDateTime=0x1d80ee6, ftLastWriteTime.dwLowDateTime=0xa0c9b430, ftLastWriteTime.dwHighDateTime=0x1d80ee6, nFileSizeHigh=0x0, nFileSizeLow=0x8e48, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBPMR.pptx", cAlternateFileName="EBPMR~1.PPT")) returned 1
	[0275.780] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0ec6e10, ftCreationTime.dwHighDateTime=0x1d825ba, ftLastAccessTime.dwLowDateTime=0x9e67b410, ftLastAccessTime.dwHighDateTime=0x1d8276b, ftLastWriteTime.dwLowDateTime=0x9e67b410, ftLastWriteTime.dwHighDateTime=0x1d8276b, nFileSizeHigh=0x0, nFileSizeLow=0x7a28, dwReserved0=0x0, dwReserved1=0x0, cFileName="GAL0vICrqtbz5.ots", cAlternateFileName="GAL0VI~1.OTS")) returned 1
	[0275.780] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef168fe0, ftCreationTime.dwHighDateTime=0x1d7b81b, ftLastAccessTime.dwLowDateTime=0x577b74b0, ftLastAccessTime.dwHighDateTime=0x1d82428, ftLastWriteTime.dwLowDateTime=0x577b74b0, ftLastWriteTime.dwHighDateTime=0x1d82428, nFileSizeHigh=0x0, nFileSizeLow=0x1331b, dwReserved0=0x0, dwReserved1=0x0, cFileName="gRpk8Z1c.docx", cAlternateFileName="GRPK8Z~1.DOC")) returned 1
	[0275.780] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29495af0, ftCreationTime.dwHighDateTime=0x1d80577, ftLastAccessTime.dwLowDateTime=0x6ad7d3f0, ftLastAccessTime.dwHighDateTime=0x1d80a15, ftLastWriteTime.dwLowDateTime=0x6ad7d3f0, ftLastWriteTime.dwHighDateTime=0x1d80a15, nFileSizeHigh=0x0, nFileSizeLow=0x12cbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="jaCxkmZM5HvA.docx", cAlternateFileName="JACXKM~1.DOC")) returned 1
	[0275.780] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c25d880, ftCreationTime.dwHighDateTime=0x1d8286a, ftLastAccessTime.dwLowDateTime=0xd393d000, ftLastAccessTime.dwHighDateTime=0x1d828de, ftLastWriteTime.dwLowDateTime=0xd393d000, ftLastWriteTime.dwHighDateTime=0x1d828de, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="l0xtaApata393X0pssf", cAlternateFileName="L0XTAA~1")) returned 1
	[0275.780] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc85a50b0, ftCreationTime.dwHighDateTime=0x1d7aadf, ftLastAccessTime.dwLowDateTime=0x2e5fd8c0, ftLastAccessTime.dwHighDateTime=0x1d7f56e, ftLastWriteTime.dwLowDateTime=0x2e5fd8c0, ftLastWriteTime.dwHighDateTime=0x1d7f56e, nFileSizeHigh=0x0, nFileSizeLow=0x4197, dwReserved0=0x0, dwReserved1=0x0, cFileName="lqYFgux47JTvr.xlsx", cAlternateFileName="LQYFGU~1.XLS")) returned 1
	[0275.780] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d374e80, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d374e80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d374e80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1
	[0275.780] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d374e80, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d374e80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d374e80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1
	[0275.780] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1
	[0275.780] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3894240, ftCreationTime.dwHighDateTime=0x1d804d4, ftLastAccessTime.dwLowDateTime=0x4735fdb0, ftLastAccessTime.dwHighDateTime=0x1d828d7, ftLastWriteTime.dwLowDateTime=0x4735fdb0, ftLastWriteTime.dwHighDateTime=0x1d828d7, nFileSizeHigh=0x0, nFileSizeLow=0x1bce, dwReserved0=0x0, dwReserved1=0x0, cFileName="Nv-fQq_ b.pptx", cAlternateFileName="NV-FQQ~1.PPT")) returned 1
	[0275.781] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09c92a0, ftCreationTime.dwHighDateTime=0x1d7dc29, ftLastAccessTime.dwLowDateTime=0xe0b5b250, ftLastAccessTime.dwHighDateTime=0x1d81338, ftLastWriteTime.dwLowDateTime=0xe0b5b250, ftLastWriteTime.dwHighDateTime=0x1d81338, nFileSizeHigh=0x0, nFileSizeLow=0xd989, dwReserved0=0x0, dwReserved1=0x0, cFileName="nZtB-SvOqljCAptbv.pptx", cAlternateFileName="NZTB-S~1.PPT")) returned 1
	[0275.781] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63954f0d, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x65ef9a5c, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x65ef9a5c, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1
	[0275.781] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8dd59190, ftCreationTime.dwHighDateTime=0x1d7ccc0, ftLastAccessTime.dwLowDateTime=0x9723520, ftLastAccessTime.dwHighDateTime=0x1d7f8f3, ftLastWriteTime.dwLowDateTime=0x9723520, ftLastWriteTime.dwHighDateTime=0x1d7f8f3, nFileSizeHigh=0x0, nFileSizeLow=0xdba6, dwReserved0=0x0, dwReserved1=0x0, cFileName="pPFUnzZFOF 9YXG.docx", cAlternateFileName="PPFUNZ~1.DOC")) returned 1
	[0275.781] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde07ccd0, ftCreationTime.dwHighDateTime=0x1d81f1f, ftLastAccessTime.dwLowDateTime=0x45827f00, ftLastAccessTime.dwHighDateTime=0x1d8208c, ftLastWriteTime.dwLowDateTime=0x45827f00, ftLastWriteTime.dwHighDateTime=0x1d8208c, nFileSizeHigh=0x0, nFileSizeLow=0x387e, dwReserved0=0x0, dwReserved1=0x0, cFileName="qp2itemHgewbk.docx", cAlternateFileName="QP2ITE~1.DOC")) returned 1
	[0275.781] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9ac01e0, ftCreationTime.dwHighDateTime=0x1d8290c, ftLastAccessTime.dwLowDateTime=0x6f4a1ea0, ftLastAccessTime.dwHighDateTime=0x1d82984, ftLastWriteTime.dwLowDateTime=0x6f4a1ea0, ftLastWriteTime.dwHighDateTime=0x1d82984, nFileSizeHigh=0x0, nFileSizeLow=0x9970, dwReserved0=0x0, dwReserved1=0x0, cFileName="SfN_7SLvBv6HWGGZ.docx", cAlternateFileName="SFN_7S~1.DOC")) returned 1
	[0275.781] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796bb8c0, ftCreationTime.dwHighDateTime=0x1d828a4, ftLastAccessTime.dwLowDateTime=0x2ebcd450, ftLastAccessTime.dwHighDateTime=0x1d8294c, ftLastWriteTime.dwLowDateTime=0x2ebcd450, ftLastWriteTime.dwHighDateTime=0x1d8294c, nFileSizeHigh=0x0, nFileSizeLow=0x2f89, dwReserved0=0x0, dwReserved1=0x0, cFileName="TaxhME.pptx", cAlternateFileName="TAXHME~1.PPT")) returned 1
	[0275.781] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c0c2020, ftCreationTime.dwHighDateTime=0x1d824ee, ftLastAccessTime.dwLowDateTime=0x146a33f0, ftLastAccessTime.dwHighDateTime=0x1d827e8, ftLastWriteTime.dwLowDateTime=0x146a33f0, ftLastWriteTime.dwHighDateTime=0x1d827e8, nFileSizeHigh=0x0, nFileSizeLow=0x3dca, dwReserved0=0x0, dwReserved1=0x0, cFileName="XlenjhZeamfDvL.odt", cAlternateFileName="XLENJH~1.ODT")) returned 1
	[0275.781] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a3e5770, ftCreationTime.dwHighDateTime=0x1d7ab4a, ftLastAccessTime.dwLowDateTime=0x7078c00, ftLastAccessTime.dwHighDateTime=0x1d7afdc, ftLastWriteTime.dwLowDateTime=0x7078c00, ftLastWriteTime.dwHighDateTime=0x1d7afdc, nFileSizeHigh=0x0, nFileSizeLow=0x174ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="YKkR7 10Jqcina5HGOD.pptx", cAlternateFileName="YKKR71~1.PPT")) returned 1
	[0275.781] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd175c0b0, ftCreationTime.dwHighDateTime=0x1d7b5cc, ftLastAccessTime.dwLowDateTime=0x5af93790, ftLastAccessTime.dwHighDateTime=0x1d820f8, ftLastWriteTime.dwLowDateTime=0x5af93790, ftLastWriteTime.dwHighDateTime=0x1d820f8, nFileSizeHigh=0x0, nFileSizeLow=0x13295, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zx_PeYMMp5W-Vj0.xlsx", cAlternateFileName="ZX_PEY~1.XLS")) returned 1
	[0275.781] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0275.781] FindClose (in: hFindFile=0x79f8e8 | out: hFindFile=0x79f8e8) returned 1
	[0275.781] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0275.782] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d94 | out: lpMode=0x12422d94) returned 0
	[0275.782] WriteFile (in: hFile=0x178, lpBuffer=0x12694000*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d84, lpOverlapped=0x0 | out: lpBuffer=0x12694000*, lpNumberOfBytesWritten=0x12422d84*=0xc85, lpOverlapped=0x0) returned 1
	[0275.783] CloseHandle (hObject=0x178) returned 1
	[0275.783] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123c0200*, nNumberOfCharsToWrite=0x3a, lpNumberOfCharsWritten=0x12422914, lpReserved=0x0 | out: lpBuffer=0x123c0200*, lpNumberOfCharsWritten=0x12422914*=0x3a) returned 1
	[0275.795] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\2kmOhs9S25.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\2kmohs9s25.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x124a6918 | out: lpFileInformation=0x124a6918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa20cb0, ftCreationTime.dwHighDateTime=0x1d7bfa8, ftLastAccessTime.dwLowDateTime=0x63ae7ab0, ftLastAccessTime.dwHighDateTime=0x1d80df4, ftLastWriteTime.dwLowDateTime=0x63ae7ab0, ftLastWriteTime.dwHighDateTime=0x1d80df4, nFileSizeHigh=0x0, nFileSizeLow=0xbc5e)) returned 1
	[0275.795] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\2kmOhs9S25.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\2kmohs9s25.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0275.795] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0275.795] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\2kmOhs9S25.xlsx.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\2kmohs9s25.xlsx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0275.796] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0275.796] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc9a0 | out: pbBuffer=0x123cc9a0) returned 1
	[0275.796] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x123ce300 | out: pbBuffer=0x123ce300) returned 1
	[0275.796] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0281 | out: pbBuffer=0x123c0281) returned 1
	[0275.797] WriteFile (in: hFile=0x17c, lpBuffer=0x125d1000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x125d1000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0275.800] SetEvent (hEvent=0x124) returned 1
	[0275.800] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0xbc5e, lpOverlapped=0x0) returned 1
	[0275.802] WriteFile (in: hFile=0x17c, lpBuffer=0x12c60000*, nNumberOfBytesToWrite=0xbc5e, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesWritten=0x12422be8*=0xbc5e, lpOverlapped=0x0) returned 1
	[0275.811] ReadFile (in: hFile=0x178, lpBuffer=0x12c60000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c60000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0275.811] CloseHandle (hObject=0x17c) returned 1
	[0275.813] CloseHandle (hObject=0x178) returned 1
	[0275.814] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12428000*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x12428000*, lpNumberOfCharsWritten=0x124228a0*=0x34) returned 1
	[0275.833] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0275.835] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\2kmOhs9S25.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\2kmohs9s25.xlsx")) returned 1
	[0275.846] SetEvent (hEvent=0x124) returned 1
	[0275.848] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0275.848] SetEvent (hEvent=0x124) returned 1
	[0275.849] SetEvent (hEvent=0x174) returned 1
	[0275.849] SetEvent (hEvent=0x12c) returned 1
	[0275.849] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0275.849] SetEvent (hEvent=0x12c) returned 1
	[0275.884] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0275.885] SetEvent (hEvent=0x168) returned 1
	[0275.885] SetEvent (hEvent=0x12c) returned 1
	[0275.888] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0275.888] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0275.889] SetEvent (hEvent=0x12c) returned 1
	[0275.889] SetEvent (hEvent=0x174) returned 1
	[0275.889] SetEvent (hEvent=0x124) returned 1
	[0275.889] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0275.889] SetEvent (hEvent=0x124) returned 1
	[0275.890] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\2kmOhs9S25.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\2kmohs9s25.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0275.891] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0275.891] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0275.928] CloseHandle (hObject=0x178) returned 1
	[0275.962] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\2kmOhs9S25.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\2kmohs9s25.xlsx")) returned 1
	[0275.977] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\5pf90.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\5pf90.rtf"), fInfoLevelId=0x0, lpFileInformation=0x124a6058 | out: lpFileInformation=0x124a6058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc523630, ftCreationTime.dwHighDateTime=0x1d81e4b, ftLastAccessTime.dwLowDateTime=0x51163df0, ftLastAccessTime.dwHighDateTime=0x1d82787, ftLastWriteTime.dwLowDateTime=0x51163df0, ftLastWriteTime.dwHighDateTime=0x1d82787, nFileSizeHigh=0x0, nFileSizeLow=0xbe8e)) returned 1
	[0275.977] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\5pf90.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\5pf90.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0275.978] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0275.978] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\5pf90.rtf.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\5pf90.rtf.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0275.978] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0275.978] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc380 | out: pbBuffer=0x123cc380) returned 1
	[0275.978] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c110 | out: pbBuffer=0x1251c110) returned 1
	[0275.978] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0275.978] WriteFile (in: hFile=0x17c, lpBuffer=0x1253d000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x1253d000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0275.983] SetEvent (hEvent=0x174) returned 1
	[0275.983] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0xbe8e, lpOverlapped=0x0) returned 1
	[0275.986] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0xbe8e, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0xbe8e, lpOverlapped=0x0) returned 1
	[0275.996] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0275.997] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0275.997] CloseHandle (hObject=0x17c) returned 1
	[0276.003] CloseHandle (hObject=0x178) returned 1
	[0276.003] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12504000*, nNumberOfCharsToWrite=0x2e, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x12504000*, lpNumberOfCharsWritten=0x124228a0*=0x2e) returned 1
	[0276.016] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\5pf90.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\5pf90.rtf")) returned 1
	[0276.027] SetEvent (hEvent=0x174) returned 1
	[0276.032] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0276.033] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0276.033] SetEvent (hEvent=0x174) returned 1
	[0276.033] SetEvent (hEvent=0x14c) returned 1
	[0276.033] SetEvent (hEvent=0x12c) returned 1
	[0276.033] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0276.034] SetEvent (hEvent=0x168) returned 1
	[0276.034] SetEvent (hEvent=0x12c) returned 1
	[0276.071] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0276.073] SetEvent (hEvent=0x168) returned 1
	[0276.073] SetEvent (hEvent=0x12c) returned 1
	[0276.076] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0276.077] SetEvent (hEvent=0x12c) returned 1
	[0276.077] SetEvent (hEvent=0x14c) returned 1
	[0276.077] SetEvent (hEvent=0x174) returned 1
	[0276.077] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0276.078] SetEvent (hEvent=0x174) returned 1
	[0276.079] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\5pf90.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\5pf90.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0276.081] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0276.082] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0276.111] CloseHandle (hObject=0x178) returned 1
	[0276.142] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\5pf90.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\5pf90.rtf")) returned 1
	[0276.164] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\6gmL5X_4slK-0_B6U.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\6gml5x_4slk-0_b6u.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x124a60a8 | out: lpFileInformation=0x124a60a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd57b71a0, ftCreationTime.dwHighDateTime=0x1d79d3a, ftLastAccessTime.dwLowDateTime=0xf481c960, ftLastAccessTime.dwHighDateTime=0x1d7ce9e, ftLastWriteTime.dwLowDateTime=0xf481c960, ftLastWriteTime.dwHighDateTime=0x1d7ce9e, nFileSizeHigh=0x0, nFileSizeLow=0x23e9)) returned 1
	[0276.164] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\6gmL5X_4slK-0_B6U.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\6gml5x_4slk-0_b6u.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0276.164] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0276.165] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\6gmL5X_4slK-0_B6U.xlsx.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\6gml5x_4slk-0_b6u.xlsx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0276.165] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0276.165] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc380 | out: pbBuffer=0x123cc380) returned 1
	[0276.165] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c110 | out: pbBuffer=0x1251c110) returned 1
	[0276.165] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0281 | out: pbBuffer=0x123c0281) returned 1
	[0276.166] WriteFile (in: hFile=0x17c, lpBuffer=0x12539000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12539000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0276.169] SetEvent (hEvent=0x14c) returned 1
	[0276.169] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x23e9, lpOverlapped=0x0) returned 1
	[0276.171] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x23e9, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0x23e9, lpOverlapped=0x0) returned 1
	[0276.174] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0276.174] CloseHandle (hObject=0x17c) returned 1
	[0276.177] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0276.180] CloseHandle (hObject=0x178) returned 1
	[0276.180] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123c0200*, nNumberOfCharsToWrite=0x3b, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x123c0200*, lpNumberOfCharsWritten=0x124228a0*=0x3b) returned 1
	[0276.440] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\6gmL5X_4slK-0_B6U.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\6gml5x_4slk-0_b6u.xlsx")) returned 1
	[0276.518] SetEvent (hEvent=0x14c) returned 1
	[0276.519] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0276.555] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0276.555] SetEvent (hEvent=0x14c) returned 1
	[0276.555] SetEvent (hEvent=0x124) returned 1
	[0276.555] SetEvent (hEvent=0x12c) returned 1
	[0276.555] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0276.666] SetEvent (hEvent=0x168) returned 1
	[0276.666] SetEvent (hEvent=0x12c) returned 1
	[0276.691] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0276.748] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0276.748] SetEvent (hEvent=0x12c) returned 1
	[0276.752] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0276.838] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0276.838] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0276.880] SetEvent (hEvent=0x12c) returned 1
	[0276.880] SetEvent (hEvent=0x124) returned 1
	[0276.880] SetEvent (hEvent=0x14c) returned 1
	[0276.880] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0276.936] SetEvent (hEvent=0x168) returned 1
	[0276.936] SetEvent (hEvent=0x14c) returned 1
	[0276.937] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\6gmL5X_4slK-0_B6U.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\6gml5x_4slk-0_b6u.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0276.979] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0276.979] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0277.004] CloseHandle (hObject=0x178) returned 1
	[0277.031] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\6gmL5X_4slK-0_B6U.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\6gml5x_4slk-0_b6u.xlsx")) returned 1
	[0277.088] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\7GBj_BHQB3gjCk60.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\7gbj_bhqb3gjck60.docx"), fInfoLevelId=0x0, lpFileInformation=0x124a6058 | out: lpFileInformation=0x124a6058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89a89330, ftCreationTime.dwHighDateTime=0x1d7dc36, ftLastAccessTime.dwLowDateTime=0xec96b410, ftLastAccessTime.dwHighDateTime=0x1d7e684, ftLastWriteTime.dwLowDateTime=0xec96b410, ftLastWriteTime.dwHighDateTime=0x1d7e684, nFileSizeHigh=0x0, nFileSizeLow=0x8821)) returned 1
	[0277.089] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\7GBj_BHQB3gjCk60.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\7gbj_bhqb3gjck60.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0277.089] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0277.089] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\7GBj_BHQB3gjCk60.docx.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\7gbj_bhqb3gjck60.docx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0277.089] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0277.089] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc380 | out: pbBuffer=0x123cc380) returned 1
	[0277.089] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c110 | out: pbBuffer=0x1251c110) returned 1
	[0277.090] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0281 | out: pbBuffer=0x123c0281) returned 1
	[0277.090] WriteFile (in: hFile=0x17c, lpBuffer=0x12539000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12539000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0277.092] SetEvent (hEvent=0x124) returned 1
	[0277.092] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x8821, lpOverlapped=0x0) returned 1
	[0277.096] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x8821, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0x8821, lpOverlapped=0x0) returned 1
	[0277.109] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0277.109] CloseHandle (hObject=0x17c) returned 1
	[0277.111] CloseHandle (hObject=0x178) returned 1
	[0277.111] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123fc080*, nNumberOfCharsToWrite=0x3a, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x123fc080*, lpNumberOfCharsWritten=0x124228a0*=0x3a) returned 1
	[0277.152] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0277.233] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\7GBj_BHQB3gjCk60.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\7gbj_bhqb3gjck60.docx")) returned 1
	[0277.278] SetEvent (hEvent=0x124) returned 1
	[0277.280] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0277.311] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0277.311] SetEvent (hEvent=0x124) returned 1
	[0277.311] SetEvent (hEvent=0x174) returned 1
	[0277.311] SetEvent (hEvent=0x12c) returned 1
	[0277.312] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0277.388] SetEvent (hEvent=0x168) returned 1
	[0277.388] SetEvent (hEvent=0x12c) returned 1
	[0277.412] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0277.437] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0277.437] SetEvent (hEvent=0x12c) returned 1
	[0277.439] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0277.470] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0277.470] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0277.505] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0277.505] SetEvent (hEvent=0x12c) returned 1
	[0277.505] SetEvent (hEvent=0x174) returned 1
	[0277.505] SetEvent (hEvent=0x124) returned 1
	[0277.505] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0277.550] SetEvent (hEvent=0x168) returned 1
	[0277.550] SetEvent (hEvent=0x124) returned 1
	[0277.550] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\7GBj_BHQB3gjCk60.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\7gbj_bhqb3gjck60.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0277.585] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0277.585] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0277.619] CloseHandle (hObject=0x178) returned 1
	[0277.646] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\7GBj_BHQB3gjCk60.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\7gbj_bhqb3gjck60.docx")) returned 1
	[0277.683] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\8Y_umCxlI.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\8y_umcxli.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x124a60a8 | out: lpFileInformation=0x124a60a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc38743b0, ftCreationTime.dwHighDateTime=0x1d7f33f, ftLastAccessTime.dwLowDateTime=0xbbf30240, ftLastAccessTime.dwHighDateTime=0x1d82974, ftLastWriteTime.dwLowDateTime=0xbbf30240, ftLastWriteTime.dwHighDateTime=0x1d82974, nFileSizeHigh=0x0, nFileSizeLow=0x7340)) returned 1
	[0277.683] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\8Y_umCxlI.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\8y_umcxli.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0277.683] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0277.683] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\8Y_umCxlI.xlsx.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\8y_umcxli.xlsx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0277.684] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0277.684] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc380 | out: pbBuffer=0x123cc380) returned 1
	[0277.684] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x123ce1c0 | out: pbBuffer=0x123ce1c0) returned 1
	[0277.684] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc081 | out: pbBuffer=0x123fc081) returned 1
	[0277.684] WriteFile (in: hFile=0x17c, lpBuffer=0x1253b000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x1253b000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0277.687] SetEvent (hEvent=0x174) returned 1
	[0277.687] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x7340, lpOverlapped=0x0) returned 1
	[0277.689] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x7340, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0x7340, lpOverlapped=0x0) returned 1
	[0277.698] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0277.698] CloseHandle (hObject=0x17c) returned 1
	[0277.700] CloseHandle (hObject=0x178) returned 1
	[0277.700] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123d00e0*, nNumberOfCharsToWrite=0x33, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x123d00e0*, lpNumberOfCharsWritten=0x124228a0*=0x33) returned 1
	[0277.752] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0277.873] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\8Y_umCxlI.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\8y_umcxli.xlsx")) returned 1
	[0277.890] SetEvent (hEvent=0x174) returned 1
	[0277.892] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0277.924] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0277.924] SetEvent (hEvent=0x174) returned 1
	[0277.924] SetEvent (hEvent=0x14c) returned 1
	[0277.924] SetEvent (hEvent=0x12c) returned 1
	[0277.924] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0277.973] SetEvent (hEvent=0x168) returned 1
	[0277.973] SetEvent (hEvent=0x12c) returned 1
	[0277.997] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0278.024] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0278.024] SetEvent (hEvent=0x12c) returned 1
	[0278.026] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0278.053] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0278.053] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0278.065] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0278.065] SetEvent (hEvent=0x12c) returned 1
	[0278.065] SetEvent (hEvent=0x14c) returned 1
	[0278.065] SetEvent (hEvent=0x174) returned 1
	[0278.065] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0278.118] SetEvent (hEvent=0x168) returned 1
	[0278.119] SetEvent (hEvent=0x174) returned 1
	[0278.119] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\8Y_umCxlI.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\8y_umcxli.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0278.129] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0278.129] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0278.151] CloseHandle (hObject=0x178) returned 1
	[0278.179] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\8Y_umCxlI.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\8y_umcxli.xlsx")) returned 1
	[0278.198] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\GAL0vICrqtbz5.ots" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\gal0vicrqtbz5.ots"), fInfoLevelId=0x0, lpFileInformation=0x124a6058 | out: lpFileInformation=0x124a6058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0ec6e10, ftCreationTime.dwHighDateTime=0x1d825ba, ftLastAccessTime.dwLowDateTime=0x9e67b410, ftLastAccessTime.dwHighDateTime=0x1d8276b, ftLastWriteTime.dwLowDateTime=0x9e67b410, ftLastWriteTime.dwHighDateTime=0x1d8276b, nFileSizeHigh=0x0, nFileSizeLow=0x7a28)) returned 1
	[0278.199] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\GAL0vICrqtbz5.ots" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\gal0vicrqtbz5.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0278.199] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0278.199] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\GAL0vICrqtbz5.ots.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\gal0vicrqtbz5.ots.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0278.200] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0278.200] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc380 | out: pbBuffer=0x123cc380) returned 1
	[0278.200] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c110 | out: pbBuffer=0x1251c110) returned 1
	[0278.200] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc101 | out: pbBuffer=0x123fc101) returned 1
	[0278.200] WriteFile (in: hFile=0x17c, lpBuffer=0x1253b000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x1253b000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0278.203] SetEvent (hEvent=0x14c) returned 1
	[0278.204] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x7a28, lpOverlapped=0x0) returned 1
	[0278.205] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x7a28, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0x7a28, lpOverlapped=0x0) returned 1
	[0278.258] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0278.258] CloseHandle (hObject=0x17c) returned 1
	[0278.261] CloseHandle (hObject=0x178) returned 1
	[0278.261] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12428000*, nNumberOfCharsToWrite=0x36, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x12428000*, lpNumberOfCharsWritten=0x124228a0*=0x36) returned 1
	[0278.287] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0278.448] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\GAL0vICrqtbz5.ots" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\gal0vicrqtbz5.ots")) returned 1
	[0278.462] SetEvent (hEvent=0x14c) returned 1
	[0278.463] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0278.464] SetEvent (hEvent=0x14c) returned 1
	[0278.464] SetEvent (hEvent=0x124) returned 1
	[0278.464] SetEvent (hEvent=0x12c) returned 1
	[0278.464] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0278.465] SetEvent (hEvent=0x12c) returned 1
	[0278.502] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0278.505] SetEvent (hEvent=0x168) returned 1
	[0278.505] SetEvent (hEvent=0x12c) returned 1
	[0278.507] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0278.509] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0278.509] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0278.509] SetEvent (hEvent=0x12c) returned 1
	[0278.510] SetEvent (hEvent=0x124) returned 1
	[0278.510] SetEvent (hEvent=0x14c) returned 1
	[0278.510] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0278.511] SetEvent (hEvent=0x168) returned 1
	[0278.511] SetEvent (hEvent=0x14c) returned 1
	[0278.512] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\GAL0vICrqtbz5.ots" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\gal0vicrqtbz5.ots"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0278.513] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0278.513] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0278.541] CloseHandle (hObject=0x178) returned 1
	[0278.571] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\GAL0vICrqtbz5.ots" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\gal0vicrqtbz5.ots")) returned 1
	[0278.590] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Music" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\my music"), fInfoLevelId=0x0, lpFileInformation=0x124a60a8 | out: lpFileInformation=0x124a60a8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d374e80, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d374e80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d374e80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0278.590] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Music" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\my music"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0278.590] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Music\\*", lpFindFileData=0x1242293c | out: lpFindFileData=0x1242293c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0278.591] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12428150*, nNumberOfCharsToWrite=0x35, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x12428150*, lpNumberOfCharsWritten=0x124228a0*=0x35) returned 1
	[0278.607] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Music.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\my music.locked")) returned 0
	[0278.607] RemoveDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Music.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\my music.locked")) returned 0
	[0278.607] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Pictures" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\my pictures"), fInfoLevelId=0x0, lpFileInformation=0x124a60f8 | out: lpFileInformation=0x124a60f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d374e80, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d374e80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d374e80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0278.608] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Videos" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\my videos"), fInfoLevelId=0x0, lpFileInformation=0x124a6148 | out: lpFileInformation=0x124a6148*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0278.608] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Nv-fQq_ b.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\nv-fqq_ b.pptx"), fInfoLevelId=0x0, lpFileInformation=0x124a6198 | out: lpFileInformation=0x124a6198*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3894240, ftCreationTime.dwHighDateTime=0x1d804d4, ftLastAccessTime.dwLowDateTime=0x4735fdb0, ftLastAccessTime.dwHighDateTime=0x1d828d7, ftLastWriteTime.dwLowDateTime=0x4735fdb0, ftLastWriteTime.dwHighDateTime=0x1d828d7, nFileSizeHigh=0x0, nFileSizeLow=0x1bce)) returned 1
	[0278.608] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Nv-fQq_ b.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\nv-fqq_ b.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0278.608] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0278.608] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Nv-fQq_ b.pptx.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\nv-fqq_ b.pptx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0278.609] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0278.609] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc540 | out: pbBuffer=0x123cc540) returned 1
	[0278.609] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x123ce4d0 | out: pbBuffer=0x123ce4d0) returned 1
	[0278.609] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc081 | out: pbBuffer=0x123fc081) returned 1
	[0278.609] WriteFile (in: hFile=0x17c, lpBuffer=0x12509000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12509000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0278.617] SetEvent (hEvent=0x124) returned 1
	[0278.617] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x1bce, lpOverlapped=0x0) returned 1
	[0278.618] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x1bce, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0x1bce, lpOverlapped=0x0) returned 1
	[0278.621] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0278.621] CloseHandle (hObject=0x17c) returned 1
	[0278.624] CloseHandle (hObject=0x178) returned 1
	[0278.624] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123d00e0*, nNumberOfCharsToWrite=0x33, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x123d00e0*, lpNumberOfCharsWritten=0x124228a0*=0x33) returned 1
	[0278.646] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0278.648] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Nv-fQq_ b.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\nv-fqq_ b.pptx")) returned 1
	[0278.655] SetEvent (hEvent=0x124) returned 1
	[0278.657] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0278.657] SetEvent (hEvent=0x124) returned 1
	[0278.657] SetEvent (hEvent=0x174) returned 1
	[0278.657] SetEvent (hEvent=0x12c) returned 1
	[0278.658] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0278.664] SetEvent (hEvent=0x168) returned 1
	[0278.664] SetEvent (hEvent=0x12c) returned 1
	[0278.688] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0278.689] SetEvent (hEvent=0x12c) returned 1
	[0278.692] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0278.692] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0278.692] SetEvent (hEvent=0x12c) returned 1
	[0278.692] SetEvent (hEvent=0x174) returned 1
	[0278.692] SetEvent (hEvent=0x124) returned 1
	[0278.692] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0278.693] SetEvent (hEvent=0x124) returned 1
	[0278.694] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Nv-fQq_ b.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\nv-fqq_ b.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0278.695] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0278.695] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0278.720] CloseHandle (hObject=0x178) returned 1
	[0278.821] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Nv-fQq_ b.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\nv-fqq_ b.pptx")) returned 1
	[0278.832] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\outlook files"), fInfoLevelId=0x0, lpFileInformation=0x124a6058 | out: lpFileInformation=0x124a6058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63954f0d, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x878c65f2, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x878c65f2, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0278.832] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\outlook files"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0278.832] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63954f0d, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x65ef9a5c, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x878c65f2, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f8e8
	[0278.833] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63954f0d, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x65ef9a5c, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x878c65f2, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0278.833] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6397affd, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x6397affd, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x878917cb, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="achoo@gdllo.de.pst", cAlternateFileName="ACHOO@~1.PST")) returned 1
	[0278.833] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0278.833] FindClose (in: hFindFile=0x79f8e8 | out: hFindFile=0x79f8e8) returned 1
	[0278.833] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\outlook files\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0278.834] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d30 | out: lpMode=0x12422d30) returned 0
	[0278.834] WriteFile (in: hFile=0x178, lpBuffer=0x12694000*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d20, lpOverlapped=0x0 | out: lpBuffer=0x12694000*, lpNumberOfBytesWritten=0x12422d20*=0xc85, lpOverlapped=0x0) returned 1
	[0278.835] CloseHandle (hObject=0x178) returned 1
	[0278.836] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12642000*, nNumberOfCharsToWrite=0x48, lpNumberOfCharsWritten=0x124228b0, lpReserved=0x0 | out: lpBuffer=0x12642000*, lpNumberOfCharsWritten=0x124228b0*=0x48) returned 1
	[0278.847] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\outlook files\\achoo@gdllo.de.pst"), fInfoLevelId=0x0, lpFileInformation=0x124a60f8 | out: lpFileInformation=0x124a60f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6397affd, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x6397affd, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x878917cb, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x42400)) returned 1
	[0278.857] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\outlook files\\achoo@gdllo.de.pst"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0278.857] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0278.857] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\outlook files\\achoo@gdllo.de.pst.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0278.861] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0278.861] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc4e0 | out: pbBuffer=0x123cc4e0) returned 1
	[0278.861] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c240 | out: pbBuffer=0x1251c240) returned 1
	[0278.861] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc181 | out: pbBuffer=0x123fc181) returned 1
	[0278.861] WriteFile (in: hFile=0x17c, lpBuffer=0x1253d000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x1253d000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0278.864] SetEvent (hEvent=0x174) returned 1
	[0278.864] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x42400, lpOverlapped=0x0) returned 1
	[0278.886] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x42400, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b84*=0x42400, lpOverlapped=0x0) returned 1
	[0278.898] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0278.900] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0278.901] CloseHandle (hObject=0x17c) returned 1
	[0278.909] CloseHandle (hObject=0x178) returned 1
	[0278.909] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12642000*, nNumberOfCharsToWrite=0x45, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x12642000*, lpNumberOfCharsWritten=0x1242283c*=0x45) returned 1
	[0278.922] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\outlook files\\achoo@gdllo.de.pst")) returned 1
	[0278.936] SetEvent (hEvent=0x174) returned 1
	[0278.937] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0278.937] SetEvent (hEvent=0x174) returned 1
	[0278.937] SetEvent (hEvent=0x14c) returned 1
	[0278.938] SetEvent (hEvent=0x12c) returned 1
	[0278.938] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0278.938] SetEvent (hEvent=0x12c) returned 1
	[0278.966] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0278.971] SetEvent (hEvent=0x168) returned 1
	[0278.972] SetEvent (hEvent=0x12c) returned 1
	[0278.974] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0278.974] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0278.975] SetEvent (hEvent=0x12c) returned 1
	[0278.975] SetEvent (hEvent=0x14c) returned 1
	[0278.975] SetEvent (hEvent=0x174) returned 1
	[0278.975] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0278.975] SetEvent (hEvent=0x174) returned 1
	[0278.976] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\outlook files\\achoo@gdllo.de.pst"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0278.977] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0278.977] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0279.000] CloseHandle (hObject=0x178) returned 1
	[0279.033] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\outlook files\\achoo@gdllo.de.pst")) returned 1
	[0279.049] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\SfN_7SLvBv6HWGGZ.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\sfn_7slvbv6hwggz.docx"), fInfoLevelId=0x0, lpFileInformation=0x124a60a8 | out: lpFileInformation=0x124a60a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9ac01e0, ftCreationTime.dwHighDateTime=0x1d8290c, ftLastAccessTime.dwLowDateTime=0x6f4a1ea0, ftLastAccessTime.dwHighDateTime=0x1d82984, ftLastWriteTime.dwLowDateTime=0x6f4a1ea0, ftLastWriteTime.dwHighDateTime=0x1d82984, nFileSizeHigh=0x0, nFileSizeLow=0x9970)) returned 1
	[0279.049] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\SfN_7SLvBv6HWGGZ.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\sfn_7slvbv6hwggz.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0279.049] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0279.049] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\SfN_7SLvBv6HWGGZ.docx.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\sfn_7slvbv6hwggz.docx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0279.050] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0279.050] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc4a0 | out: pbBuffer=0x123cc4a0) returned 1
	[0279.050] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c110 | out: pbBuffer=0x1251c110) returned 1
	[0279.050] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc101 | out: pbBuffer=0x123fc101) returned 1
	[0279.050] WriteFile (in: hFile=0x17c, lpBuffer=0x12539000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12539000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0279.053] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0279.056] SetEvent (hEvent=0x168) returned 1
	[0279.056] SetEvent (hEvent=0x14c) returned 1
	[0279.056] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x9970, lpOverlapped=0x0) returned 1
	[0279.059] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x9970, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0x9970, lpOverlapped=0x0) returned 1
	[0279.062] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0279.062] CloseHandle (hObject=0x17c) returned 1
	[0279.065] CloseHandle (hObject=0x178) returned 1
	[0279.065] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123c0200*, nNumberOfCharsToWrite=0x3a, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x123c0200*, lpNumberOfCharsWritten=0x124228a0*=0x3a) returned 1
	[0279.079] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0279.082] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\SfN_7SLvBv6HWGGZ.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\sfn_7slvbv6hwggz.docx")) returned 1
	[0279.095] SetEvent (hEvent=0x14c) returned 1
	[0279.100] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0279.101] SetEvent (hEvent=0x14c) returned 1
	[0279.101] SetEvent (hEvent=0x124) returned 1
	[0279.101] SetEvent (hEvent=0x12c) returned 1
	[0279.101] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0279.101] SetEvent (hEvent=0x168) returned 1
	[0279.102] SetEvent (hEvent=0x12c) returned 1
	[0279.140] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0279.140] SetEvent (hEvent=0x168) returned 1
	[0279.140] SetEvent (hEvent=0x12c) returned 1
	[0279.143] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0279.144] SetEvent (hEvent=0x12c) returned 1
	[0279.144] SetEvent (hEvent=0x124) returned 1
	[0279.144] SetEvent (hEvent=0x14c) returned 1
	[0279.144] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0279.145] SetEvent (hEvent=0x14c) returned 1
	[0279.145] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\SfN_7SLvBv6HWGGZ.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\sfn_7slvbv6hwggz.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0279.147] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0279.147] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0279.174] CloseHandle (hObject=0x178) returned 1
	[0279.206] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\SfN_7SLvBv6HWGGZ.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\sfn_7slvbv6hwggz.docx")) returned 1
	[0279.241] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\TaxhME.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\taxhme.pptx"), fInfoLevelId=0x0, lpFileInformation=0x124a6058 | out: lpFileInformation=0x124a6058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x796bb8c0, ftCreationTime.dwHighDateTime=0x1d828a4, ftLastAccessTime.dwLowDateTime=0x2ebcd450, ftLastAccessTime.dwHighDateTime=0x1d8294c, ftLastWriteTime.dwLowDateTime=0x2ebcd450, ftLastWriteTime.dwHighDateTime=0x1d8294c, nFileSizeHigh=0x0, nFileSizeLow=0x2f89)) returned 1
	[0279.241] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\TaxhME.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\taxhme.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0279.241] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0279.242] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\TaxhME.pptx.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\taxhme.pptx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0279.242] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0279.242] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc380 | out: pbBuffer=0x123cc380) returned 1
	[0279.242] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x123ce1c0 | out: pbBuffer=0x123ce1c0) returned 1
	[0279.242] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0279.243] WriteFile (in: hFile=0x17c, lpBuffer=0x1253b000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x1253b000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0279.245] SetEvent (hEvent=0x124) returned 1
	[0279.246] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x2f89, lpOverlapped=0x0) returned 1
	[0279.247] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x2f89, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0x2f89, lpOverlapped=0x0) returned 1
	[0279.250] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0279.250] CloseHandle (hObject=0x17c) returned 1
	[0279.252] CloseHandle (hObject=0x178) returned 1
	[0279.252] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x125d8000*, nNumberOfCharsToWrite=0x30, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x125d8000*, lpNumberOfCharsWritten=0x124228a0*=0x30) returned 1
	[0279.268] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0279.272] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\TaxhME.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\taxhme.pptx")) returned 1
	[0279.286] SetEvent (hEvent=0x124) returned 1
	[0279.288] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0279.289] SetEvent (hEvent=0x124) returned 1
	[0279.289] SetEvent (hEvent=0x174) returned 1
	[0279.289] SetEvent (hEvent=0x12c) returned 1
	[0279.289] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0279.289] SetEvent (hEvent=0x12c) returned 1
	[0279.371] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0279.373] SetEvent (hEvent=0x168) returned 1
	[0279.373] SetEvent (hEvent=0x12c) returned 1
	[0279.376] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0279.377] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0279.377] SetEvent (hEvent=0x174) returned 1
	[0279.377] SetEvent (hEvent=0x12c) returned 1
	[0279.377] SetEvent (hEvent=0x124) returned 1
	[0279.378] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0279.378] SetEvent (hEvent=0x124) returned 1
	[0279.379] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\TaxhME.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\taxhme.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0279.381] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0279.381] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0279.412] CloseHandle (hObject=0x178) returned 1
	[0279.439] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\TaxhME.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\taxhme.pptx")) returned 1
	[0279.452] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\XlenjhZeamfDvL.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\xlenjhzeamfdvl.odt"), fInfoLevelId=0x0, lpFileInformation=0x124a60a8 | out: lpFileInformation=0x124a60a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c0c2020, ftCreationTime.dwHighDateTime=0x1d824ee, ftLastAccessTime.dwLowDateTime=0x146a33f0, ftLastAccessTime.dwHighDateTime=0x1d827e8, ftLastWriteTime.dwLowDateTime=0x146a33f0, ftLastWriteTime.dwHighDateTime=0x1d827e8, nFileSizeHigh=0x0, nFileSizeLow=0x3dca)) returned 1
	[0279.452] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\XlenjhZeamfDvL.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\xlenjhzeamfdvl.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0279.452] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0279.452] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\XlenjhZeamfDvL.odt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\xlenjhzeamfdvl.odt.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0279.453] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0279.453] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc380 | out: pbBuffer=0x123cc380) returned 1
	[0279.453] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c110 | out: pbBuffer=0x1251c110) returned 1
	[0279.453] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0281 | out: pbBuffer=0x123c0281) returned 1
	[0279.453] WriteFile (in: hFile=0x17c, lpBuffer=0x1253b000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x1253b000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0279.456] SetEvent (hEvent=0x12c) returned 1
	[0279.456] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x3dca, lpOverlapped=0x0) returned 1
	[0279.458] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x3dca, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0x3dca, lpOverlapped=0x0) returned 1
	[0279.459] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0279.459] CloseHandle (hObject=0x17c) returned 1
	[0279.460] CloseHandle (hObject=0x178) returned 1
	[0279.461] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0279.461] SetEvent (hEvent=0x12c) returned 1
	[0279.461] SetEvent (hEvent=0x124) returned 1
	[0279.461] SetEvent (hEvent=0x174) returned 1
	[0279.461] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0279.462] SetEvent (hEvent=0x174) returned 1
	[0279.462] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123d00e0*, nNumberOfCharsToWrite=0x37, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x123d00e0*, lpNumberOfCharsWritten=0x124228a0*=0x37) returned 1
	[0279.474] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\XlenjhZeamfDvL.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\xlenjhzeamfdvl.odt")) returned 1
	[0279.501] SetEvent (hEvent=0x124) returned 1
	[0279.509] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0279.512] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0279.512] SetEvent (hEvent=0x124) returned 1
	[0279.512] SetEvent (hEvent=0x174) returned 1
	[0279.512] SetEvent (hEvent=0x12c) returned 1
	[0279.512] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0279.513] SetEvent (hEvent=0x12c) returned 1
	[0279.515] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0279.515] SetEvent (hEvent=0x168) returned 1
	[0279.515] SetEvent (hEvent=0x12c) returned 1
	[0279.516] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0279.516] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0279.516] SetEvent (hEvent=0x12c) returned 1
	[0279.516] SetEvent (hEvent=0x174) returned 1
	[0279.516] SetEvent (hEvent=0x124) returned 1
	[0279.516] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0279.517] SetEvent (hEvent=0x124) returned 1
	[0279.517] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\XlenjhZeamfDvL.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\xlenjhzeamfdvl.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0279.518] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0279.518] WriteFile (in: hFile=0x178, lpBuffer=0x12b44000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x12b44000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0279.540] CloseHandle (hObject=0x178) returned 1
	[0279.571] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\XlenjhZeamfDvL.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\xlenjhzeamfdvl.odt")) returned 1
	[0279.586] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\YKkR7 10Jqcina5HGOD.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ykkr7 10jqcina5hgod.pptx"), fInfoLevelId=0x0, lpFileInformation=0x124a6058 | out: lpFileInformation=0x124a6058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a3e5770, ftCreationTime.dwHighDateTime=0x1d7ab4a, ftLastAccessTime.dwLowDateTime=0x7078c00, ftLastAccessTime.dwHighDateTime=0x1d7afdc, ftLastWriteTime.dwLowDateTime=0x7078c00, ftLastWriteTime.dwHighDateTime=0x1d7afdc, nFileSizeHigh=0x0, nFileSizeLow=0x174ea)) returned 1
	[0279.586] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\YKkR7 10Jqcina5HGOD.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ykkr7 10jqcina5hgod.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0279.587] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0279.587] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\YKkR7 10Jqcina5HGOD.pptx.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ykkr7 10jqcina5hgod.pptx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0279.587] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0279.587] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc380 | out: pbBuffer=0x123cc380) returned 1
	[0279.587] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x123ce1c0 | out: pbBuffer=0x123ce1c0) returned 1
	[0279.587] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0381 | out: pbBuffer=0x123c0381) returned 1
	[0279.588] WriteFile (in: hFile=0x17c, lpBuffer=0x1253b000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x1253b000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0279.591] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0279.592] SetEvent (hEvent=0x168) returned 1
	[0279.592] SetEvent (hEvent=0x174) returned 1
	[0279.592] ReadFile (in: hFile=0x178, lpBuffer=0x12c3e000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c3e000*, lpNumberOfBytesRead=0x12422bdc*=0x174ea, lpOverlapped=0x0) returned 1
	[0279.596] WriteFile (in: hFile=0x17c, lpBuffer=0x12c3e000*, nNumberOfBytesToWrite=0x174ea, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c3e000*, lpNumberOfBytesWritten=0x12422be8*=0x174ea, lpOverlapped=0x0) returned 1
	[0279.600] ReadFile (in: hFile=0x178, lpBuffer=0x12c3e000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c3e000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0279.600] CloseHandle (hObject=0x17c) returned 1
	[0279.605] CloseHandle (hObject=0x178) returned 1
	[0279.605] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123fc080*, nNumberOfCharsToWrite=0x3d, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x123fc080*, lpNumberOfCharsWritten=0x124228a0*=0x3d) returned 1
	[0279.622] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0279.668] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\YKkR7 10Jqcina5HGOD.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ykkr7 10jqcina5hgod.pptx")) returned 1
	[0279.675] SetEvent (hEvent=0x174) returned 1
	[0279.677] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0279.679] SetEvent (hEvent=0x174) returned 1
	[0279.679] SetEvent (hEvent=0x14c) returned 1
	[0279.679] SetEvent (hEvent=0x12c) returned 1
	[0279.679] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0279.679] SetEvent (hEvent=0x168) returned 1
	[0279.679] SetEvent (hEvent=0x12c) returned 1
	[0279.702] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0279.703] SetEvent (hEvent=0x12c) returned 1
	[0279.705] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0279.705] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0279.705] SetEvent (hEvent=0x12c) returned 1
	[0279.705] SetEvent (hEvent=0x14c) returned 1
	[0279.705] SetEvent (hEvent=0x174) returned 1
	[0279.705] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0279.706] SetEvent (hEvent=0x174) returned 1
	[0279.706] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\YKkR7 10Jqcina5HGOD.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ykkr7 10jqcina5hgod.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0279.707] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0279.708] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0279.728] CloseHandle (hObject=0x178) returned 1
	[0279.758] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\YKkR7 10Jqcina5HGOD.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ykkr7 10jqcina5hgod.pptx")) returned 1
	[0279.771] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Zx_PeYMMp5W-Vj0.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\zx_peymmp5w-vj0.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x124a60a8 | out: lpFileInformation=0x124a60a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd175c0b0, ftCreationTime.dwHighDateTime=0x1d7b5cc, ftLastAccessTime.dwLowDateTime=0x5af93790, ftLastAccessTime.dwHighDateTime=0x1d820f8, ftLastWriteTime.dwLowDateTime=0x5af93790, ftLastWriteTime.dwHighDateTime=0x1d820f8, nFileSizeHigh=0x0, nFileSizeLow=0x13295)) returned 1
	[0279.771] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Zx_PeYMMp5W-Vj0.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\zx_peymmp5w-vj0.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0279.771] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0279.771] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Zx_PeYMMp5W-Vj0.xlsx.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\zx_peymmp5w-vj0.xlsx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0279.771] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0279.771] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc380 | out: pbBuffer=0x123cc380) returned 1
	[0279.772] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124121a0 | out: pbBuffer=0x124121a0) returned 1
	[0279.772] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc201 | out: pbBuffer=0x123fc201) returned 1
	[0279.772] WriteFile (in: hFile=0x17c, lpBuffer=0x12539000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12539000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0279.774] SetEvent (hEvent=0x14c) returned 1
	[0279.774] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x13295, lpOverlapped=0x0) returned 1
	[0279.777] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x13295, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0x13295, lpOverlapped=0x0) returned 1
	[0279.782] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0279.782] CloseHandle (hObject=0x17c) returned 1
	[0279.788] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0279.791] CloseHandle (hObject=0x178) returned 1
	[0279.791] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123fc080*, nNumberOfCharsToWrite=0x39, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x123fc080*, lpNumberOfCharsWritten=0x124228a0*=0x39) returned 1
	[0279.805] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Zx_PeYMMp5W-Vj0.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\zx_peymmp5w-vj0.xlsx")) returned 1
	[0279.818] SetEvent (hEvent=0x14c) returned 1
	[0279.822] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0279.825] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0279.825] SetEvent (hEvent=0x14c) returned 1
	[0279.825] SetEvent (hEvent=0x124) returned 1
	[0279.825] SetEvent (hEvent=0x12c) returned 1
	[0279.825] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0279.827] SetEvent (hEvent=0x168) returned 1
	[0279.827] SetEvent (hEvent=0x12c) returned 1
	[0279.855] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0279.855] SetEvent (hEvent=0x12c) returned 1
	[0279.858] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0279.859] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0279.859] SetEvent (hEvent=0x12c) returned 1
	[0279.859] SetEvent (hEvent=0x124) returned 1
	[0279.859] SetEvent (hEvent=0x14c) returned 1
	[0279.859] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0279.859] SetEvent (hEvent=0x14c) returned 1
	[0279.860] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Zx_PeYMMp5W-Vj0.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\zx_peymmp5w-vj0.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0279.861] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0279.861] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0279.884] CloseHandle (hObject=0x178) returned 1
	[0279.909] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Zx_PeYMMp5W-Vj0.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\zx_peymmp5w-vj0.xlsx")) returned 1
	[0279.922] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\desktop.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x124a6058 | out: lpFileInformation=0x124a6058*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43649a85, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43649a85, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x4372e947, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x192)) returned 1
	[0279.922] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\eBPMR.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ebpmr.pptx"), fInfoLevelId=0x0, lpFileInformation=0x124a60f8 | out: lpFileInformation=0x124a60f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd945c640, ftCreationTime.dwHighDateTime=0x1d80afa, ftLastAccessTime.dwLowDateTime=0xa0c9b430, ftLastAccessTime.dwHighDateTime=0x1d80ee6, ftLastWriteTime.dwLowDateTime=0xa0c9b430, ftLastWriteTime.dwHighDateTime=0x1d80ee6, nFileSizeHigh=0x0, nFileSizeLow=0x8e48)) returned 1
	[0279.922] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\eBPMR.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ebpmr.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0279.922] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0279.922] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\eBPMR.pptx.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ebpmr.pptx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0279.923] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0279.923] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc380 | out: pbBuffer=0x123cc380) returned 1
	[0279.923] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x12412260 | out: pbBuffer=0x12412260) returned 1
	[0279.923] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc081 | out: pbBuffer=0x123fc081) returned 1
	[0279.923] WriteFile (in: hFile=0x17c, lpBuffer=0x1253d000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x1253d000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0279.963] SetEvent (hEvent=0x124) returned 1
	[0279.963] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x8e48, lpOverlapped=0x0) returned 1
	[0279.965] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x8e48, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0x8e48, lpOverlapped=0x0) returned 1
	[0279.968] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0279.968] CloseHandle (hObject=0x17c) returned 1
	[0279.970] CloseHandle (hObject=0x178) returned 1
	[0279.970] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12510000*, nNumberOfCharsToWrite=0x2f, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x12510000*, lpNumberOfCharsWritten=0x124228a0*=0x2f) returned 1
	[0279.981] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0279.983] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\eBPMR.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ebpmr.pptx")) returned 1
	[0279.989] SetEvent (hEvent=0x124) returned 1
	[0279.993] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0279.994] SetEvent (hEvent=0x124) returned 1
	[0279.994] SetEvent (hEvent=0x174) returned 1
	[0279.994] SetEvent (hEvent=0x12c) returned 1
	[0279.994] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0279.995] SetEvent (hEvent=0x168) returned 1
	[0279.995] SetEvent (hEvent=0x12c) returned 1
	[0280.016] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0280.016] SetEvent (hEvent=0x12c) returned 1
	[0280.018] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0280.019] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0280.020] SetEvent (hEvent=0x12c) returned 1
	[0280.020] SetEvent (hEvent=0x174) returned 1
	[0280.020] SetEvent (hEvent=0x124) returned 1
	[0280.020] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0280.020] SetEvent (hEvent=0x124) returned 1
	[0280.021] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\eBPMR.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ebpmr.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0280.022] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0280.022] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0280.045] CloseHandle (hObject=0x178) returned 1
	[0280.073] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\eBPMR.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ebpmr.pptx")) returned 1
	[0280.086] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\eau-Oo1pPUvz4w8PX.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\eau-oo1ppuvz4w8px.ppt"), fInfoLevelId=0x0, lpFileInformation=0x124a6058 | out: lpFileInformation=0x124a6058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc63079f0, ftCreationTime.dwHighDateTime=0x1d82540, ftLastAccessTime.dwLowDateTime=0x7e38fe20, ftLastAccessTime.dwHighDateTime=0x1d829ea, ftLastWriteTime.dwLowDateTime=0x7e38fe20, ftLastWriteTime.dwHighDateTime=0x1d829ea, nFileSizeHigh=0x0, nFileSizeLow=0xb686)) returned 1
	[0280.086] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\eau-Oo1pPUvz4w8PX.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\eau-oo1ppuvz4w8px.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0280.086] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0280.087] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\eau-Oo1pPUvz4w8PX.ppt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\eau-oo1ppuvz4w8px.ppt.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0280.087] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0280.087] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc380 | out: pbBuffer=0x123cc380) returned 1
	[0280.087] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x123ce1c0 | out: pbBuffer=0x123ce1c0) returned 1
	[0280.087] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc101 | out: pbBuffer=0x123fc101) returned 1
	[0280.087] WriteFile (in: hFile=0x17c, lpBuffer=0x1253b000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x1253b000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0280.090] SetEvent (hEvent=0x174) returned 1
	[0280.090] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0xb686, lpOverlapped=0x0) returned 1
	[0280.092] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0xb686, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0xb686, lpOverlapped=0x0) returned 1
	[0280.095] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0280.095] CloseHandle (hObject=0x17c) returned 1
	[0280.098] CloseHandle (hObject=0x178) returned 1
	[0280.098] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123fc200*, nNumberOfCharsToWrite=0x3a, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x123fc200*, lpNumberOfCharsWritten=0x124228a0*=0x3a) returned 1
	[0280.109] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0280.110] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\eau-Oo1pPUvz4w8PX.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\eau-oo1ppuvz4w8px.ppt")) returned 1
	[0280.117] SetEvent (hEvent=0x174) returned 1
	[0280.118] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0280.119] SetEvent (hEvent=0x174) returned 1
	[0280.119] SetEvent (hEvent=0x14c) returned 1
	[0280.119] SetEvent (hEvent=0x12c) returned 1
	[0280.119] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0280.119] SetEvent (hEvent=0x12c) returned 1
	[0280.145] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0280.147] SetEvent (hEvent=0x168) returned 1
	[0280.147] SetEvent (hEvent=0x12c) returned 1
	[0280.149] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0280.149] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0280.149] SetEvent (hEvent=0x12c) returned 1
	[0280.149] SetEvent (hEvent=0x14c) returned 1
	[0280.149] SetEvent (hEvent=0x174) returned 1
	[0280.149] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0280.150] SetEvent (hEvent=0x174) returned 1
	[0280.151] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\eau-Oo1pPUvz4w8PX.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\eau-oo1ppuvz4w8px.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0280.152] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0280.152] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0280.176] CloseHandle (hObject=0x178) returned 1
	[0280.201] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\eau-Oo1pPUvz4w8PX.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\eau-oo1ppuvz4w8px.ppt")) returned 1
	[0280.228] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\gRpk8Z1c.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\grpk8z1c.docx"), fInfoLevelId=0x0, lpFileInformation=0x124a60a8 | out: lpFileInformation=0x124a60a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef168fe0, ftCreationTime.dwHighDateTime=0x1d7b81b, ftLastAccessTime.dwLowDateTime=0x577b74b0, ftLastAccessTime.dwHighDateTime=0x1d82428, ftLastWriteTime.dwLowDateTime=0x577b74b0, ftLastWriteTime.dwHighDateTime=0x1d82428, nFileSizeHigh=0x0, nFileSizeLow=0x1331b)) returned 1
	[0280.228] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\gRpk8Z1c.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\grpk8z1c.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0280.229] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0280.229] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\gRpk8Z1c.docx.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\grpk8z1c.docx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0280.229] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0280.229] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc380 | out: pbBuffer=0x123cc380) returned 1
	[0280.229] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x123ce1c0 | out: pbBuffer=0x123ce1c0) returned 1
	[0280.229] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc081 | out: pbBuffer=0x123fc081) returned 1
	[0280.230] WriteFile (in: hFile=0x17c, lpBuffer=0x1253b000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x1253b000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0280.232] SetEvent (hEvent=0x14c) returned 1
	[0280.232] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x1331b, lpOverlapped=0x0) returned 1
	[0280.235] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x1331b, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0x1331b, lpOverlapped=0x0) returned 1
	[0280.241] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0280.241] CloseHandle (hObject=0x17c) returned 1
	[0280.245] CloseHandle (hObject=0x178) returned 1
	[0280.245] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12428000*, nNumberOfCharsToWrite=0x32, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x12428000*, lpNumberOfCharsWritten=0x124228a0*=0x32) returned 1
	[0280.262] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\gRpk8Z1c.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\grpk8z1c.docx")) returned 1
	[0280.275] SetEvent (hEvent=0x124) returned 1
	[0280.276] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0280.277] SetEvent (hEvent=0x124) returned 1
	[0280.277] SetEvent (hEvent=0x14c) returned 1
	[0280.277] SetEvent (hEvent=0x12c) returned 1
	[0280.278] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0280.278] SetEvent (hEvent=0x168) returned 1
	[0280.278] SetEvent (hEvent=0x12c) returned 1
	[0280.307] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0280.308] SetEvent (hEvent=0x12c) returned 1
	[0280.310] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0280.310] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0280.310] SetEvent (hEvent=0x12c) returned 1
	[0280.310] SetEvent (hEvent=0x14c) returned 1
	[0280.311] SetEvent (hEvent=0x124) returned 1
	[0280.311] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0280.311] SetEvent (hEvent=0x124) returned 1
	[0280.312] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\gRpk8Z1c.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\grpk8z1c.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0280.313] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0280.313] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0280.367] CloseHandle (hObject=0x178) returned 1
	[0280.393] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\gRpk8Z1c.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\grpk8z1c.docx")) returned 1
	[0280.406] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\jaCxkmZM5HvA.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\jacxkmzm5hva.docx"), fInfoLevelId=0x0, lpFileInformation=0x124a6058 | out: lpFileInformation=0x124a6058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29495af0, ftCreationTime.dwHighDateTime=0x1d80577, ftLastAccessTime.dwLowDateTime=0x6ad7d3f0, ftLastAccessTime.dwHighDateTime=0x1d80a15, ftLastWriteTime.dwLowDateTime=0x6ad7d3f0, ftLastWriteTime.dwHighDateTime=0x1d80a15, nFileSizeHigh=0x0, nFileSizeLow=0x12cbb)) returned 1
	[0280.406] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\jaCxkmZM5HvA.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\jacxkmzm5hva.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0280.406] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0280.406] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\jaCxkmZM5HvA.docx.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\jacxkmzm5hva.docx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0280.406] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0280.407] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc380 | out: pbBuffer=0x123cc380) returned 1
	[0280.407] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x123ce1c0 | out: pbBuffer=0x123ce1c0) returned 1
	[0280.407] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc101 | out: pbBuffer=0x123fc101) returned 1
	[0280.407] WriteFile (in: hFile=0x17c, lpBuffer=0x1253b000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x1253b000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0280.409] SetEvent (hEvent=0x14c) returned 1
	[0280.410] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x12cbb, lpOverlapped=0x0) returned 1
	[0280.414] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x12cbb, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0x12cbb, lpOverlapped=0x0) returned 1
	[0280.417] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0280.417] CloseHandle (hObject=0x17c) returned 1
	[0280.420] CloseHandle (hObject=0x178) returned 1
	[0280.420] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123d00e0*, nNumberOfCharsToWrite=0x36, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x123d00e0*, lpNumberOfCharsWritten=0x124228a0*=0x36) returned 1
	[0280.432] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0280.434] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\jaCxkmZM5HvA.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\jacxkmzm5hva.docx")) returned 1
	[0280.444] SetEvent (hEvent=0x14c) returned 1
	[0280.446] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0280.447] SetEvent (hEvent=0x14c) returned 1
	[0280.447] SetEvent (hEvent=0x174) returned 1
	[0280.447] SetEvent (hEvent=0x124) returned 1
	[0280.447] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0280.448] SetEvent (hEvent=0x168) returned 1
	[0280.448] SetEvent (hEvent=0x124) returned 1
	[0280.472] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0280.473] SetEvent (hEvent=0x124) returned 1
	[0280.475] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0280.475] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0280.475] SetEvent (hEvent=0x124) returned 1
	[0280.475] SetEvent (hEvent=0x174) returned 1
	[0280.475] SetEvent (hEvent=0x14c) returned 1
	[0280.475] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0280.476] SetEvent (hEvent=0x14c) returned 1
	[0280.476] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\jaCxkmZM5HvA.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\jacxkmzm5hva.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0280.478] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0280.478] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0280.506] CloseHandle (hObject=0x178) returned 1
	[0280.537] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\jaCxkmZM5HvA.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\jacxkmzm5hva.docx")) returned 1
	[0280.556] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf"), fInfoLevelId=0x0, lpFileInformation=0x124a60a8 | out: lpFileInformation=0x124a60a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c25d880, ftCreationTime.dwHighDateTime=0x1d8286a, ftLastAccessTime.dwLowDateTime=0xd393d000, ftLastAccessTime.dwHighDateTime=0x1d828de, ftLastWriteTime.dwLowDateTime=0xd393d000, ftLastWriteTime.dwHighDateTime=0x1d828de, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0280.556] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0280.556] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c25d880, ftCreationTime.dwHighDateTime=0x1d8286a, ftLastAccessTime.dwLowDateTime=0xd393d000, ftLastAccessTime.dwHighDateTime=0x1d828de, ftLastWriteTime.dwLowDateTime=0xd393d000, ftLastWriteTime.dwHighDateTime=0x1d828de, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffe8
	[0280.557] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c25d880, ftCreationTime.dwHighDateTime=0x1d8286a, ftLastAccessTime.dwLowDateTime=0xd393d000, ftLastAccessTime.dwHighDateTime=0x1d828de, ftLastWriteTime.dwLowDateTime=0xd393d000, ftLastWriteTime.dwHighDateTime=0x1d828de, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0280.557] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea94d70, ftCreationTime.dwHighDateTime=0x1d81ae7, ftLastAccessTime.dwLowDateTime=0x82ea8710, ftLastAccessTime.dwHighDateTime=0x1d826af, ftLastWriteTime.dwLowDateTime=0x82ea8710, ftLastWriteTime.dwHighDateTime=0x1d826af, nFileSizeHigh=0x0, nFileSizeLow=0x1642b, dwReserved0=0x0, dwReserved1=0x0, cFileName="6ah1b.odp", cAlternateFileName="")) returned 1
	[0280.557] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65f12720, ftCreationTime.dwHighDateTime=0x1d827b0, ftLastAccessTime.dwLowDateTime=0xb4641ec0, ftLastAccessTime.dwHighDateTime=0x1d827d4, ftLastWriteTime.dwLowDateTime=0xb4641ec0, ftLastWriteTime.dwHighDateTime=0x1d827d4, nFileSizeHigh=0x0, nFileSizeLow=0x158d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="uMlP.pps", cAlternateFileName="")) returned 1
	[0280.557] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a420010, ftCreationTime.dwHighDateTime=0x1d827b0, ftLastAccessTime.dwLowDateTime=0x4632de50, ftLastAccessTime.dwHighDateTime=0x1d829c3, ftLastWriteTime.dwLowDateTime=0x4632de50, ftLastWriteTime.dwHighDateTime=0x1d829c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vJv2RbfkMNDaXqowjBc", cAlternateFileName="VJV2RB~1")) returned 1
	[0280.557] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91762470, ftCreationTime.dwHighDateTime=0x1d821d1, ftLastAccessTime.dwLowDateTime=0x9e13d9b0, ftLastAccessTime.dwHighDateTime=0x1d826a5, ftLastWriteTime.dwLowDateTime=0x9e13d9b0, ftLastWriteTime.dwHighDateTime=0x1d826a5, nFileSizeHigh=0x0, nFileSizeLow=0x18cb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="xtaQYYC_Me3cfvNcxyDr.doc", cAlternateFileName="XTAQYY~1.DOC")) returned 1
	[0280.557] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0280.557] FindClose (in: hFindFile=0x79ffe8 | out: hFindFile=0x79ffe8) returned 1
	[0280.558] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0280.558] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d30 | out: lpMode=0x12422d30) returned 0
	[0280.558] WriteFile (in: hFile=0x178, lpBuffer=0x12694000*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d20, lpOverlapped=0x0 | out: lpBuffer=0x12694000*, lpNumberOfBytesWritten=0x12422d20*=0xc85, lpOverlapped=0x0) returned 1
	[0280.560] CloseHandle (hObject=0x178) returned 1
	[0280.560] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12644000*, nNumberOfCharsToWrite=0x4e, lpNumberOfCharsWritten=0x124228b0, lpReserved=0x0 | out: lpBuffer=0x12644000*, lpNumberOfCharsWritten=0x124228b0*=0x4e) returned 1
	[0280.581] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\6ah1b.odp" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\6ah1b.odp"), fInfoLevelId=0x0, lpFileInformation=0x124a6238 | out: lpFileInformation=0x124a6238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea94d70, ftCreationTime.dwHighDateTime=0x1d81ae7, ftLastAccessTime.dwLowDateTime=0x82ea8710, ftLastAccessTime.dwHighDateTime=0x1d826af, ftLastWriteTime.dwLowDateTime=0x82ea8710, ftLastWriteTime.dwHighDateTime=0x1d826af, nFileSizeHigh=0x0, nFileSizeLow=0x1642b)) returned 1
	[0280.581] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\6ah1b.odp" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\6ah1b.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0280.582] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0280.582] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\6ah1b.odp.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\6ah1b.odp.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0280.582] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0280.582] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc520 | out: pbBuffer=0x123cc520) returned 1
	[0280.582] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124122f0 | out: pbBuffer=0x124122f0) returned 1
	[0280.582] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc281 | out: pbBuffer=0x123fc281) returned 1
	[0280.583] WriteFile (in: hFile=0x17c, lpBuffer=0x1253f000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x1253f000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0280.585] SetEvent (hEvent=0x174) returned 1
	[0280.585] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x1642b, lpOverlapped=0x0) returned 1
	[0280.592] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x1642b, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b84*=0x1642b, lpOverlapped=0x0) returned 1
	[0280.597] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0280.598] CloseHandle (hObject=0x17c) returned 1
	[0280.605] CloseHandle (hObject=0x178) returned 1
	[0280.605] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x125ce000*, nNumberOfCharsToWrite=0x42, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x125ce000*, lpNumberOfCharsWritten=0x1242283c*=0x42) returned 1
	[0280.623] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0280.624] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\6ah1b.odp" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\6ah1b.odp")) returned 1
	[0280.631] SetEvent (hEvent=0x174) returned 1
	[0280.632] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0280.633] SetEvent (hEvent=0x174) returned 1
	[0280.633] SetEvent (hEvent=0x12c) returned 1
	[0280.633] SetEvent (hEvent=0x124) returned 1
	[0280.633] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0280.637] SetEvent (hEvent=0x168) returned 1
	[0280.637] SetEvent (hEvent=0x124) returned 1
	[0280.664] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0280.667] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0280.667] SetEvent (hEvent=0x124) returned 1
	[0280.669] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0280.670] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0280.670] SetEvent (hEvent=0x124) returned 1
	[0280.670] SetEvent (hEvent=0x12c) returned 1
	[0280.670] SetEvent (hEvent=0x174) returned 1
	[0280.670] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0280.671] SetEvent (hEvent=0x174) returned 1
	[0280.671] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\6ah1b.odp" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\6ah1b.odp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0280.673] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0280.673] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0280.697] CloseHandle (hObject=0x178) returned 1
	[0280.723] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\6ah1b.odp" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\6ah1b.odp")) returned 1
	[0280.736] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\uMlP.pps" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\umlp.pps"), fInfoLevelId=0x0, lpFileInformation=0x124a6058 | out: lpFileInformation=0x124a6058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65f12720, ftCreationTime.dwHighDateTime=0x1d827b0, ftLastAccessTime.dwLowDateTime=0xb4641ec0, ftLastAccessTime.dwHighDateTime=0x1d827d4, ftLastWriteTime.dwLowDateTime=0xb4641ec0, ftLastWriteTime.dwHighDateTime=0x1d827d4, nFileSizeHigh=0x0, nFileSizeLow=0x158d8)) returned 1
	[0280.736] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\uMlP.pps" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\umlp.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0280.736] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0280.736] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\uMlP.pps.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\umlp.pps.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0280.736] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0280.736] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc4c0 | out: pbBuffer=0x123cc4c0) returned 1
	[0280.736] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x123ce1c0 | out: pbBuffer=0x123ce1c0) returned 1
	[0280.736] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc281 | out: pbBuffer=0x123fc281) returned 1
	[0280.737] WriteFile (in: hFile=0x17c, lpBuffer=0x12537000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x12537000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0280.742] SetEvent (hEvent=0x12c) returned 1
	[0280.742] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x158d8, lpOverlapped=0x0) returned 1
	[0280.747] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x158d8, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b84*=0x158d8, lpOverlapped=0x0) returned 1
	[0280.752] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0280.752] CloseHandle (hObject=0x17c) returned 1
	[0280.756] CloseHandle (hObject=0x178) returned 1
	[0280.756] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x125d2000*, nNumberOfCharsToWrite=0x41, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x125d2000*, lpNumberOfCharsWritten=0x1242283c*=0x41) returned 1
	[0280.768] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0280.772] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\uMlP.pps" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\umlp.pps")) returned 1
	[0280.781] SetEvent (hEvent=0x12c) returned 1
	[0280.782] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0280.784] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0280.784] SetEvent (hEvent=0x12c) returned 1
	[0280.784] SetEvent (hEvent=0x14c) returned 1
	[0280.784] SetEvent (hEvent=0x124) returned 1
	[0280.784] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0280.785] SetEvent (hEvent=0x168) returned 1
	[0280.785] SetEvent (hEvent=0x124) returned 1
	[0280.807] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0280.807] SetEvent (hEvent=0x124) returned 1
	[0280.810] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0280.811] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0280.811] SetEvent (hEvent=0x124) returned 1
	[0280.811] SetEvent (hEvent=0x14c) returned 1
	[0280.811] SetEvent (hEvent=0x12c) returned 1
	[0280.811] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0280.812] SetEvent (hEvent=0x168) returned 1
	[0280.812] SetEvent (hEvent=0x12c) returned 1
	[0280.812] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\uMlP.pps" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\umlp.pps"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0280.814] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0280.814] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0280.829] CloseHandle (hObject=0x178) returned 1
	[0280.856] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\uMlP.pps" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\umlp.pps")) returned 1
	[0280.872] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc"), fInfoLevelId=0x0, lpFileInformation=0x124a60f8 | out: lpFileInformation=0x124a60f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a420010, ftCreationTime.dwHighDateTime=0x1d827b0, ftLastAccessTime.dwLowDateTime=0x4632de50, ftLastAccessTime.dwHighDateTime=0x1d829c3, ftLastWriteTime.dwLowDateTime=0x4632de50, ftLastWriteTime.dwHighDateTime=0x1d829c3, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0280.872] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0280.873] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a420010, ftCreationTime.dwHighDateTime=0x1d827b0, ftLastAccessTime.dwLowDateTime=0x4632de50, ftLastAccessTime.dwHighDateTime=0x1d829c3, ftLastWriteTime.dwLowDateTime=0x4632de50, ftLastWriteTime.dwHighDateTime=0x1d829c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fea8
	[0280.873] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a420010, ftCreationTime.dwHighDateTime=0x1d827b0, ftLastAccessTime.dwLowDateTime=0x4632de50, ftLastAccessTime.dwHighDateTime=0x1d829c3, ftLastWriteTime.dwLowDateTime=0x4632de50, ftLastWriteTime.dwHighDateTime=0x1d829c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0280.873] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4275b80, ftCreationTime.dwHighDateTime=0x1d81df7, ftLastAccessTime.dwLowDateTime=0xdfd10d30, ftLastAccessTime.dwHighDateTime=0x1d823d7, ftLastWriteTime.dwLowDateTime=0xdfd10d30, ftLastWriteTime.dwHighDateTime=0x1d823d7, nFileSizeHigh=0x0, nFileSizeLow=0x69b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="3Zq4EcajslY7PFQKVsvW.pdf", cAlternateFileName="3ZQ4EC~1.PDF")) returned 1
	[0280.873] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d608870, ftCreationTime.dwHighDateTime=0x1d81c1b, ftLastAccessTime.dwLowDateTime=0x33ece7a0, ftLastAccessTime.dwHighDateTime=0x1d81eb4, ftLastWriteTime.dwLowDateTime=0x33ece7a0, ftLastWriteTime.dwHighDateTime=0x1d81eb4, nFileSizeHigh=0x0, nFileSizeLow=0x32c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="9RRM_.csv", cAlternateFileName="")) returned 1
	[0280.873] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4629ba0, ftCreationTime.dwHighDateTime=0x1d8295b, ftLastAccessTime.dwLowDateTime=0x207e6a20, ftLastAccessTime.dwHighDateTime=0x1d829d8, ftLastWriteTime.dwLowDateTime=0x207e6a20, ftLastWriteTime.dwHighDateTime=0x1d829d8, nFileSizeHigh=0x0, nFileSizeLow=0x183fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="H9ZYmL.pptx", cAlternateFileName="H9ZYML~1.PPT")) returned 1
	[0280.873] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7539b3d0, ftCreationTime.dwHighDateTime=0x1d81beb, ftLastAccessTime.dwLowDateTime=0xb221e3e0, ftLastAccessTime.dwHighDateTime=0x1d81fa5, ftLastWriteTime.dwLowDateTime=0xb221e3e0, ftLastWriteTime.dwHighDateTime=0x1d81fa5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TVGDzH", cAlternateFileName="")) returned 1
	[0280.873] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0280.873] FindClose (in: hFindFile=0x79fea8 | out: hFindFile=0x79fea8) returned 1
	[0280.873] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0280.874] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422ccc | out: lpMode=0x12422ccc) returned 0
	[0280.874] WriteFile (in: hFile=0x178, lpBuffer=0x12694000*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422cbc, lpOverlapped=0x0 | out: lpBuffer=0x12694000*, lpNumberOfBytesWritten=0x12422cbc*=0xc85, lpOverlapped=0x0) returned 1
	[0280.876] CloseHandle (hObject=0x178) returned 1
	[0280.876] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1253c000*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x1242284c, lpReserved=0x0 | out: lpBuffer=0x1253c000*, lpNumberOfCharsWritten=0x1242284c*=0x62) returned 1
	[0280.891] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\3Zq4EcajslY7PFQKVsvW.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\3zq4ecajsly7pfqkvsvw.pdf"), fInfoLevelId=0x0, lpFileInformation=0x124a6288 | out: lpFileInformation=0x124a6288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4275b80, ftCreationTime.dwHighDateTime=0x1d81df7, ftLastAccessTime.dwLowDateTime=0xdfd10d30, ftLastAccessTime.dwHighDateTime=0x1d823d7, ftLastWriteTime.dwLowDateTime=0xdfd10d30, ftLastWriteTime.dwHighDateTime=0x1d823d7, nFileSizeHigh=0x0, nFileSizeLow=0x69b8)) returned 1
	[0280.891] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\3Zq4EcajslY7PFQKVsvW.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\3zq4ecajsly7pfqkvsvw.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0280.891] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b48 | out: lpMode=0x12422b48) returned 0
	[0280.891] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\3Zq4EcajslY7PFQKVsvW.pdf.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\3zq4ecajsly7pfqkvsvw.pdf.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0280.892] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422b48 | out: lpMode=0x12422b48) returned 0
	[0280.892] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc540 | out: pbBuffer=0x123cc540) returned 1
	[0280.892] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x12412320 | out: pbBuffer=0x12412320) returned 1
	[0280.892] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0301 | out: pbBuffer=0x123c0301) returned 1
	[0280.893] WriteFile (in: hFile=0x17c, lpBuffer=0x125d1000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b24, lpOverlapped=0x0 | out: lpBuffer=0x125d1000*, lpNumberOfBytesWritten=0x12422b24*=0x80, lpOverlapped=0x0) returned 1
	[0280.896] SetEvent (hEvent=0x14c) returned 1
	[0280.896] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b14, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b14*=0x69b8, lpOverlapped=0x0) returned 1
	[0280.898] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x69b8, lpNumberOfBytesWritten=0x12422b20, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b20*=0x69b8, lpOverlapped=0x0) returned 1
	[0280.901] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b14, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b14*=0x0, lpOverlapped=0x0) returned 1
	[0280.901] CloseHandle (hObject=0x17c) returned 1
	[0280.904] CloseHandle (hObject=0x178) returned 1
	[0280.904] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1250a000*, nNumberOfCharsToWrite=0x65, lpNumberOfCharsWritten=0x124227d8, lpReserved=0x0 | out: lpBuffer=0x1250a000*, lpNumberOfCharsWritten=0x124227d8*=0x65) returned 1
	[0280.926] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0280.930] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\3Zq4EcajslY7PFQKVsvW.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\3zq4ecajsly7pfqkvsvw.pdf")) returned 1
	[0280.943] SetEvent (hEvent=0x14c) returned 1
	[0280.945] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0280.948] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0280.948] SetEvent (hEvent=0x14c) returned 1
	[0280.948] SetEvent (hEvent=0x174) returned 1
	[0280.949] SetEvent (hEvent=0x124) returned 1
	[0280.949] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0280.949] SetEvent (hEvent=0x168) returned 1
	[0280.949] SetEvent (hEvent=0x124) returned 1
	[0280.985] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0280.995] SetEvent (hEvent=0x124) returned 1
	[0281.001] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0281.002] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0281.002] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0281.003] SetEvent (hEvent=0x124) returned 1
	[0281.003] SetEvent (hEvent=0x174) returned 1
	[0281.003] SetEvent (hEvent=0x14c) returned 1
	[0281.003] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0281.003] SetEvent (hEvent=0x168) returned 1
	[0281.004] SetEvent (hEvent=0x14c) returned 1
	[0281.004] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\3Zq4EcajslY7PFQKVsvW.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\3zq4ecajsly7pfqkvsvw.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0281.006] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c34 | out: lpMode=0x12422c34) returned 0
	[0281.006] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c24, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c24*=0xfa000, lpOverlapped=0x0) returned 1
	[0281.032] CloseHandle (hObject=0x178) returned 1
	[0281.067] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\3Zq4EcajslY7PFQKVsvW.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\3zq4ecajsly7pfqkvsvw.pdf")) returned 1
	[0281.091] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\9RRM_.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\9rrm_.csv"), fInfoLevelId=0x0, lpFileInformation=0x124a6058 | out: lpFileInformation=0x124a6058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d608870, ftCreationTime.dwHighDateTime=0x1d81c1b, ftLastAccessTime.dwLowDateTime=0x33ece7a0, ftLastAccessTime.dwHighDateTime=0x1d81eb4, ftLastWriteTime.dwLowDateTime=0x33ece7a0, ftLastWriteTime.dwHighDateTime=0x1d81eb4, nFileSizeHigh=0x0, nFileSizeLow=0x32c4)) returned 1
	[0281.091] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\9RRM_.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\9rrm_.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0281.092] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b48 | out: lpMode=0x12422b48) returned 0
	[0281.092] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\9RRM_.csv.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\9rrm_.csv.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0281.098] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422b48 | out: lpMode=0x12422b48) returned 0
	[0281.098] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc4e0 | out: pbBuffer=0x123cc4e0) returned 1
	[0281.098] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x123ce1c0 | out: pbBuffer=0x123ce1c0) returned 1
	[0281.098] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0281.099] WriteFile (in: hFile=0x17c, lpBuffer=0x1253f000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b24, lpOverlapped=0x0 | out: lpBuffer=0x1253f000*, lpNumberOfBytesWritten=0x12422b24*=0x80, lpOverlapped=0x0) returned 1
	[0281.102] SetEvent (hEvent=0x174) returned 1
	[0281.102] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b14, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b14*=0x32c4, lpOverlapped=0x0) returned 1
	[0281.104] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x32c4, lpNumberOfBytesWritten=0x12422b20, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b20*=0x32c4, lpOverlapped=0x0) returned 1
	[0281.309] SetEvent (hEvent=0x168) returned 1
	[0281.309] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b14, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b14*=0x0, lpOverlapped=0x0) returned 1
	[0281.309] CloseHandle (hObject=0x17c) returned 1
	[0281.311] CloseHandle (hObject=0x178) returned 1
	[0281.311] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12426000*, nNumberOfCharsToWrite=0x56, lpNumberOfCharsWritten=0x124227d8, lpReserved=0x0 | out: lpBuffer=0x12426000*, lpNumberOfCharsWritten=0x124227d8*=0x56) returned 1
	[0281.366] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\9RRM_.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\9rrm_.csv")) returned 1
	[0281.384] SetEvent (hEvent=0x12c) returned 1
	[0281.386] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0281.387] SetEvent (hEvent=0x12c) returned 1
	[0281.387] SetEvent (hEvent=0x174) returned 1
	[0281.387] SetEvent (hEvent=0x124) returned 1
	[0281.387] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0281.388] SetEvent (hEvent=0x168) returned 1
	[0281.388] SetEvent (hEvent=0x124) returned 1
	[0281.423] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0281.426] SetEvent (hEvent=0x124) returned 1
	[0281.429] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0281.430] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0281.430] SetEvent (hEvent=0x124) returned 1
	[0281.430] SetEvent (hEvent=0x174) returned 1
	[0281.430] SetEvent (hEvent=0x12c) returned 1
	[0281.431] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0281.431] SetEvent (hEvent=0x168) returned 1
	[0281.431] SetEvent (hEvent=0x12c) returned 1
	[0281.432] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\9RRM_.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\9rrm_.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0281.433] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c34 | out: lpMode=0x12422c34) returned 0
	[0281.434] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c24, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c24*=0xfa000, lpOverlapped=0x0) returned 1
	[0281.465] CloseHandle (hObject=0x178) returned 1
	[0281.503] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\9RRM_.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\9rrm_.csv")) returned 1
	[0281.517] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\H9ZYmL.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\h9zyml.pptx"), fInfoLevelId=0x0, lpFileInformation=0x124a6148 | out: lpFileInformation=0x124a6148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4629ba0, ftCreationTime.dwHighDateTime=0x1d8295b, ftLastAccessTime.dwLowDateTime=0x207e6a20, ftLastAccessTime.dwHighDateTime=0x1d829d8, ftLastWriteTime.dwLowDateTime=0x207e6a20, ftLastWriteTime.dwHighDateTime=0x1d829d8, nFileSizeHigh=0x0, nFileSizeLow=0x183fa)) returned 1
	[0281.517] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\H9ZYmL.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\h9zyml.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0281.517] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b48 | out: lpMode=0x12422b48) returned 0
	[0281.518] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\H9ZYmL.pptx.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\h9zyml.pptx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0281.518] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422b48 | out: lpMode=0x12422b48) returned 0
	[0281.518] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc4e0 | out: pbBuffer=0x123cc4e0) returned 1
	[0281.518] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x123ce1c0 | out: pbBuffer=0x123ce1c0) returned 1
	[0281.518] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0281.518] WriteFile (in: hFile=0x17c, lpBuffer=0x1253d000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b24, lpOverlapped=0x0 | out: lpBuffer=0x1253d000*, lpNumberOfBytesWritten=0x12422b24*=0x80, lpOverlapped=0x0) returned 1
	[0281.521] SetEvent (hEvent=0x174) returned 1
	[0281.521] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b14, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b14*=0x183fa, lpOverlapped=0x0) returned 1
	[0281.527] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x183fa, lpNumberOfBytesWritten=0x12422b20, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b20*=0x183fa, lpOverlapped=0x0) returned 1
	[0281.531] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b14, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b14*=0x0, lpOverlapped=0x0) returned 1
	[0281.531] CloseHandle (hObject=0x17c) returned 1
	[0281.536] CloseHandle (hObject=0x178) returned 1
	[0281.537] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x125ce000*, nNumberOfCharsToWrite=0x58, lpNumberOfCharsWritten=0x124227d8, lpReserved=0x0 | out: lpBuffer=0x125ce000*, lpNumberOfCharsWritten=0x124227d8*=0x58) returned 1
	[0281.551] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0281.560] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\H9ZYmL.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\h9zyml.pptx")) returned 1
	[0281.572] SetEvent (hEvent=0x174) returned 1
	[0281.574] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0281.576] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0281.576] SetEvent (hEvent=0x174) returned 1
	[0281.576] SetEvent (hEvent=0x14c) returned 1
	[0281.576] SetEvent (hEvent=0x124) returned 1
	[0281.576] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0281.577] SetEvent (hEvent=0x124) returned 1
	[0281.610] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0281.612] SetEvent (hEvent=0x168) returned 1
	[0281.612] SetEvent (hEvent=0x124) returned 1
	[0281.615] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0281.616] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0281.616] SetEvent (hEvent=0x124) returned 1
	[0281.616] SetEvent (hEvent=0x14c) returned 1
	[0281.616] SetEvent (hEvent=0x174) returned 1
	[0281.616] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0281.617] SetEvent (hEvent=0x174) returned 1
	[0281.618] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\H9ZYmL.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\h9zyml.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0281.619] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c34 | out: lpMode=0x12422c34) returned 0
	[0281.620] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c24, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c24*=0xfa000, lpOverlapped=0x0) returned 1
	[0281.648] CloseHandle (hObject=0x178) returned 1
	[0281.684] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\H9ZYmL.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\h9zyml.pptx")) returned 1
	[0281.700] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh"), fInfoLevelId=0x0, lpFileInformation=0x124a6058 | out: lpFileInformation=0x124a6058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7539b3d0, ftCreationTime.dwHighDateTime=0x1d81beb, ftLastAccessTime.dwLowDateTime=0xb221e3e0, ftLastAccessTime.dwHighDateTime=0x1d81fa5, ftLastWriteTime.dwLowDateTime=0xb221e3e0, ftLastWriteTime.dwHighDateTime=0x1d81fa5, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0281.700] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0281.700] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7539b3d0, ftCreationTime.dwHighDateTime=0x1d81beb, ftLastAccessTime.dwLowDateTime=0xb221e3e0, ftLastAccessTime.dwHighDateTime=0x1d81fa5, ftLastWriteTime.dwLowDateTime=0xb221e3e0, ftLastWriteTime.dwHighDateTime=0x1d81fa5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fa68
	[0281.700] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7539b3d0, ftCreationTime.dwHighDateTime=0x1d81beb, ftLastAccessTime.dwLowDateTime=0xb221e3e0, ftLastAccessTime.dwHighDateTime=0x1d81fa5, ftLastWriteTime.dwLowDateTime=0xb221e3e0, ftLastWriteTime.dwHighDateTime=0x1d81fa5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0281.700] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd977f120, ftCreationTime.dwHighDateTime=0x1d81b11, ftLastAccessTime.dwLowDateTime=0x58ecad40, ftLastAccessTime.dwHighDateTime=0x1d82820, ftLastWriteTime.dwLowDateTime=0x58ecad40, ftLastWriteTime.dwHighDateTime=0x1d82820, nFileSizeHigh=0x0, nFileSizeLow=0x8496, dwReserved0=0x0, dwReserved1=0x0, cFileName="cRamxOp.pptx", cAlternateFileName="CRAMXO~1.PPT")) returned 1
	[0281.701] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a744e30, ftCreationTime.dwHighDateTime=0x1d82728, ftLastAccessTime.dwLowDateTime=0xbb04f790, ftLastAccessTime.dwHighDateTime=0x1d8295a, ftLastWriteTime.dwLowDateTime=0xbb04f790, ftLastWriteTime.dwHighDateTime=0x1d8295a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IQnC", cAlternateFileName="")) returned 1
	[0281.701] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xff6556c0, ftCreationTime.dwHighDateTime=0x1d827cd, ftLastAccessTime.dwLowDateTime=0x1c4f5a0, ftLastAccessTime.dwHighDateTime=0x1d82a13, ftLastWriteTime.dwLowDateTime=0x1c4f5a0, ftLastWriteTime.dwHighDateTime=0x1d82a13, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LdD7S xtG", cAlternateFileName="LDD7SX~1")) returned 1
	[0281.701] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49b3ad60, ftCreationTime.dwHighDateTime=0x1d81d9e, ftLastAccessTime.dwLowDateTime=0xed0abb30, ftLastAccessTime.dwHighDateTime=0x1d829e6, ftLastWriteTime.dwLowDateTime=0xed0abb30, ftLastWriteTime.dwHighDateTime=0x1d829e6, nFileSizeHigh=0x0, nFileSizeLow=0x147af, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZRQK8ITXpYCj4zTc6UpV.rtf", cAlternateFileName="ZRQK8I~1.RTF")) returned 1
	[0281.701] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0281.701] FindClose (in: hFindFile=0x79fa68 | out: hFindFile=0x79fa68) returned 1
	[0281.701] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0281.702] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c68 | out: lpMode=0x12422c68) returned 0
	[0281.702] WriteFile (in: hFile=0x178, lpBuffer=0x12694000*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422c58, lpOverlapped=0x0 | out: lpBuffer=0x12694000*, lpNumberOfBytesWritten=0x12422c58*=0xc85, lpOverlapped=0x0) returned 1
	[0281.703] CloseHandle (hObject=0x178) returned 1
	[0281.704] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1253a000*, nNumberOfCharsToWrite=0x69, lpNumberOfCharsWritten=0x124227e8, lpReserved=0x0 | out: lpBuffer=0x1253a000*, lpNumberOfCharsWritten=0x124227e8*=0x69) returned 1
	[0281.721] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc"), fInfoLevelId=0x0, lpFileInformation=0x124a62d8 | out: lpFileInformation=0x124a62d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a744e30, ftCreationTime.dwHighDateTime=0x1d82728, ftLastAccessTime.dwLowDateTime=0xbb04f790, ftLastAccessTime.dwHighDateTime=0x1d8295a, ftLastWriteTime.dwLowDateTime=0xbb04f790, ftLastWriteTime.dwHighDateTime=0x1d8295a, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0281.721] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0281.721] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a744e30, ftCreationTime.dwHighDateTime=0x1d82728, ftLastAccessTime.dwLowDateTime=0xbb04f790, ftLastAccessTime.dwHighDateTime=0x1d8295a, ftLastWriteTime.dwLowDateTime=0xbb04f790, ftLastWriteTime.dwHighDateTime=0x1d8295a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f8e8
	[0281.721] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a744e30, ftCreationTime.dwHighDateTime=0x1d82728, ftLastAccessTime.dwLowDateTime=0xbb04f790, ftLastAccessTime.dwHighDateTime=0x1d8295a, ftLastWriteTime.dwLowDateTime=0xbb04f790, ftLastWriteTime.dwHighDateTime=0x1d8295a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0281.721] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1593400, ftCreationTime.dwHighDateTime=0x1d828b7, ftLastAccessTime.dwLowDateTime=0xe0c60700, ftLastAccessTime.dwHighDateTime=0x1d82926, ftLastWriteTime.dwLowDateTime=0xe0c60700, ftLastWriteTime.dwHighDateTime=0x1d82926, nFileSizeHigh=0x0, nFileSizeLow=0xdcd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="-iqW_.pptx", cAlternateFileName="-IQW_~1.PPT")) returned 1
	[0281.722] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x579511c0, ftCreationTime.dwHighDateTime=0x1d81d86, ftLastAccessTime.dwLowDateTime=0x37a7ef80, ftLastAccessTime.dwHighDateTime=0x1d82796, ftLastWriteTime.dwLowDateTime=0x37a7ef80, ftLastWriteTime.dwHighDateTime=0x1d82796, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5A5KELPEB3fxvrO", cAlternateFileName="5A5KEL~1")) returned 1
	[0281.722] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4cb8f70, ftCreationTime.dwHighDateTime=0x1d821bb, ftLastAccessTime.dwLowDateTime=0xda8429b0, ftLastAccessTime.dwHighDateTime=0x1d828f6, ftLastWriteTime.dwLowDateTime=0xda8429b0, ftLastWriteTime.dwHighDateTime=0x1d828f6, nFileSizeHigh=0x0, nFileSizeLow=0x14978, dwReserved0=0x0, dwReserved1=0x0, cFileName="bPP6k2AtPCvK.odp", cAlternateFileName="BPP6K2~1.ODP")) returned 1
	[0281.722] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f244ef0, ftCreationTime.dwHighDateTime=0x1d81f91, ftLastAccessTime.dwLowDateTime=0x84edcf0, ftLastAccessTime.dwHighDateTime=0x1d82668, ftLastWriteTime.dwLowDateTime=0x84edcf0, ftLastWriteTime.dwHighDateTime=0x1d82668, nFileSizeHigh=0x0, nFileSizeLow=0x10723, dwReserved0=0x0, dwReserved1=0x0, cFileName="LtbtPfDoTJ77Qjxw.odt", cAlternateFileName="LTBTPF~1.ODT")) returned 1
	[0281.722] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef843d60, ftCreationTime.dwHighDateTime=0x1d81a95, ftLastAccessTime.dwLowDateTime=0xa8f7130, ftLastAccessTime.dwHighDateTime=0x1d828a4, ftLastWriteTime.dwLowDateTime=0xa8f7130, ftLastWriteTime.dwHighDateTime=0x1d828a4, nFileSizeHigh=0x0, nFileSizeLow=0x585a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mh6oNy9bLKM5.pps", cAlternateFileName="MH6ONY~1.PPS")) returned 1
	[0281.722] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59a41cd0, ftCreationTime.dwHighDateTime=0x1d82011, ftLastAccessTime.dwLowDateTime=0xfabedc30, ftLastAccessTime.dwHighDateTime=0x1d82206, ftLastWriteTime.dwLowDateTime=0xfabedc30, ftLastWriteTime.dwHighDateTime=0x1d82206, nFileSizeHigh=0x0, nFileSizeLow=0x14b38, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZjvJmA1w8wm09o.odt", cAlternateFileName="ZJVJMA~1.ODT")) returned 1
	[0281.722] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0281.723] FindClose (in: hFindFile=0x79f8e8 | out: hFindFile=0x79f8e8) returned 1
	[0281.723] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0281.724] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c04 | out: lpMode=0x12422c04) returned 0
	[0281.724] WriteFile (in: hFile=0x178, lpBuffer=0x12694d80*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422bf4, lpOverlapped=0x0 | out: lpBuffer=0x12694d80*, lpNumberOfBytesWritten=0x12422bf4*=0xc85, lpOverlapped=0x0) returned 1
	[0281.726] CloseHandle (hObject=0x178) returned 1
	[0281.726] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1253a0e0*, nNumberOfCharsToWrite=0x6e, lpNumberOfCharsWritten=0x12422784, lpReserved=0x0 | out: lpBuffer=0x1253a0e0*, lpNumberOfCharsWritten=0x12422784*=0x6e) returned 1
	[0281.751] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\-iqW_.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\-iqw_.pptx"), fInfoLevelId=0x0, lpFileInformation=0x124a6508 | out: lpFileInformation=0x124a6508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1593400, ftCreationTime.dwHighDateTime=0x1d828b7, ftLastAccessTime.dwLowDateTime=0xe0c60700, ftLastAccessTime.dwHighDateTime=0x1d82926, ftLastWriteTime.dwLowDateTime=0xe0c60700, ftLastWriteTime.dwHighDateTime=0x1d82926, nFileSizeHigh=0x0, nFileSizeLow=0xdcd5)) returned 1
	[0281.751] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\-iqW_.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\-iqw_.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0281.752] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0281.752] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\-iqW_.pptx.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\-iqw_.pptx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0281.753] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0281.753] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc620 | out: pbBuffer=0x123cc620) returned 1
	[0281.753] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124124a0 | out: pbBuffer=0x124124a0) returned 1
	[0281.753] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0281.753] WriteFile (in: hFile=0x17c, lpBuffer=0x125d7000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422a5c, lpOverlapped=0x0 | out: lpBuffer=0x125d7000*, lpNumberOfBytesWritten=0x12422a5c*=0x80, lpOverlapped=0x0) returned 1
	[0281.756] SetEvent (hEvent=0x14c) returned 1
	[0281.756] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422a4c*=0xdcd5, lpOverlapped=0x0) returned 1
	[0281.760] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0xdcd5, lpNumberOfBytesWritten=0x12422a58, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422a58*=0xdcd5, lpOverlapped=0x0) returned 1
	[0281.771] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422a4c*=0x0, lpOverlapped=0x0) returned 1
	[0281.771] CloseHandle (hObject=0x17c) returned 1
	[0281.774] CloseHandle (hObject=0x178) returned 1
	[0281.774] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12510000*, nNumberOfCharsToWrite=0x63, lpNumberOfCharsWritten=0x12422710, lpReserved=0x0 | out: lpBuffer=0x12510000*, lpNumberOfCharsWritten=0x12422710*=0x63) returned 1
	[0281.799] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0281.801] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\-iqW_.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\-iqw_.pptx")) returned 1
	[0281.815] SetEvent (hEvent=0x14c) returned 1
	[0281.841] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0281.843] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0281.843] SetEvent (hEvent=0x14c) returned 1
	[0281.843] SetEvent (hEvent=0x12c) returned 1
	[0281.843] SetEvent (hEvent=0x124) returned 1
	[0281.843] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0281.844] SetEvent (hEvent=0x168) returned 1
	[0281.844] SetEvent (hEvent=0x124) returned 1
	[0281.879] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0281.880] SetEvent (hEvent=0x168) returned 1
	[0281.880] SetEvent (hEvent=0x124) returned 1
	[0281.883] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0281.884] SetEvent (hEvent=0x124) returned 1
	[0281.884] SetEvent (hEvent=0x12c) returned 1
	[0281.884] SetEvent (hEvent=0x14c) returned 1
	[0281.884] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0281.886] SetEvent (hEvent=0x168) returned 1
	[0281.886] SetEvent (hEvent=0x14c) returned 1
	[0281.887] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\-iqW_.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\-iqw_.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0281.888] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b6c | out: lpMode=0x12422b6c) returned 0
	[0281.888] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422b5c, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422b5c*=0xfa000, lpOverlapped=0x0) returned 1
	[0281.916] CloseHandle (hObject=0x178) returned 1
	[0281.950] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\-iqW_.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\-iqw_.pptx")) returned 1
	[0281.968] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\5A5KELPEB3fxvrO" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\5a5kelpeb3fxvro"), fInfoLevelId=0x0, lpFileInformation=0x124a6148 | out: lpFileInformation=0x124a6148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x579511c0, ftCreationTime.dwHighDateTime=0x1d81d86, ftLastAccessTime.dwLowDateTime=0x37a7ef80, ftLastAccessTime.dwHighDateTime=0x1d82796, ftLastWriteTime.dwLowDateTime=0x37a7ef80, ftLastWriteTime.dwHighDateTime=0x1d82796, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0281.968] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\5A5KELPEB3fxvrO" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\5a5kelpeb3fxvro"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0281.968] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\5A5KELPEB3fxvrO\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x579511c0, ftCreationTime.dwHighDateTime=0x1d81d86, ftLastAccessTime.dwLowDateTime=0x37a7ef80, ftLastAccessTime.dwHighDateTime=0x1d82796, ftLastWriteTime.dwLowDateTime=0x37a7ef80, ftLastWriteTime.dwHighDateTime=0x1d82796, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0068
	[0281.968] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x579511c0, ftCreationTime.dwHighDateTime=0x1d81d86, ftLastAccessTime.dwLowDateTime=0x37a7ef80, ftLastAccessTime.dwHighDateTime=0x1d82796, ftLastWriteTime.dwLowDateTime=0x37a7ef80, ftLastWriteTime.dwHighDateTime=0x1d82796, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0281.968] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16b6a960, ftCreationTime.dwHighDateTime=0x1d82421, ftLastAccessTime.dwLowDateTime=0xb3058fe0, ftLastAccessTime.dwHighDateTime=0x1d82505, ftLastWriteTime.dwLowDateTime=0xb3058fe0, ftLastWriteTime.dwHighDateTime=0x1d82505, nFileSizeHigh=0x0, nFileSizeLow=0xa77d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q8qlBA 30gG.ods", cAlternateFileName="Q8QLBA~1.ODS")) returned 1
	[0281.969] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c33fe70, ftCreationTime.dwHighDateTime=0x1d82894, ftLastAccessTime.dwLowDateTime=0xefb58050, ftLastAccessTime.dwHighDateTime=0x1d82a1c, ftLastWriteTime.dwLowDateTime=0xefb58050, ftLastWriteTime.dwHighDateTime=0x1d82a1c, nFileSizeHigh=0x0, nFileSizeLow=0xd811, dwReserved0=0x0, dwReserved1=0x0, cFileName="VNJUeKMIKE5Ysn n.rtf", cAlternateFileName="VNJUEK~1.RTF")) returned 1
	[0281.969] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6af7fc20, ftCreationTime.dwHighDateTime=0x1d8207c, ftLastAccessTime.dwLowDateTime=0xb032cec0, ftLastAccessTime.dwHighDateTime=0x1d82a11, ftLastWriteTime.dwLowDateTime=0xb032cec0, ftLastWriteTime.dwHighDateTime=0x1d82a11, nFileSizeHigh=0x0, nFileSizeLow=0x8696, dwReserved0=0x0, dwReserved1=0x0, cFileName="xgy7j.pptx", cAlternateFileName="XGY7J~1.PPT")) returned 1
	[0281.969] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84069140, ftCreationTime.dwHighDateTime=0x1d829d7, ftLastAccessTime.dwLowDateTime=0xcd83b1c0, ftLastAccessTime.dwHighDateTime=0x1d82a06, ftLastWriteTime.dwLowDateTime=0xcd83b1c0, ftLastWriteTime.dwHighDateTime=0x1d82a06, nFileSizeHigh=0x0, nFileSizeLow=0x120ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="zIPqwuKy.rtf", cAlternateFileName="")) returned 1
	[0281.969] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0281.969] FindClose (in: hFindFile=0x7a0068 | out: hFindFile=0x7a0068) returned 1
	[0281.969] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\5A5KELPEB3fxvrO\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\5a5kelpeb3fxvro\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0281.970] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422ba0 | out: lpMode=0x12422ba0) returned 0
	[0281.970] WriteFile (in: hFile=0x178, lpBuffer=0x12694000*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422b90, lpOverlapped=0x0 | out: lpBuffer=0x12694000*, lpNumberOfBytesWritten=0x12422b90*=0xc85, lpOverlapped=0x0) returned 1
	[0281.972] CloseHandle (hObject=0x178) returned 1
	[0281.973] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12506000*, nNumberOfCharsToWrite=0x7e, lpNumberOfCharsWritten=0x12422720, lpReserved=0x0 | out: lpBuffer=0x12506000*, lpNumberOfCharsWritten=0x12422720*=0x7e) returned 1
	[0281.991] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\5A5KELPEB3fxvrO\\Q8qlBA 30gG.ods" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\5a5kelpeb3fxvro\\q8qlba 30gg.ods"), fInfoLevelId=0x0, lpFileInformation=0x124a6328 | out: lpFileInformation=0x124a6328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16b6a960, ftCreationTime.dwHighDateTime=0x1d82421, ftLastAccessTime.dwLowDateTime=0xb3058fe0, ftLastAccessTime.dwHighDateTime=0x1d82505, ftLastWriteTime.dwLowDateTime=0xb3058fe0, ftLastWriteTime.dwHighDateTime=0x1d82505, nFileSizeHigh=0x0, nFileSizeLow=0xa77d)) returned 1
	[0281.991] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\5A5KELPEB3fxvrO\\Q8qlBA 30gG.ods" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\5a5kelpeb3fxvro\\q8qlba 30gg.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0281.992] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422a1c | out: lpMode=0x12422a1c) returned 0
	[0281.992] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\5A5KELPEB3fxvrO\\Q8qlBA 30gG.ods.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\5a5kelpeb3fxvro\\q8qlba 30gg.ods.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0281.992] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422a1c | out: lpMode=0x12422a1c) returned 0
	[0281.992] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc620 | out: pbBuffer=0x123cc620) returned 1
	[0281.992] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x12412380 | out: pbBuffer=0x12412380) returned 1
	[0281.992] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c1681 | out: pbBuffer=0x123c1681) returned 1
	[0281.993] WriteFile (in: hFile=0x17c, lpBuffer=0x12511000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x124229f8, lpOverlapped=0x0 | out: lpBuffer=0x12511000*, lpNumberOfBytesWritten=0x124229f8*=0x80, lpOverlapped=0x0) returned 1
	[0281.996] SetEvent (hEvent=0x12c) returned 1
	[0281.996] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x124229e8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x124229e8*=0xa77d, lpOverlapped=0x0) returned 1
	[0281.999] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0xa77d, lpNumberOfBytesWritten=0x124229f4, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x124229f4*=0xa77d, lpOverlapped=0x0) returned 1
	[0282.002] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x124229e8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x124229e8*=0x0, lpOverlapped=0x0) returned 1
	[0282.002] CloseHandle (hObject=0x17c) returned 1
	[0282.007] CloseHandle (hObject=0x178) returned 1
	[0282.007] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123e8000*, nNumberOfCharsToWrite=0x78, lpNumberOfCharsWritten=0x124226ac, lpReserved=0x0 | out: lpBuffer=0x123e8000*, lpNumberOfCharsWritten=0x124226ac*=0x78) returned 1
	[0282.026] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0282.028] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\5A5KELPEB3fxvrO\\Q8qlBA 30gG.ods" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\5a5kelpeb3fxvro\\q8qlba 30gg.ods")) returned 1
	[0282.039] SetEvent (hEvent=0x12c) returned 1
	[0282.041] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0282.041] SetEvent (hEvent=0x12c) returned 1
	[0282.041] SetEvent (hEvent=0x174) returned 1
	[0282.041] SetEvent (hEvent=0x124) returned 1
	[0282.041] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0282.042] SetEvent (hEvent=0x124) returned 1
	[0282.065] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0282.073] SetEvent (hEvent=0x168) returned 1
	[0282.073] SetEvent (hEvent=0x124) returned 1
	[0282.075] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0282.099] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0282.100] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0282.104] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0282.104] SetEvent (hEvent=0x124) returned 1
	[0282.104] SetEvent (hEvent=0x174) returned 1
	[0282.104] SetEvent (hEvent=0x12c) returned 1
	[0282.104] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0282.111] SetEvent (hEvent=0x168) returned 1
	[0282.112] SetEvent (hEvent=0x12c) returned 1
	[0282.112] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\5A5KELPEB3fxvrO\\Q8qlBA 30gG.ods" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\5a5kelpeb3fxvro\\q8qlba 30gg.ods"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0282.118] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b08 | out: lpMode=0x12422b08) returned 0
	[0282.118] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422af8, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422af8*=0xfa000, lpOverlapped=0x0) returned 1
	[0282.146] CloseHandle (hObject=0x178) returned 1
	[0282.189] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\5A5KELPEB3fxvrO\\Q8qlBA 30gG.ods" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\5a5kelpeb3fxvro\\q8qlba 30gg.ods")) returned 1
	[0282.208] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\5A5KELPEB3fxvrO\\VNJUeKMIKE5Ysn n.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\5a5kelpeb3fxvro\\vnjuekmike5ysn n.rtf"), fInfoLevelId=0x0, lpFileInformation=0x124a6198 | out: lpFileInformation=0x124a6198*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c33fe70, ftCreationTime.dwHighDateTime=0x1d82894, ftLastAccessTime.dwLowDateTime=0xefb58050, ftLastAccessTime.dwHighDateTime=0x1d82a1c, ftLastWriteTime.dwLowDateTime=0xefb58050, ftLastWriteTime.dwHighDateTime=0x1d82a1c, nFileSizeHigh=0x0, nFileSizeLow=0xd811)) returned 1
	[0282.208] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\5A5KELPEB3fxvrO\\VNJUeKMIKE5Ysn n.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\5a5kelpeb3fxvro\\vnjuekmike5ysn n.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0282.208] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422a1c | out: lpMode=0x12422a1c) returned 0
	[0282.209] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\5A5KELPEB3fxvrO\\VNJUeKMIKE5Ysn n.rtf.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\5a5kelpeb3fxvro\\vnjuekmike5ysn n.rtf.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0282.209] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422a1c | out: lpMode=0x12422a1c) returned 0
	[0282.209] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc5e0 | out: pbBuffer=0x123cc5e0) returned 1
	[0282.209] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c110 | out: pbBuffer=0x1251c110) returned 1
	[0282.209] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fd601 | out: pbBuffer=0x123fd601) returned 1
	[0282.209] WriteFile (in: hFile=0x17c, lpBuffer=0x1253b000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x124229f8, lpOverlapped=0x0 | out: lpBuffer=0x1253b000*, lpNumberOfBytesWritten=0x124229f8*=0x80, lpOverlapped=0x0) returned 1
	[0282.219] SetEvent (hEvent=0x174) returned 1
	[0282.219] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x124229e8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x124229e8*=0xd811, lpOverlapped=0x0) returned 1
	[0282.223] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0xd811, lpNumberOfBytesWritten=0x124229f4, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x124229f4*=0xd811, lpOverlapped=0x0) returned 1
	[0282.227] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x124229e8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x124229e8*=0x0, lpOverlapped=0x0) returned 1
	[0282.227] CloseHandle (hObject=0x17c) returned 1
	[0282.230] CloseHandle (hObject=0x178) returned 1
	[0282.230] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1253c000*, nNumberOfCharsToWrite=0x7d, lpNumberOfCharsWritten=0x124226ac, lpReserved=0x0 | out: lpBuffer=0x1253c000*, lpNumberOfCharsWritten=0x124226ac*=0x7d) returned 1
	[0282.248] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0282.251] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\5A5KELPEB3fxvrO\\VNJUeKMIKE5Ysn n.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\5a5kelpeb3fxvro\\vnjuekmike5ysn n.rtf")) returned 1
	[0282.263] SetEvent (hEvent=0x174) returned 1
	[0282.265] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0282.266] SetEvent (hEvent=0x174) returned 1
	[0282.266] SetEvent (hEvent=0x14c) returned 1
	[0282.266] SetEvent (hEvent=0x124) returned 1
	[0282.266] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0282.267] SetEvent (hEvent=0x168) returned 1
	[0282.267] SetEvent (hEvent=0x124) returned 1
	[0282.298] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0282.300] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0282.300] SetEvent (hEvent=0x124) returned 1
	[0282.302] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0282.304] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0282.304] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0282.304] SetEvent (hEvent=0x124) returned 1
	[0282.304] SetEvent (hEvent=0x14c) returned 1
	[0282.304] SetEvent (hEvent=0x174) returned 1
	[0282.304] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0282.304] SetEvent (hEvent=0x174) returned 1
	[0282.305] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\5A5KELPEB3fxvrO\\VNJUeKMIKE5Ysn n.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\5a5kelpeb3fxvro\\vnjuekmike5ysn n.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0282.306] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b08 | out: lpMode=0x12422b08) returned 0
	[0282.306] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422af8, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422af8*=0xfa000, lpOverlapped=0x0) returned 1
	[0282.351] CloseHandle (hObject=0x178) returned 1
	[0282.394] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\5A5KELPEB3fxvrO\\VNJUeKMIKE5Ysn n.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\5a5kelpeb3fxvro\\vnjuekmike5ysn n.rtf")) returned 1
	[0282.411] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\5A5KELPEB3fxvrO\\xgy7j.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\5a5kelpeb3fxvro\\xgy7j.pptx"), fInfoLevelId=0x0, lpFileInformation=0x124a61e8 | out: lpFileInformation=0x124a61e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6af7fc20, ftCreationTime.dwHighDateTime=0x1d8207c, ftLastAccessTime.dwLowDateTime=0xb032cec0, ftLastAccessTime.dwHighDateTime=0x1d82a11, ftLastWriteTime.dwLowDateTime=0xb032cec0, ftLastWriteTime.dwHighDateTime=0x1d82a11, nFileSizeHigh=0x0, nFileSizeLow=0x8696)) returned 1
	[0282.411] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\5A5KELPEB3fxvrO\\xgy7j.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\5a5kelpeb3fxvro\\xgy7j.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0282.412] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422a1c | out: lpMode=0x12422a1c) returned 0
	[0282.412] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\5A5KELPEB3fxvrO\\xgy7j.pptx.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\5a5kelpeb3fxvro\\xgy7j.pptx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0282.412] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422a1c | out: lpMode=0x12422a1c) returned 0
	[0282.412] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc5e0 | out: pbBuffer=0x123cc5e0) returned 1
	[0282.412] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x12412240 | out: pbBuffer=0x12412240) returned 1
	[0282.412] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0401 | out: pbBuffer=0x123c0401) returned 1
	[0282.413] WriteFile (in: hFile=0x17c, lpBuffer=0x1253f000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x124229f8, lpOverlapped=0x0 | out: lpBuffer=0x1253f000*, lpNumberOfBytesWritten=0x124229f8*=0x80, lpOverlapped=0x0) returned 1
	[0282.416] SetEvent (hEvent=0x14c) returned 1
	[0282.416] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x124229e8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x124229e8*=0x8696, lpOverlapped=0x0) returned 1
	[0282.419] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x8696, lpNumberOfBytesWritten=0x124229f4, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x124229f4*=0x8696, lpOverlapped=0x0) returned 1
	[0282.421] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x124229e8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x124229e8*=0x0, lpOverlapped=0x0) returned 1
	[0282.422] CloseHandle (hObject=0x17c) returned 1
	[0282.424] CloseHandle (hObject=0x178) returned 1
	[0282.424] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12506000*, nNumberOfCharsToWrite=0x73, lpNumberOfCharsWritten=0x124226ac, lpReserved=0x0 | out: lpBuffer=0x12506000*, lpNumberOfCharsWritten=0x124226ac*=0x73) returned 1
	[0282.438] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0282.441] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\5A5KELPEB3fxvrO\\xgy7j.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\5a5kelpeb3fxvro\\xgy7j.pptx")) returned 1
	[0282.448] SetEvent (hEvent=0x14c) returned 1
	[0282.449] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0282.452] SetEvent (hEvent=0x14c) returned 1
	[0282.452] SetEvent (hEvent=0x12c) returned 1
	[0282.452] SetEvent (hEvent=0x124) returned 1
	[0282.452] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0282.453] SetEvent (hEvent=0x168) returned 1
	[0282.453] SetEvent (hEvent=0x124) returned 1
	[0282.476] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0282.476] SetEvent (hEvent=0x124) returned 1
	[0282.479] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0282.479] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0282.480] SetEvent (hEvent=0x124) returned 1
	[0282.480] SetEvent (hEvent=0x12c) returned 1
	[0282.480] SetEvent (hEvent=0x14c) returned 1
	[0282.480] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0282.480] SetEvent (hEvent=0x14c) returned 1
	[0282.481] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\5A5KELPEB3fxvrO\\xgy7j.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\5a5kelpeb3fxvro\\xgy7j.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0282.482] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b08 | out: lpMode=0x12422b08) returned 0
	[0282.482] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422af8, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422af8*=0xfa000, lpOverlapped=0x0) returned 1
	[0282.508] CloseHandle (hObject=0x178) returned 1
	[0282.535] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\5A5KELPEB3fxvrO\\xgy7j.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\5a5kelpeb3fxvro\\xgy7j.pptx")) returned 1
	[0282.547] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\5A5KELPEB3fxvrO\\zIPqwuKy.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\5a5kelpeb3fxvro\\zipqwuky.rtf"), fInfoLevelId=0x0, lpFileInformation=0x124a6198 | out: lpFileInformation=0x124a6198*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84069140, ftCreationTime.dwHighDateTime=0x1d829d7, ftLastAccessTime.dwLowDateTime=0xcd83b1c0, ftLastAccessTime.dwHighDateTime=0x1d82a06, ftLastWriteTime.dwLowDateTime=0xcd83b1c0, ftLastWriteTime.dwHighDateTime=0x1d82a06, nFileSizeHigh=0x0, nFileSizeLow=0x120ac)) returned 1
	[0282.547] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\5A5KELPEB3fxvrO\\zIPqwuKy.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\5a5kelpeb3fxvro\\zipqwuky.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0282.547] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422a1c | out: lpMode=0x12422a1c) returned 0
	[0282.547] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\5A5KELPEB3fxvrO\\zIPqwuKy.rtf.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\5a5kelpeb3fxvro\\zipqwuky.rtf.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0282.547] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422a1c | out: lpMode=0x12422a1c) returned 0
	[0282.547] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc5e0 | out: pbBuffer=0x123cc5e0) returned 1
	[0282.547] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c110 | out: pbBuffer=0x1251c110) returned 1
	[0282.547] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc281 | out: pbBuffer=0x123fc281) returned 1
	[0282.548] WriteFile (in: hFile=0x17c, lpBuffer=0x1253d000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x124229f8, lpOverlapped=0x0 | out: lpBuffer=0x1253d000*, lpNumberOfBytesWritten=0x124229f8*=0x80, lpOverlapped=0x0) returned 1
	[0282.550] SetEvent (hEvent=0x12c) returned 1
	[0282.550] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x124229e8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x124229e8*=0x120ac, lpOverlapped=0x0) returned 1
	[0282.554] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x120ac, lpNumberOfBytesWritten=0x124229f4, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x124229f4*=0x120ac, lpOverlapped=0x0) returned 1
	[0282.557] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x124229e8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x124229e8*=0x0, lpOverlapped=0x0) returned 1
	[0282.557] CloseHandle (hObject=0x17c) returned 1
	[0282.560] CloseHandle (hObject=0x178) returned 1
	[0282.560] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12510000*, nNumberOfCharsToWrite=0x75, lpNumberOfCharsWritten=0x124226ac, lpReserved=0x0 | out: lpBuffer=0x12510000*, lpNumberOfCharsWritten=0x124226ac*=0x75) returned 1
	[0282.577] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0282.581] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\5A5KELPEB3fxvrO\\zIPqwuKy.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\5a5kelpeb3fxvro\\zipqwuky.rtf")) returned 1
	[0282.590] SetEvent (hEvent=0x12c) returned 1
	[0282.591] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0282.592] SetEvent (hEvent=0x12c) returned 1
	[0282.592] SetEvent (hEvent=0x174) returned 1
	[0282.592] SetEvent (hEvent=0x124) returned 1
	[0282.592] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0282.593] SetEvent (hEvent=0x168) returned 1
	[0282.593] SetEvent (hEvent=0x124) returned 1
	[0282.614] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0282.615] SetEvent (hEvent=0x124) returned 1
	[0282.617] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0282.617] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0282.618] SetEvent (hEvent=0x124) returned 1
	[0282.618] SetEvent (hEvent=0x174) returned 1
	[0282.618] SetEvent (hEvent=0x12c) returned 1
	[0282.618] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0282.618] SetEvent (hEvent=0x168) returned 1
	[0282.618] SetEvent (hEvent=0x12c) returned 1
	[0282.619] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\5A5KELPEB3fxvrO\\zIPqwuKy.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\5a5kelpeb3fxvro\\zipqwuky.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0282.620] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b08 | out: lpMode=0x12422b08) returned 0
	[0282.620] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422af8, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422af8*=0xfa000, lpOverlapped=0x0) returned 1
	[0282.642] CloseHandle (hObject=0x178) returned 1
	[0282.669] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\5A5KELPEB3fxvrO\\zIPqwuKy.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\5a5kelpeb3fxvro\\zipqwuky.rtf")) returned 1
	[0282.686] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\LtbtPfDoTJ77Qjxw.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\ltbtpfdotj77qjxw.odt"), fInfoLevelId=0x0, lpFileInformation=0x124a61e8 | out: lpFileInformation=0x124a61e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f244ef0, ftCreationTime.dwHighDateTime=0x1d81f91, ftLastAccessTime.dwLowDateTime=0x84edcf0, ftLastAccessTime.dwHighDateTime=0x1d82668, ftLastWriteTime.dwLowDateTime=0x84edcf0, ftLastWriteTime.dwHighDateTime=0x1d82668, nFileSizeHigh=0x0, nFileSizeLow=0x10723)) returned 1
	[0282.686] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\LtbtPfDoTJ77Qjxw.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\ltbtpfdotj77qjxw.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0282.687] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0282.687] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\LtbtPfDoTJ77Qjxw.odt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\ltbtpfdotj77qjxw.odt.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0282.687] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0282.687] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc5e0 | out: pbBuffer=0x123cc5e0) returned 1
	[0282.687] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x12412240 | out: pbBuffer=0x12412240) returned 1
	[0282.687] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0301 | out: pbBuffer=0x123c0301) returned 1
	[0282.687] WriteFile (in: hFile=0x17c, lpBuffer=0x1253d000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422a5c, lpOverlapped=0x0 | out: lpBuffer=0x1253d000*, lpNumberOfBytesWritten=0x12422a5c*=0x80, lpOverlapped=0x0) returned 1
	[0282.690] SetEvent (hEvent=0x174) returned 1
	[0282.690] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422a4c*=0x10723, lpOverlapped=0x0) returned 1
	[0282.693] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x10723, lpNumberOfBytesWritten=0x12422a58, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422a58*=0x10723, lpOverlapped=0x0) returned 1
	[0282.695] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422a4c*=0x0, lpOverlapped=0x0) returned 1
	[0282.695] CloseHandle (hObject=0x17c) returned 1
	[0282.698] CloseHandle (hObject=0x178) returned 1
	[0282.698] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12510000*, nNumberOfCharsToWrite=0x6d, lpNumberOfCharsWritten=0x12422710, lpReserved=0x0 | out: lpBuffer=0x12510000*, lpNumberOfCharsWritten=0x12422710*=0x6d) returned 1
	[0282.712] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0282.715] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\LtbtPfDoTJ77Qjxw.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\ltbtpfdotj77qjxw.odt")) returned 1
	[0282.725] SetEvent (hEvent=0x174) returned 1
	[0282.726] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0282.726] SetEvent (hEvent=0x174) returned 1
	[0282.726] SetEvent (hEvent=0x14c) returned 1
	[0282.727] SetEvent (hEvent=0x124) returned 1
	[0282.727] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0282.727] SetEvent (hEvent=0x124) returned 1
	[0282.750] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0282.750] SetEvent (hEvent=0x168) returned 1
	[0282.751] SetEvent (hEvent=0x124) returned 1
	[0282.754] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0282.754] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0282.754] SetEvent (hEvent=0x124) returned 1
	[0282.754] SetEvent (hEvent=0x14c) returned 1
	[0282.754] SetEvent (hEvent=0x174) returned 1
	[0282.754] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0282.755] SetEvent (hEvent=0x174) returned 1
	[0282.756] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\LtbtPfDoTJ77Qjxw.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\ltbtpfdotj77qjxw.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0282.757] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b6c | out: lpMode=0x12422b6c) returned 0
	[0282.757] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422b5c, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422b5c*=0xfa000, lpOverlapped=0x0) returned 1
	[0282.779] CloseHandle (hObject=0x178) returned 1
	[0282.813] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\LtbtPfDoTJ77Qjxw.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\ltbtpfdotj77qjxw.odt")) returned 1
	[0282.827] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\Mh6oNy9bLKM5.pps" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\mh6ony9blkm5.pps"), fInfoLevelId=0x0, lpFileInformation=0x124a6148 | out: lpFileInformation=0x124a6148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef843d60, ftCreationTime.dwHighDateTime=0x1d81a95, ftLastAccessTime.dwLowDateTime=0xa8f7130, ftLastAccessTime.dwHighDateTime=0x1d828a4, ftLastWriteTime.dwLowDateTime=0xa8f7130, ftLastWriteTime.dwHighDateTime=0x1d828a4, nFileSizeHigh=0x0, nFileSizeLow=0x585a)) returned 1
	[0282.827] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\Mh6oNy9bLKM5.pps" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\mh6ony9blkm5.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0282.827] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0282.827] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\Mh6oNy9bLKM5.pps.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\mh6ony9blkm5.pps.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0282.828] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0282.828] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc5a0 | out: pbBuffer=0x123cc5a0) returned 1
	[0282.828] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c110 | out: pbBuffer=0x1251c110) returned 1
	[0282.828] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0282.828] WriteFile (in: hFile=0x17c, lpBuffer=0x1253d000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422a5c, lpOverlapped=0x0 | out: lpBuffer=0x1253d000*, lpNumberOfBytesWritten=0x12422a5c*=0x80, lpOverlapped=0x0) returned 1
	[0282.831] SetEvent (hEvent=0x14c) returned 1
	[0282.831] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422a4c*=0x585a, lpOverlapped=0x0) returned 1
	[0282.833] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x585a, lpNumberOfBytesWritten=0x12422a58, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422a58*=0x585a, lpOverlapped=0x0) returned 1
	[0282.836] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422a4c*=0x0, lpOverlapped=0x0) returned 1
	[0282.836] CloseHandle (hObject=0x17c) returned 1
	[0282.838] CloseHandle (hObject=0x178) returned 1
	[0282.838] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12510000*, nNumberOfCharsToWrite=0x69, lpNumberOfCharsWritten=0x12422710, lpReserved=0x0 | out: lpBuffer=0x12510000*, lpNumberOfCharsWritten=0x12422710*=0x69) returned 1
	[0282.853] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0282.857] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\Mh6oNy9bLKM5.pps" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\mh6ony9blkm5.pps")) returned 1
	[0282.868] SetEvent (hEvent=0x14c) returned 1
	[0282.870] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0282.872] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0282.872] SetEvent (hEvent=0x14c) returned 1
	[0282.872] SetEvent (hEvent=0x12c) returned 1
	[0282.872] SetEvent (hEvent=0x124) returned 1
	[0282.872] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0282.873] SetEvent (hEvent=0x168) returned 1
	[0282.873] SetEvent (hEvent=0x124) returned 1
	[0282.902] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0282.904] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0282.904] SetEvent (hEvent=0x124) returned 1
	[0282.906] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0282.907] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0282.908] SetEvent (hEvent=0x124) returned 1
	[0282.908] SetEvent (hEvent=0x12c) returned 1
	[0282.908] SetEvent (hEvent=0x14c) returned 1
	[0282.908] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0282.909] SetEvent (hEvent=0x168) returned 1
	[0282.909] SetEvent (hEvent=0x14c) returned 1
	[0282.909] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\Mh6oNy9bLKM5.pps" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\mh6ony9blkm5.pps"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0282.910] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b6c | out: lpMode=0x12422b6c) returned 0
	[0282.910] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422b5c, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422b5c*=0xfa000, lpOverlapped=0x0) returned 1
	[0282.934] CloseHandle (hObject=0x178) returned 1
	[0282.959] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\Mh6oNy9bLKM5.pps" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\mh6ony9blkm5.pps")) returned 1
	[0282.978] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\ZjvJmA1w8wm09o.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\zjvjma1w8wm09o.odt"), fInfoLevelId=0x0, lpFileInformation=0x124a6198 | out: lpFileInformation=0x124a6198*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59a41cd0, ftCreationTime.dwHighDateTime=0x1d82011, ftLastAccessTime.dwLowDateTime=0xfabedc30, ftLastAccessTime.dwHighDateTime=0x1d82206, ftLastWriteTime.dwLowDateTime=0xfabedc30, ftLastWriteTime.dwHighDateTime=0x1d82206, nFileSizeHigh=0x0, nFileSizeLow=0x14b38)) returned 1
	[0282.978] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\ZjvJmA1w8wm09o.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\zjvjma1w8wm09o.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0282.978] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0282.979] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\ZjvJmA1w8wm09o.odt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\zjvjma1w8wm09o.odt.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0282.979] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0282.979] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc5a0 | out: pbBuffer=0x123cc5a0) returned 1
	[0282.979] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x12412220 | out: pbBuffer=0x12412220) returned 1
	[0282.979] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0282.979] WriteFile (in: hFile=0x17c, lpBuffer=0x1253d000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422a5c, lpOverlapped=0x0 | out: lpBuffer=0x1253d000*, lpNumberOfBytesWritten=0x12422a5c*=0x80, lpOverlapped=0x0) returned 1
	[0282.982] SetEvent (hEvent=0x12c) returned 1
	[0282.982] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422a4c*=0x14b38, lpOverlapped=0x0) returned 1
	[0282.985] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x14b38, lpNumberOfBytesWritten=0x12422a58, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422a58*=0x14b38, lpOverlapped=0x0) returned 1
	[0282.987] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422a4c*=0x0, lpOverlapped=0x0) returned 1
	[0282.988] CloseHandle (hObject=0x17c) returned 1
	[0282.991] CloseHandle (hObject=0x178) returned 1
	[0282.992] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0282.993] SetEvent (hEvent=0x12c) returned 1
	[0282.993] SetEvent (hEvent=0x14c) returned 1
	[0282.993] SetEvent (hEvent=0x124) returned 1
	[0282.993] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0282.993] SetEvent (hEvent=0x168) returned 1
	[0282.994] SetEvent (hEvent=0x124) returned 1
	[0282.994] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1240e000*, nNumberOfCharsToWrite=0x6b, lpNumberOfCharsWritten=0x12422710, lpReserved=0x0 | out: lpBuffer=0x1240e000*, lpNumberOfCharsWritten=0x12422710*=0x6b) returned 1
	[0283.008] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\ZjvJmA1w8wm09o.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\zjvjma1w8wm09o.odt")) returned 1
	[0283.034] SetEvent (hEvent=0x14c) returned 1
	[0283.040] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0283.043] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0283.043] SetEvent (hEvent=0x14c) returned 1
	[0283.043] SetEvent (hEvent=0x124) returned 1
	[0283.043] SetEvent (hEvent=0x12c) returned 1
	[0283.043] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0283.044] SetEvent (hEvent=0x168) returned 1
	[0283.044] SetEvent (hEvent=0x12c) returned 1
	[0283.046] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0283.047] SetEvent (hEvent=0x12c) returned 1
	[0283.047] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0283.047] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0283.047] SetEvent (hEvent=0x12c) returned 1
	[0283.047] SetEvent (hEvent=0x124) returned 1
	[0283.047] SetEvent (hEvent=0x14c) returned 1
	[0283.048] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0283.048] SetEvent (hEvent=0x168) returned 1
	[0283.048] SetEvent (hEvent=0x14c) returned 1
	[0283.048] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\ZjvJmA1w8wm09o.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\zjvjma1w8wm09o.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0283.050] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b6c | out: lpMode=0x12422b6c) returned 0
	[0283.050] WriteFile (in: hFile=0x178, lpBuffer=0x12b44000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422b5c, lpOverlapped=0x0 | out: lpBuffer=0x12b44000*, lpNumberOfBytesWritten=0x12422b5c*=0xfa000, lpOverlapped=0x0) returned 1
	[0283.076] CloseHandle (hObject=0x178) returned 1
	[0283.102] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\ZjvJmA1w8wm09o.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\zjvjma1w8wm09o.odt")) returned 1
	[0283.120] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\bPP6k2AtPCvK.odp" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\bpp6k2atpcvk.odp"), fInfoLevelId=0x0, lpFileInformation=0x124a6148 | out: lpFileInformation=0x124a6148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4cb8f70, ftCreationTime.dwHighDateTime=0x1d821bb, ftLastAccessTime.dwLowDateTime=0xda8429b0, ftLastAccessTime.dwHighDateTime=0x1d828f6, ftLastWriteTime.dwLowDateTime=0xda8429b0, ftLastWriteTime.dwHighDateTime=0x1d828f6, nFileSizeHigh=0x0, nFileSizeLow=0x14978)) returned 1
	[0283.120] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\bPP6k2AtPCvK.odp" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\bpp6k2atpcvk.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0283.120] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0283.120] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\bPP6k2AtPCvK.odp.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\bpp6k2atpcvk.odp.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0283.120] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0283.120] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc5a0 | out: pbBuffer=0x123cc5a0) returned 1
	[0283.120] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x12412220 | out: pbBuffer=0x12412220) returned 1
	[0283.120] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0283.121] WriteFile (in: hFile=0x17c, lpBuffer=0x1253d000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422a5c, lpOverlapped=0x0 | out: lpBuffer=0x1253d000*, lpNumberOfBytesWritten=0x12422a5c*=0x80, lpOverlapped=0x0) returned 1
	[0283.123] SetEvent (hEvent=0x124) returned 1
	[0283.123] ReadFile (in: hFile=0x178, lpBuffer=0x12c3e000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c3e000*, lpNumberOfBytesRead=0x12422a4c*=0x14978, lpOverlapped=0x0) returned 1
	[0283.127] WriteFile (in: hFile=0x17c, lpBuffer=0x12c3e000*, nNumberOfBytesToWrite=0x14978, lpNumberOfBytesWritten=0x12422a58, lpOverlapped=0x0 | out: lpBuffer=0x12c3e000*, lpNumberOfBytesWritten=0x12422a58*=0x14978, lpOverlapped=0x0) returned 1
	[0283.130] ReadFile (in: hFile=0x178, lpBuffer=0x12c3e000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c3e000*, lpNumberOfBytesRead=0x12422a4c*=0x0, lpOverlapped=0x0) returned 1
	[0283.130] CloseHandle (hObject=0x17c) returned 1
	[0283.134] CloseHandle (hObject=0x178) returned 1
	[0283.134] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12510000*, nNumberOfCharsToWrite=0x69, lpNumberOfCharsWritten=0x12422710, lpReserved=0x0 | out: lpBuffer=0x12510000*, lpNumberOfCharsWritten=0x12422710*=0x69) returned 1
	[0283.145] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0283.146] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\bPP6k2AtPCvK.odp" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\bpp6k2atpcvk.odp")) returned 1
	[0283.155] SetEvent (hEvent=0x124) returned 1
	[0283.156] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0283.159] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0283.159] SetEvent (hEvent=0x124) returned 1
	[0283.159] SetEvent (hEvent=0x174) returned 1
	[0283.159] SetEvent (hEvent=0x12c) returned 1
	[0283.159] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0283.160] SetEvent (hEvent=0x168) returned 1
	[0283.160] SetEvent (hEvent=0x12c) returned 1
	[0283.181] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0283.182] SetEvent (hEvent=0x12c) returned 1
	[0283.184] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0283.184] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0283.184] SetEvent (hEvent=0x12c) returned 1
	[0283.184] SetEvent (hEvent=0x174) returned 1
	[0283.184] SetEvent (hEvent=0x124) returned 1
	[0283.184] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0283.185] SetEvent (hEvent=0x124) returned 1
	[0283.185] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\bPP6k2AtPCvK.odp" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\bpp6k2atpcvk.odp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0283.186] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b6c | out: lpMode=0x12422b6c) returned 0
	[0283.186] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422b5c, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422b5c*=0xfa000, lpOverlapped=0x0) returned 1
	[0283.227] CloseHandle (hObject=0x178) returned 1
	[0283.251] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\IQnC\\bPP6k2AtPCvK.odp" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\iqnc\\bpp6k2atpcvk.odp")) returned 1
	[0283.266] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\LdD7S xtG" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\ldd7s xtg"), fInfoLevelId=0x0, lpFileInformation=0x124a6198 | out: lpFileInformation=0x124a6198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xff6556c0, ftCreationTime.dwHighDateTime=0x1d827cd, ftLastAccessTime.dwLowDateTime=0x1c4f5a0, ftLastAccessTime.dwHighDateTime=0x1d82a13, ftLastWriteTime.dwLowDateTime=0x1c4f5a0, ftLastWriteTime.dwHighDateTime=0x1d82a13, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0283.266] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\LdD7S xtG" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\ldd7s xtg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0283.266] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\LdD7S xtG\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xff6556c0, ftCreationTime.dwHighDateTime=0x1d827cd, ftLastAccessTime.dwLowDateTime=0x1c4f5a0, ftLastAccessTime.dwHighDateTime=0x1d82a13, ftLastWriteTime.dwLowDateTime=0x1c4f5a0, ftLastWriteTime.dwHighDateTime=0x1d82a13, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fb68
	[0283.267] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xff6556c0, ftCreationTime.dwHighDateTime=0x1d827cd, ftLastAccessTime.dwLowDateTime=0x1c4f5a0, ftLastAccessTime.dwHighDateTime=0x1d82a13, ftLastWriteTime.dwLowDateTime=0x1c4f5a0, ftLastWriteTime.dwHighDateTime=0x1d82a13, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0283.267] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11d24170, ftCreationTime.dwHighDateTime=0x1d8256b, ftLastAccessTime.dwLowDateTime=0xcc68e3f0, ftLastAccessTime.dwHighDateTime=0x1d8283a, ftLastWriteTime.dwLowDateTime=0xcc68e3f0, ftLastWriteTime.dwHighDateTime=0x1d8283a, nFileSizeHigh=0x0, nFileSizeLow=0x2a16, dwReserved0=0x0, dwReserved1=0x0, cFileName="8BmBuzkrBAz-1J-IShq.pdf", cAlternateFileName="8BMBUZ~1.PDF")) returned 1
	[0283.267] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1db45390, ftCreationTime.dwHighDateTime=0x1d827e9, ftLastAccessTime.dwLowDateTime=0xcaf05490, ftLastAccessTime.dwHighDateTime=0x1d82975, ftLastWriteTime.dwLowDateTime=0xcaf05490, ftLastWriteTime.dwHighDateTime=0x1d82975, nFileSizeHigh=0x0, nFileSizeLow=0x18cd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="fAbqQJxC6j.xls", cAlternateFileName="FABQQJ~1.XLS")) returned 1
	[0283.267] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x734f59f0, ftCreationTime.dwHighDateTime=0x1d82283, ftLastAccessTime.dwLowDateTime=0xc9bbe080, ftLastAccessTime.dwHighDateTime=0x1d82736, ftLastWriteTime.dwLowDateTime=0xc9bbe080, ftLastWriteTime.dwHighDateTime=0x1d82736, nFileSizeHigh=0x0, nFileSizeLow=0x12f9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="qb50fmMABVOmckG.docx", cAlternateFileName="QB50FM~1.DOC")) returned 1
	[0283.267] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c9970c0, ftCreationTime.dwHighDateTime=0x1d82508, ftLastAccessTime.dwLowDateTime=0x27662a30, ftLastAccessTime.dwHighDateTime=0x1d829a1, ftLastWriteTime.dwLowDateTime=0x27662a30, ftLastWriteTime.dwHighDateTime=0x1d829a1, nFileSizeHigh=0x0, nFileSizeLow=0x3a80, dwReserved0=0x0, dwReserved1=0x0, cFileName="R1iyoik0t.ppt", cAlternateFileName="R1IYOI~1.PPT")) returned 1
	[0283.267] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34aee270, ftCreationTime.dwHighDateTime=0x1d819ae, ftLastAccessTime.dwLowDateTime=0x51eec0b0, ftLastAccessTime.dwHighDateTime=0x1d81d20, ftLastWriteTime.dwLowDateTime=0x51eec0b0, ftLastWriteTime.dwHighDateTime=0x1d81d20, nFileSizeHigh=0x0, nFileSizeLow=0x858c, dwReserved0=0x0, dwReserved1=0x0, cFileName="r455COtDTUz9Fdj.docx", cAlternateFileName="R455CO~1.DOC")) returned 1
	[0283.267] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3320dd60, ftCreationTime.dwHighDateTime=0x1d8276d, ftLastAccessTime.dwLowDateTime=0xc98cc7b0, ftLastAccessTime.dwHighDateTime=0x1d827da, ftLastWriteTime.dwLowDateTime=0xc98cc7b0, ftLastWriteTime.dwHighDateTime=0x1d827da, nFileSizeHigh=0x0, nFileSizeLow=0xa88c, dwReserved0=0x0, dwReserved1=0x0, cFileName="sTfdrvnNNB6old.doc", cAlternateFileName="STFDRV~1.DOC")) returned 1
	[0283.267] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0283.267] FindClose (in: hFindFile=0x79fb68 | out: hFindFile=0x79fb68) returned 1
	[0283.267] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\LdD7S xtG\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\ldd7s xtg\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0283.268] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c04 | out: lpMode=0x12422c04) returned 0
	[0283.268] WriteFile (in: hFile=0x178, lpBuffer=0x12694000*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422bf4, lpOverlapped=0x0 | out: lpBuffer=0x12694000*, lpNumberOfBytesWritten=0x12422bf4*=0xc85, lpOverlapped=0x0) returned 1
	[0283.269] CloseHandle (hObject=0x178) returned 1
	[0283.269] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1253c000*, nNumberOfCharsToWrite=0x73, lpNumberOfCharsWritten=0x12422784, lpReserved=0x0 | out: lpBuffer=0x1253c000*, lpNumberOfCharsWritten=0x12422784*=0x73) returned 1
	[0283.281] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\LdD7S xtG\\8BmBuzkrBAz-1J-IShq.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\ldd7s xtg\\8bmbuzkrbaz-1j-ishq.pdf"), fInfoLevelId=0x0, lpFileInformation=0x124a6418 | out: lpFileInformation=0x124a6418*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11d24170, ftCreationTime.dwHighDateTime=0x1d8256b, ftLastAccessTime.dwLowDateTime=0xcc68e3f0, ftLastAccessTime.dwHighDateTime=0x1d8283a, ftLastWriteTime.dwLowDateTime=0xcc68e3f0, ftLastWriteTime.dwHighDateTime=0x1d8283a, nFileSizeHigh=0x0, nFileSizeLow=0x2a16)) returned 1
	[0283.282] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\LdD7S xtG\\8BmBuzkrBAz-1J-IShq.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\ldd7s xtg\\8bmbuzkrbaz-1j-ishq.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0283.282] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0283.282] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\LdD7S xtG\\8BmBuzkrBAz-1J-IShq.pdf.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\ldd7s xtg\\8bmbuzkrbaz-1j-ishq.pdf.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0283.282] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0283.283] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc680 | out: pbBuffer=0x123cc680) returned 1
	[0283.283] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c250 | out: pbBuffer=0x1251c250) returned 1
	[0283.283] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0401 | out: pbBuffer=0x123c0401) returned 1
	[0283.283] WriteFile (in: hFile=0x17c, lpBuffer=0x1250b000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422a5c, lpOverlapped=0x0 | out: lpBuffer=0x1250b000*, lpNumberOfBytesWritten=0x12422a5c*=0x80, lpOverlapped=0x0) returned 1
	[0283.285] SetEvent (hEvent=0x174) returned 1
	[0283.285] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422a4c*=0x2a16, lpOverlapped=0x0) returned 1
	[0283.287] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x2a16, lpNumberOfBytesWritten=0x12422a58, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422a58*=0x2a16, lpOverlapped=0x0) returned 1
	[0283.288] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422a4c*=0x0, lpOverlapped=0x0) returned 1
	[0283.289] CloseHandle (hObject=0x17c) returned 1
	[0283.293] CloseHandle (hObject=0x178) returned 1
	[0283.293] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1250c000*, nNumberOfCharsToWrite=0x75, lpNumberOfCharsWritten=0x12422710, lpReserved=0x0 | out: lpBuffer=0x1250c000*, lpNumberOfCharsWritten=0x12422710*=0x75) returned 1
	[0283.305] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0283.340] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\LdD7S xtG\\8BmBuzkrBAz-1J-IShq.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\ldd7s xtg\\8bmbuzkrbaz-1j-ishq.pdf")) returned 1
	[0283.347] SetEvent (hEvent=0x174) returned 1
	[0283.348] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0283.348] SetEvent (hEvent=0x174) returned 1
	[0283.348] SetEvent (hEvent=0x14c) returned 1
	[0283.348] SetEvent (hEvent=0x12c) returned 1
	[0283.348] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0283.349] SetEvent (hEvent=0x12c) returned 1
	[0283.371] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0283.371] SetEvent (hEvent=0x168) returned 1
	[0283.371] SetEvent (hEvent=0x12c) returned 1
	[0283.378] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0283.379] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0283.379] SetEvent (hEvent=0x12c) returned 1
	[0283.379] SetEvent (hEvent=0x14c) returned 1
	[0283.379] SetEvent (hEvent=0x174) returned 1
	[0283.379] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0283.379] SetEvent (hEvent=0x174) returned 1
	[0283.380] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\LdD7S xtG\\8BmBuzkrBAz-1J-IShq.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\ldd7s xtg\\8bmbuzkrbaz-1j-ishq.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0283.381] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b6c | out: lpMode=0x12422b6c) returned 0
	[0283.381] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422b5c, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422b5c*=0xfa000, lpOverlapped=0x0) returned 1
	[0283.410] CloseHandle (hObject=0x178) returned 1
	[0283.439] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\LdD7S xtG\\8BmBuzkrBAz-1J-IShq.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\ldd7s xtg\\8bmbuzkrbaz-1j-ishq.pdf")) returned 1
	[0283.451] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\LdD7S xtG\\R1iyoik0t.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\ldd7s xtg\\r1iyoik0t.ppt"), fInfoLevelId=0x0, lpFileInformation=0x124a6148 | out: lpFileInformation=0x124a6148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c9970c0, ftCreationTime.dwHighDateTime=0x1d82508, ftLastAccessTime.dwLowDateTime=0x27662a30, ftLastAccessTime.dwHighDateTime=0x1d829a1, ftLastWriteTime.dwLowDateTime=0x27662a30, ftLastWriteTime.dwHighDateTime=0x1d829a1, nFileSizeHigh=0x0, nFileSizeLow=0x3a80)) returned 1
	[0283.451] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\LdD7S xtG\\R1iyoik0t.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\ldd7s xtg\\r1iyoik0t.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0283.451] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0283.451] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\LdD7S xtG\\R1iyoik0t.ppt.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\ldd7s xtg\\r1iyoik0t.ppt.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0283.451] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0283.451] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc540 | out: pbBuffer=0x123cc540) returned 1
	[0283.452] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x12412220 | out: pbBuffer=0x12412220) returned 1
	[0283.452] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc181 | out: pbBuffer=0x123fc181) returned 1
	[0283.452] WriteFile (in: hFile=0x17c, lpBuffer=0x1253f000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422a5c, lpOverlapped=0x0 | out: lpBuffer=0x1253f000*, lpNumberOfBytesWritten=0x12422a5c*=0x80, lpOverlapped=0x0) returned 1
	[0283.454] SetEvent (hEvent=0x14c) returned 1
	[0283.454] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422a4c*=0x3a80, lpOverlapped=0x0) returned 1
	[0283.456] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x3a80, lpNumberOfBytesWritten=0x12422a58, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422a58*=0x3a80, lpOverlapped=0x0) returned 1
	[0283.458] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422a4c*=0x0, lpOverlapped=0x0) returned 1
	[0283.458] CloseHandle (hObject=0x17c) returned 1
	[0283.461] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0283.462] CloseHandle (hObject=0x178) returned 1
	[0283.462] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x127de000*, nNumberOfCharsToWrite=0x6b, lpNumberOfCharsWritten=0x12422710, lpReserved=0x0 | out: lpBuffer=0x127de000*, lpNumberOfCharsWritten=0x12422710*=0x6b) returned 1
	[0283.474] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\LdD7S xtG\\R1iyoik0t.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\ldd7s xtg\\r1iyoik0t.ppt")) returned 1
	[0283.480] SetEvent (hEvent=0x14c) returned 1
	[0283.481] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0283.482] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0283.482] SetEvent (hEvent=0x14c) returned 1
	[0283.482] SetEvent (hEvent=0x124) returned 1
	[0283.482] SetEvent (hEvent=0x12c) returned 1
	[0283.482] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0283.483] SetEvent (hEvent=0x12c) returned 1
	[0283.506] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0283.508] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0283.508] SetEvent (hEvent=0x168) returned 1
	[0283.508] SetEvent (hEvent=0x12c) returned 1
	[0283.510] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0283.511] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0283.511] SetEvent (hEvent=0x12c) returned 1
	[0283.511] SetEvent (hEvent=0x124) returned 1
	[0283.511] SetEvent (hEvent=0x14c) returned 1
	[0283.511] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0283.512] SetEvent (hEvent=0x14c) returned 1
	[0283.512] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\LdD7S xtG\\R1iyoik0t.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\ldd7s xtg\\r1iyoik0t.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0283.514] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b6c | out: lpMode=0x12422b6c) returned 0
	[0283.514] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422b5c, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422b5c*=0xfa000, lpOverlapped=0x0) returned 1
	[0283.536] CloseHandle (hObject=0x178) returned 1
	[0283.561] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\LdD7S xtG\\R1iyoik0t.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\ldd7s xtg\\r1iyoik0t.ppt")) returned 1
	[0283.574] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\LdD7S xtG\\fAbqQJxC6j.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\ldd7s xtg\\fabqqjxc6j.xls"), fInfoLevelId=0x0, lpFileInformation=0x124a61e8 | out: lpFileInformation=0x124a61e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1db45390, ftCreationTime.dwHighDateTime=0x1d827e9, ftLastAccessTime.dwLowDateTime=0xcaf05490, ftLastAccessTime.dwHighDateTime=0x1d82975, ftLastWriteTime.dwLowDateTime=0xcaf05490, ftLastWriteTime.dwHighDateTime=0x1d82975, nFileSizeHigh=0x0, nFileSizeLow=0x18cd8)) returned 1
	[0283.574] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\LdD7S xtG\\fAbqQJxC6j.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\ldd7s xtg\\fabqqjxc6j.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0283.574] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0283.574] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\LdD7S xtG\\fAbqQJxC6j.xls.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\ldd7s xtg\\fabqqjxc6j.xls.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0283.574] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0283.575] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc540 | out: pbBuffer=0x123cc540) returned 1
	[0283.575] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x12412220 | out: pbBuffer=0x12412220) returned 1
	[0283.575] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc081 | out: pbBuffer=0x123fc081) returned 1
	[0283.575] WriteFile (in: hFile=0x17c, lpBuffer=0x1253d000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422a5c, lpOverlapped=0x0 | out: lpBuffer=0x1253d000*, lpNumberOfBytesWritten=0x12422a5c*=0x80, lpOverlapped=0x0) returned 1
	[0283.577] SetEvent (hEvent=0x124) returned 1
	[0283.577] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422a4c*=0x18cd8, lpOverlapped=0x0) returned 1
	[0283.581] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x18cd8, lpNumberOfBytesWritten=0x12422a58, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422a58*=0x18cd8, lpOverlapped=0x0) returned 1
	[0283.585] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422a4c*=0x0, lpOverlapped=0x0) returned 1
	[0283.585] CloseHandle (hObject=0x17c) returned 1
	[0283.589] CloseHandle (hObject=0x178) returned 1
	[0283.589] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12510000*, nNumberOfCharsToWrite=0x6c, lpNumberOfCharsWritten=0x12422710, lpReserved=0x0 | out: lpBuffer=0x12510000*, lpNumberOfCharsWritten=0x12422710*=0x6c) returned 1
	[0283.601] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0283.603] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\LdD7S xtG\\fAbqQJxC6j.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\ldd7s xtg\\fabqqjxc6j.xls")) returned 1
	[0283.649] SetEvent (hEvent=0x124) returned 1
	[0283.651] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0283.651] SetEvent (hEvent=0x124) returned 1
	[0283.651] SetEvent (hEvent=0x174) returned 1
	[0283.651] SetEvent (hEvent=0x12c) returned 1
	[0283.651] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0283.652] SetEvent (hEvent=0x168) returned 1
	[0283.652] SetEvent (hEvent=0x12c) returned 1
	[0283.673] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0283.674] SetEvent (hEvent=0x12c) returned 1
	[0283.676] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0283.676] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0283.676] SetEvent (hEvent=0x12c) returned 1
	[0283.676] SetEvent (hEvent=0x174) returned 1
	[0283.676] SetEvent (hEvent=0x124) returned 1
	[0283.676] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0283.677] SetEvent (hEvent=0x124) returned 1
	[0283.677] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\LdD7S xtG\\fAbqQJxC6j.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\ldd7s xtg\\fabqqjxc6j.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0283.679] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b6c | out: lpMode=0x12422b6c) returned 0
	[0283.679] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422b5c, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422b5c*=0xfa000, lpOverlapped=0x0) returned 1
	[0283.701] CloseHandle (hObject=0x178) returned 1
	[0283.730] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\LdD7S xtG\\fAbqQJxC6j.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\ldd7s xtg\\fabqqjxc6j.xls")) returned 1
	[0283.747] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\LdD7S xtG\\qb50fmMABVOmckG.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\ldd7s xtg\\qb50fmmabvomckg.docx"), fInfoLevelId=0x0, lpFileInformation=0x124a6148 | out: lpFileInformation=0x124a6148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x734f59f0, ftCreationTime.dwHighDateTime=0x1d82283, ftLastAccessTime.dwLowDateTime=0xc9bbe080, ftLastAccessTime.dwHighDateTime=0x1d82736, ftLastWriteTime.dwLowDateTime=0xc9bbe080, ftLastWriteTime.dwHighDateTime=0x1d82736, nFileSizeHigh=0x0, nFileSizeLow=0x12f9e)) returned 1
	[0283.747] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\LdD7S xtG\\qb50fmMABVOmckG.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\ldd7s xtg\\qb50fmmabvomckg.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0283.747] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0283.748] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\LdD7S xtG\\qb50fmMABVOmckG.docx.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\ldd7s xtg\\qb50fmmabvomckg.docx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0283.748] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0283.748] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc540 | out: pbBuffer=0x123cc540) returned 1
	[0283.748] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c120 | out: pbBuffer=0x1251c120) returned 1
	[0283.748] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc181 | out: pbBuffer=0x123fc181) returned 1
	[0283.749] WriteFile (in: hFile=0x17c, lpBuffer=0x1253f000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422a5c, lpOverlapped=0x0 | out: lpBuffer=0x1253f000*, lpNumberOfBytesWritten=0x12422a5c*=0x80, lpOverlapped=0x0) returned 1
	[0283.752] SetEvent (hEvent=0x174) returned 1
	[0283.752] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422a4c*=0x12f9e, lpOverlapped=0x0) returned 1
	[0283.756] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x12f9e, lpNumberOfBytesWritten=0x12422a58, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422a58*=0x12f9e, lpOverlapped=0x0) returned 1
	[0283.777] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0283.779] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422a4c*=0x0, lpOverlapped=0x0) returned 1
	[0283.779] CloseHandle (hObject=0x17c) returned 1
	[0283.782] CloseHandle (hObject=0x178) returned 1
	[0283.782] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12536000*, nNumberOfCharsToWrite=0x72, lpNumberOfCharsWritten=0x12422710, lpReserved=0x0 | out: lpBuffer=0x12536000*, lpNumberOfCharsWritten=0x12422710*=0x72) returned 1
	[0283.797] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\LdD7S xtG\\qb50fmMABVOmckG.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\ldd7s xtg\\qb50fmmabvomckg.docx")) returned 1
	[0283.807] SetEvent (hEvent=0x174) returned 1
	[0283.814] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0283.815] SetEvent (hEvent=0x174) returned 1
	[0283.815] SetEvent (hEvent=0x14c) returned 1
	[0283.815] SetEvent (hEvent=0x12c) returned 1
	[0283.815] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0283.815] SetEvent (hEvent=0x168) returned 1
	[0283.815] SetEvent (hEvent=0x12c) returned 1
	[0283.850] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0283.852] SetEvent (hEvent=0x12c) returned 1
	[0283.855] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0283.855] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0283.856] SetEvent (hEvent=0x12c) returned 1
	[0283.856] SetEvent (hEvent=0x14c) returned 1
	[0283.856] SetEvent (hEvent=0x174) returned 1
	[0283.856] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0283.856] SetEvent (hEvent=0x174) returned 1
	[0283.857] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\LdD7S xtG\\qb50fmMABVOmckG.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\ldd7s xtg\\qb50fmmabvomckg.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0283.858] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b6c | out: lpMode=0x12422b6c) returned 0
	[0283.858] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422b5c, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422b5c*=0xfa000, lpOverlapped=0x0) returned 1
	[0283.885] CloseHandle (hObject=0x178) returned 1
	[0283.921] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\LdD7S xtG\\qb50fmMABVOmckG.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\ldd7s xtg\\qb50fmmabvomckg.docx")) returned 1
	[0283.932] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\LdD7S xtG\\r455COtDTUz9Fdj.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\ldd7s xtg\\r455cotdtuz9fdj.docx"), fInfoLevelId=0x0, lpFileInformation=0x124a61e8 | out: lpFileInformation=0x124a61e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34aee270, ftCreationTime.dwHighDateTime=0x1d819ae, ftLastAccessTime.dwLowDateTime=0x51eec0b0, ftLastAccessTime.dwHighDateTime=0x1d81d20, ftLastWriteTime.dwLowDateTime=0x51eec0b0, ftLastWriteTime.dwHighDateTime=0x1d81d20, nFileSizeHigh=0x0, nFileSizeLow=0x858c)) returned 1
	[0283.932] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\LdD7S xtG\\r455COtDTUz9Fdj.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\ldd7s xtg\\r455cotdtuz9fdj.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0283.932] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0283.932] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\LdD7S xtG\\r455COtDTUz9Fdj.docx.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\ldd7s xtg\\r455cotdtuz9fdj.docx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0283.933] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0283.933] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc540 | out: pbBuffer=0x123cc540) returned 1
	[0283.933] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c120 | out: pbBuffer=0x1251c120) returned 1
	[0283.933] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc181 | out: pbBuffer=0x123fc181) returned 1
	[0283.933] WriteFile (in: hFile=0x17c, lpBuffer=0x1253d000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422a5c, lpOverlapped=0x0 | out: lpBuffer=0x1253d000*, lpNumberOfBytesWritten=0x12422a5c*=0x80, lpOverlapped=0x0) returned 1
	[0283.935] SetEvent (hEvent=0x14c) returned 1
	[0283.935] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422a4c*=0x858c, lpOverlapped=0x0) returned 1
	[0283.937] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x858c, lpNumberOfBytesWritten=0x12422a58, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422a58*=0x858c, lpOverlapped=0x0) returned 1
	[0283.940] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422a4c*=0x0, lpOverlapped=0x0) returned 1
	[0283.940] CloseHandle (hObject=0x17c) returned 1
	[0283.942] CloseHandle (hObject=0x178) returned 1
	[0283.942] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12510000*, nNumberOfCharsToWrite=0x72, lpNumberOfCharsWritten=0x12422710, lpReserved=0x0 | out: lpBuffer=0x12510000*, lpNumberOfCharsWritten=0x12422710*=0x72) returned 1
	[0283.958] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0283.962] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\LdD7S xtG\\r455COtDTUz9Fdj.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\ldd7s xtg\\r455cotdtuz9fdj.docx")) returned 1
	[0283.990] SetEvent (hEvent=0x14c) returned 1
	[0283.993] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0283.995] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0283.995] SetEvent (hEvent=0x14c) returned 1
	[0283.995] SetEvent (hEvent=0x124) returned 1
	[0283.995] SetEvent (hEvent=0x12c) returned 1
	[0283.995] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0283.995] SetEvent (hEvent=0x12c) returned 1
	[0284.029] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0284.030] SetEvent (hEvent=0x168) returned 1
	[0284.030] SetEvent (hEvent=0x12c) returned 1
	[0284.033] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0284.033] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0284.034] SetEvent (hEvent=0x12c) returned 1
	[0284.034] SetEvent (hEvent=0x124) returned 1
	[0284.034] SetEvent (hEvent=0x14c) returned 1
	[0284.034] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0284.034] SetEvent (hEvent=0x14c) returned 1
	[0284.035] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\LdD7S xtG\\r455COtDTUz9Fdj.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\ldd7s xtg\\r455cotdtuz9fdj.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0284.037] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b6c | out: lpMode=0x12422b6c) returned 0
	[0284.037] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422b5c, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422b5c*=0xfa000, lpOverlapped=0x0) returned 1
	[0284.066] CloseHandle (hObject=0x178) returned 1
	[0284.098] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\LdD7S xtG\\r455COtDTUz9Fdj.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\ldd7s xtg\\r455cotdtuz9fdj.docx")) returned 1
	[0284.118] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\LdD7S xtG\\sTfdrvnNNB6old.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\ldd7s xtg\\stfdrvnnnb6old.doc"), fInfoLevelId=0x0, lpFileInformation=0x124a6148 | out: lpFileInformation=0x124a6148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3320dd60, ftCreationTime.dwHighDateTime=0x1d8276d, ftLastAccessTime.dwLowDateTime=0xc98cc7b0, ftLastAccessTime.dwHighDateTime=0x1d827da, ftLastWriteTime.dwLowDateTime=0xc98cc7b0, ftLastWriteTime.dwHighDateTime=0x1d827da, nFileSizeHigh=0x0, nFileSizeLow=0xa88c)) returned 1
	[0284.118] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\LdD7S xtG\\sTfdrvnNNB6old.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\ldd7s xtg\\stfdrvnnnb6old.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0284.118] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0284.119] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\LdD7S xtG\\sTfdrvnNNB6old.doc.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\ldd7s xtg\\stfdrvnnnb6old.doc.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0284.119] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0284.119] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc540 | out: pbBuffer=0x123cc540) returned 1
	[0284.119] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x12412220 | out: pbBuffer=0x12412220) returned 1
	[0284.119] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0301 | out: pbBuffer=0x123c0301) returned 1
	[0284.119] WriteFile (in: hFile=0x17c, lpBuffer=0x1253d000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422a5c, lpOverlapped=0x0 | out: lpBuffer=0x1253d000*, lpNumberOfBytesWritten=0x12422a5c*=0x80, lpOverlapped=0x0) returned 1
	[0284.123] SetEvent (hEvent=0x124) returned 1
	[0284.123] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422a4c*=0xa88c, lpOverlapped=0x0) returned 1
	[0284.127] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0xa88c, lpNumberOfBytesWritten=0x12422a58, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422a58*=0xa88c, lpOverlapped=0x0) returned 1
	[0284.131] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422a4c*=0x0, lpOverlapped=0x0) returned 1
	[0284.131] CloseHandle (hObject=0x17c) returned 1
	[0284.134] CloseHandle (hObject=0x178) returned 1
	[0284.134] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12510000*, nNumberOfCharsToWrite=0x70, lpNumberOfCharsWritten=0x12422710, lpReserved=0x0 | out: lpBuffer=0x12510000*, lpNumberOfCharsWritten=0x12422710*=0x70) returned 1
	[0284.149] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0284.151] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\LdD7S xtG\\sTfdrvnNNB6old.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\ldd7s xtg\\stfdrvnnnb6old.doc")) returned 1
	[0284.164] SetEvent (hEvent=0x124) returned 1
	[0284.166] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0284.167] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0284.167] SetEvent (hEvent=0x124) returned 1
	[0284.167] SetEvent (hEvent=0x174) returned 1
	[0284.167] SetEvent (hEvent=0x12c) returned 1
	[0284.167] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0284.168] SetEvent (hEvent=0x12c) returned 1
	[0284.200] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0284.203] SetEvent (hEvent=0x168) returned 1
	[0284.203] SetEvent (hEvent=0x12c) returned 1
	[0284.207] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0284.209] SetEvent (hEvent=0x174) returned 1
	[0284.209] SetEvent (hEvent=0x124) returned 1
	[0284.209] SetEvent (hEvent=0x14c) returned 1
	[0284.209] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0284.210] SetEvent (hEvent=0x168) returned 1
	[0284.210] SetEvent (hEvent=0x14c) returned 1
	[0284.210] SetEvent (hEvent=0x12c) returned 1
	[0284.211] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0284.290] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0284.350] SetEvent (hEvent=0x14c) returned 1
	[0284.350] SetEvent (hEvent=0x124) returned 1
	[0284.350] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0284.377] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0284.377] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0284.383] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0284.383] SetEvent (hEvent=0x14c) returned 1
	[0284.383] SetEvent (hEvent=0x124) returned 1
	[0284.383] SetEvent (hEvent=0x174) returned 1
	[0284.383] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0284.387] SetEvent (hEvent=0x168) returned 1
	[0284.387] SetEvent (hEvent=0x174) returned 1
	[0284.387] SetEvent (hEvent=0x12c) returned 1
	[0284.387] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0284.388] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0284.398] SetEvent (hEvent=0x12c) returned 1
	[0284.398] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0284.398] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0284.440] SetEvent (hEvent=0x12c) returned 1
	[0284.440] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0284.443] SetEvent (hEvent=0x124) returned 1
	[0284.443] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0284.534] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0284.535] SetEvent (hEvent=0x124) returned 1
	[0284.535] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0284.535] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0284.669] SetEvent (hEvent=0x14c) returned 1
	[0284.669] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0284.671] SetEvent (hEvent=0x14c) returned 1
	[0284.672] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0284.699] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0284.729] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0284.780] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0284.800] SetEvent (hEvent=0x14c) returned 1
	[0284.800] SetEvent (hEvent=0x174) returned 1
	[0284.800] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0284.818] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0284.818] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0284.819] SetEvent (hEvent=0x14c) returned 1
	[0284.819] SetEvent (hEvent=0x174) returned 1
	[0284.819] SetEvent (hEvent=0x124) returned 1
	[0284.819] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0284.820] SetEvent (hEvent=0x168) returned 1
	[0284.820] SetEvent (hEvent=0x124) returned 1
	[0284.820] SetEvent (hEvent=0x12c) returned 1
	[0284.820] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0284.821] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0284.834] SetEvent (hEvent=0x12c) returned 1
	[0284.834] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0284.836] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0284.864] SetEvent (hEvent=0x12c) returned 1
	[0284.864] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0284.865] SetEvent (hEvent=0x124) returned 1
	[0284.865] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0284.993] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0284.994] SetEvent (hEvent=0x124) returned 1
	[0284.994] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0284.994] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0285.167] SetEvent (hEvent=0x14c) returned 1
	[0285.167] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0285.174] SetEvent (hEvent=0x14c) returned 1
	[0285.174] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0285.184] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0285.208] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0285.262] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0285.282] SetEvent (hEvent=0x14c) returned 1
	[0285.283] SetEvent (hEvent=0x174) returned 1
	[0285.283] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0285.304] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0285.304] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0285.305] SetEvent (hEvent=0x14c) returned 1
	[0285.305] SetEvent (hEvent=0x174) returned 1
	[0285.305] SetEvent (hEvent=0x124) returned 1
	[0285.305] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0285.305] SetEvent (hEvent=0x168) returned 1
	[0285.305] SetEvent (hEvent=0x124) returned 1
	[0285.305] SetEvent (hEvent=0x12c) returned 1
	[0285.305] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0285.306] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0285.313] SetEvent (hEvent=0x12c) returned 1
	[0285.313] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0285.313] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0285.376] SetEvent (hEvent=0x12c) returned 1
	[0285.376] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0285.377] SetEvent (hEvent=0x124) returned 1
	[0285.377] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0285.583] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0285.585] SetEvent (hEvent=0x124) returned 1
	[0285.585] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0285.585] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0285.749] SetEvent (hEvent=0x14c) returned 1
	[0285.749] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0285.750] SetEvent (hEvent=0x14c) returned 1
	[0285.750] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0285.762] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0285.790] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0285.827] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0285.860] SetEvent (hEvent=0x14c) returned 1
	[0285.860] SetEvent (hEvent=0x174) returned 1
	[0285.860] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0285.875] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0285.876] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0285.876] SetEvent (hEvent=0x14c) returned 1
	[0285.876] SetEvent (hEvent=0x174) returned 1
	[0285.876] SetEvent (hEvent=0x124) returned 1
	[0285.876] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0285.877] SetEvent (hEvent=0x124) returned 1
	[0285.877] SetEvent (hEvent=0x12c) returned 1
	[0285.877] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0285.878] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0285.886] SetEvent (hEvent=0x12c) returned 1
	[0285.886] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0285.886] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0285.912] SetEvent (hEvent=0x12c) returned 1
	[0285.912] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0285.914] SetEvent (hEvent=0x124) returned 1
	[0285.914] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0285.993] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0285.994] SetEvent (hEvent=0x124) returned 1
	[0285.994] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0285.994] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0286.153] SetEvent (hEvent=0x14c) returned 1
	[0286.153] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0286.154] SetEvent (hEvent=0x14c) returned 1
	[0286.154] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0286.171] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0286.234] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0286.299] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0286.389] SetEvent (hEvent=0x14c) returned 1
	[0286.390] SetEvent (hEvent=0x174) returned 1
	[0286.390] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0286.418] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0286.418] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0286.420] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0286.420] SetEvent (hEvent=0x14c) returned 1
	[0286.420] SetEvent (hEvent=0x174) returned 1
	[0286.420] SetEvent (hEvent=0x124) returned 1
	[0286.420] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0286.424] SetEvent (hEvent=0x168) returned 1
	[0286.425] SetEvent (hEvent=0x124) returned 1
	[0286.425] SetEvent (hEvent=0x12c) returned 1
	[0286.425] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0286.426] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0286.450] SetEvent (hEvent=0x12c) returned 1
	[0286.450] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0286.450] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0286.524] SetEvent (hEvent=0x12c) returned 1
	[0286.524] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0286.527] SetEvent (hEvent=0x124) returned 1
	[0286.527] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0286.636] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0286.637] SetEvent (hEvent=0x124) returned 1
	[0286.638] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0286.638] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0286.778] SetEvent (hEvent=0x14c) returned 1
	[0286.778] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0286.778] SetEvent (hEvent=0x14c) returned 1
	[0286.778] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0286.789] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0286.818] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0286.872] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0286.889] SetEvent (hEvent=0x14c) returned 1
	[0286.890] SetEvent (hEvent=0x174) returned 1
	[0286.890] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0286.906] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0286.906] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0286.907] SetEvent (hEvent=0x14c) returned 1
	[0286.907] SetEvent (hEvent=0x174) returned 1
	[0286.907] SetEvent (hEvent=0x124) returned 1
	[0286.907] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0286.907] SetEvent (hEvent=0x124) returned 1
	[0286.907] SetEvent (hEvent=0x12c) returned 1
	[0286.907] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0286.908] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0286.916] SetEvent (hEvent=0x12c) returned 1
	[0286.916] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0286.916] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0286.944] SetEvent (hEvent=0x12c) returned 1
	[0286.944] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0286.945] SetEvent (hEvent=0x124) returned 1
	[0286.945] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0287.040] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0287.041] SetEvent (hEvent=0x124) returned 1
	[0287.041] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0287.042] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0287.170] SetEvent (hEvent=0x14c) returned 1
	[0287.170] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0287.170] SetEvent (hEvent=0x14c) returned 1
	[0287.170] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0287.178] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0287.206] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0287.263] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0287.285] SetEvent (hEvent=0x14c) returned 1
	[0287.285] SetEvent (hEvent=0x174) returned 1
	[0287.285] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0287.306] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0287.306] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0287.306] SetEvent (hEvent=0x14c) returned 1
	[0287.306] SetEvent (hEvent=0x174) returned 1
	[0287.307] SetEvent (hEvent=0x124) returned 1
	[0287.307] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0287.307] SetEvent (hEvent=0x124) returned 1
	[0287.307] SetEvent (hEvent=0x12c) returned 1
	[0287.307] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0287.308] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0287.351] SetEvent (hEvent=0x12c) returned 1
	[0287.351] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0287.353] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0287.378] SetEvent (hEvent=0x12c) returned 1
	[0287.378] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0287.383] SetEvent (hEvent=0x124) returned 1
	[0287.383] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0287.469] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0287.470] SetEvent (hEvent=0x124) returned 1
	[0287.470] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0287.470] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0287.667] SetEvent (hEvent=0x14c) returned 1
	[0287.667] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0287.668] SetEvent (hEvent=0x14c) returned 1
	[0287.668] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0287.690] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0287.715] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0287.757] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0287.785] SetEvent (hEvent=0x14c) returned 1
	[0287.785] SetEvent (hEvent=0x174) returned 1
	[0287.785] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0287.803] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0287.804] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0287.805] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0287.805] SetEvent (hEvent=0x14c) returned 1
	[0287.805] SetEvent (hEvent=0x174) returned 1
	[0287.805] SetEvent (hEvent=0x124) returned 1
	[0287.805] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0287.806] SetEvent (hEvent=0x168) returned 1
	[0287.806] SetEvent (hEvent=0x124) returned 1
	[0287.806] SetEvent (hEvent=0x12c) returned 1
	[0287.806] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0287.808] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0287.815] SetEvent (hEvent=0x12c) returned 1
	[0287.815] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0287.816] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0287.870] SetEvent (hEvent=0x12c) returned 1
	[0287.870] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0287.872] SetEvent (hEvent=0x124) returned 1
	[0287.872] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0287.984] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0287.984] SetEvent (hEvent=0x124) returned 1
	[0287.984] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0287.985] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0288.124] SetEvent (hEvent=0x124) returned 1
	[0288.124] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0288.124] SetEvent (hEvent=0x124) returned 1
	[0288.125] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0288.141] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0288.179] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0288.208] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0288.242] SetEvent (hEvent=0x124) returned 1
	[0288.242] SetEvent (hEvent=0x174) returned 1
	[0288.242] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0288.259] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0288.260] SetEvent (hEvent=0x124) returned 1
	[0288.260] SetEvent (hEvent=0x174) returned 1
	[0288.260] SetEvent (hEvent=0x14c) returned 1
	[0288.260] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0288.260] SetEvent (hEvent=0x168) returned 1
	[0288.260] SetEvent (hEvent=0x14c) returned 1
	[0288.261] SetEvent (hEvent=0x12c) returned 1
	[0288.261] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0288.265] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0288.274] SetEvent (hEvent=0x12c) returned 1
	[0288.274] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0288.274] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0288.308] SetEvent (hEvent=0x12c) returned 1
	[0288.308] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0288.310] SetEvent (hEvent=0x14c) returned 1
	[0288.310] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0288.366] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0288.371] SetEvent (hEvent=0x14c) returned 1
	[0288.371] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0288.380] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0288.527] SetEvent (hEvent=0x124) returned 1
	[0288.527] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0288.535] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0288.605] SetEvent (hEvent=0x12c) returned 1
	[0288.605] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0288.606] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0288.632] SetEvent (hEvent=0x12c) returned 1
	[0288.633] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0288.634] SetEvent (hEvent=0x124) returned 1
	[0288.634] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0288.774] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0288.774] SetEvent (hEvent=0x124) returned 1
	[0288.774] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0288.774] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0289.117] SetEvent (hEvent=0x124) returned 1
	[0289.117] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0289.119] SetEvent (hEvent=0x124) returned 1
	[0289.119] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0289.135] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0289.176] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0289.208] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0289.250] SetEvent (hEvent=0x124) returned 1
	[0289.250] SetEvent (hEvent=0x174) returned 1
	[0289.250] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0289.261] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0289.261] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0289.262] SetEvent (hEvent=0x124) returned 1
	[0289.262] SetEvent (hEvent=0x174) returned 1
	[0289.263] SetEvent (hEvent=0x14c) returned 1
	[0289.263] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0289.263] SetEvent (hEvent=0x168) returned 1
	[0289.263] SetEvent (hEvent=0x14c) returned 1
	[0289.263] SetEvent (hEvent=0x12c) returned 1
	[0289.263] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0289.264] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0289.271] SetEvent (hEvent=0x12c) returned 1
	[0289.271] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0289.271] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0289.307] SetEvent (hEvent=0x12c) returned 1
	[0289.307] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0289.308] SetEvent (hEvent=0x14c) returned 1
	[0289.308] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0289.339] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0289.339] SetEvent (hEvent=0x14c) returned 1
	[0289.339] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0289.339] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0289.500] SetEvent (hEvent=0x14c) returned 1
	[0289.500] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0289.500] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0289.552] SetEvent (hEvent=0x12c) returned 1
	[0289.552] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0289.553] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0289.582] SetEvent (hEvent=0x12c) returned 1
	[0289.582] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0289.584] SetEvent (hEvent=0x14c) returned 1
	[0289.584] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0289.710] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0289.711] SetEvent (hEvent=0x14c) returned 1
	[0289.711] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0289.711] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0289.809] SetEvent (hEvent=0x124) returned 1
	[0289.809] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0289.810] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0289.876] SetEvent (hEvent=0x12c) returned 1
	[0289.876] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0289.876] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0289.905] SetEvent (hEvent=0x12c) returned 1
	[0289.905] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0289.906] SetEvent (hEvent=0x124) returned 1
	[0289.906] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0289.939] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0289.940] SetEvent (hEvent=0x124) returned 1
	[0289.940] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0289.940] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0290.294] SetEvent (hEvent=0x124) returned 1
	[0290.294] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0290.294] SetEvent (hEvent=0x124) returned 1
	[0290.295] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0290.315] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0290.339] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0290.362] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0290.387] SetEvent (hEvent=0x124) returned 1
	[0290.388] SetEvent (hEvent=0x174) returned 1
	[0290.388] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0290.388] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0290.388] SetEvent (hEvent=0x124) returned 1
	[0290.388] SetEvent (hEvent=0x174) returned 1
	[0290.388] SetEvent (hEvent=0x14c) returned 1
	[0290.388] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0290.389] SetEvent (hEvent=0x168) returned 1
	[0290.389] SetEvent (hEvent=0x14c) returned 1
	[0290.389] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0290.470] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0290.496] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0290.520] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0290.532] SetEvent (hEvent=0x14c) returned 1
	[0290.532] SetEvent (hEvent=0x174) returned 1
	[0290.533] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0290.533] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0290.533] SetEvent (hEvent=0x14c) returned 1
	[0290.533] SetEvent (hEvent=0x174) returned 1
	[0290.533] SetEvent (hEvent=0x124) returned 1
	[0290.533] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0290.534] SetEvent (hEvent=0x124) returned 1
	[0290.534] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0290.671] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0290.697] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0290.723] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0290.733] SetEvent (hEvent=0x124) returned 1
	[0290.733] SetEvent (hEvent=0x174) returned 1
	[0290.733] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0290.734] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0290.734] SetEvent (hEvent=0x124) returned 1
	[0290.734] SetEvent (hEvent=0x174) returned 1
	[0290.734] SetEvent (hEvent=0x14c) returned 1
	[0290.734] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0290.735] SetEvent (hEvent=0x168) returned 1
	[0290.735] SetEvent (hEvent=0x14c) returned 1
	[0290.735] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0290.820] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0290.848] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0290.872] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0290.883] SetEvent (hEvent=0x14c) returned 1
	[0290.884] SetEvent (hEvent=0x174) returned 1
	[0290.884] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0290.884] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0290.885] SetEvent (hEvent=0x14c) returned 1
	[0290.885] SetEvent (hEvent=0x174) returned 1
	[0290.885] SetEvent (hEvent=0x124) returned 1
	[0290.885] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0290.885] SetEvent (hEvent=0x124) returned 1
	[0290.885] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0290.925] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0290.952] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0290.963] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0290.987] SetEvent (hEvent=0x124) returned 1
	[0290.987] SetEvent (hEvent=0x174) returned 1
	[0290.987] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0290.988] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0290.988] SetEvent (hEvent=0x124) returned 1
	[0290.988] SetEvent (hEvent=0x174) returned 1
	[0290.988] SetEvent (hEvent=0x14c) returned 1
	[0290.988] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0290.988] SetEvent (hEvent=0x168) returned 1
	[0290.988] SetEvent (hEvent=0x14c) returned 1
	[0290.989] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.083] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.111] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.136] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.163] SetEvent (hEvent=0x14c) returned 1
	[0291.163] SetEvent (hEvent=0x174) returned 1
	[0291.163] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0291.181] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.181] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0291.181] SetEvent (hEvent=0x14c) returned 1
	[0291.181] SetEvent (hEvent=0x174) returned 1
	[0291.181] SetEvent (hEvent=0x124) returned 1
	[0291.181] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.182] SetEvent (hEvent=0x124) returned 1
	[0291.182] SetEvent (hEvent=0x12c) returned 1
	[0291.182] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.183] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.194] SetEvent (hEvent=0x12c) returned 1
	[0291.195] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.195] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.264] SetEvent (hEvent=0x12c) returned 1
	[0291.264] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.266] SetEvent (hEvent=0x124) returned 1
	[0291.266] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.311] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.312] SetEvent (hEvent=0x124) returned 1
	[0291.312] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.312] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.397] SetEvent (hEvent=0x14c) returned 1
	[0291.397] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.398] SetEvent (hEvent=0x14c) returned 1
	[0291.398] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.409] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.489] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.517] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.534] SetEvent (hEvent=0x14c) returned 1
	[0291.535] SetEvent (hEvent=0x174) returned 1
	[0291.535] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0291.548] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.548] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0291.551] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.551] SetEvent (hEvent=0x14c) returned 1
	[0291.551] SetEvent (hEvent=0x174) returned 1
	[0291.552] SetEvent (hEvent=0x124) returned 1
	[0291.552] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.552] SetEvent (hEvent=0x168) returned 1
	[0291.552] SetEvent (hEvent=0x124) returned 1
	[0291.552] SetEvent (hEvent=0x12c) returned 1
	[0291.552] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.553] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.560] SetEvent (hEvent=0x12c) returned 1
	[0291.560] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.560] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.589] SetEvent (hEvent=0x12c) returned 1
	[0291.589] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.591] SetEvent (hEvent=0x124) returned 1
	[0291.591] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.632] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.633] SetEvent (hEvent=0x124) returned 1
	[0291.633] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.634] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.744] SetEvent (hEvent=0x14c) returned 1
	[0291.744] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.745] SetEvent (hEvent=0x14c) returned 1
	[0291.745] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.755] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.785] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.808] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.820] SetEvent (hEvent=0x14c) returned 1
	[0291.820] SetEvent (hEvent=0x174) returned 1
	[0291.820] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0291.832] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.832] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0291.834] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.834] SetEvent (hEvent=0x14c) returned 1
	[0291.834] SetEvent (hEvent=0x174) returned 1
	[0291.834] SetEvent (hEvent=0x124) returned 1
	[0291.834] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.835] SetEvent (hEvent=0x168) returned 1
	[0291.835] SetEvent (hEvent=0x124) returned 1
	[0291.835] SetEvent (hEvent=0x12c) returned 1
	[0291.835] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.836] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.843] SetEvent (hEvent=0x12c) returned 1
	[0291.843] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.843] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.884] SetEvent (hEvent=0x12c) returned 1
	[0291.884] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0291.886] SetEvent (hEvent=0x124) returned 1
	[0291.886] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0292.049] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0292.049] SetEvent (hEvent=0x124) returned 1
	[0292.049] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0292.050] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0292.651] SetEvent (hEvent=0x124) returned 1
	[0292.651] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0292.652] SetEvent (hEvent=0x124) returned 1
	[0292.652] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0292.664] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0292.710] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0292.736] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0292.771] SetEvent (hEvent=0x124) returned 1
	[0292.772] SetEvent (hEvent=0x174) returned 1
	[0292.772] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0292.792] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0292.792] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0292.793] SetEvent (hEvent=0x124) returned 1
	[0292.793] SetEvent (hEvent=0x174) returned 1
	[0292.793] SetEvent (hEvent=0x14c) returned 1
	[0292.793] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0292.793] SetEvent (hEvent=0x168) returned 1
	[0292.793] SetEvent (hEvent=0x14c) returned 1
	[0292.793] SetEvent (hEvent=0x12c) returned 1
	[0292.793] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0292.795] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0292.803] SetEvent (hEvent=0x12c) returned 1
	[0292.803] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0292.803] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0292.836] SetEvent (hEvent=0x12c) returned 1
	[0292.836] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0292.838] SetEvent (hEvent=0x14c) returned 1
	[0292.838] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0292.882] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0292.883] SetEvent (hEvent=0x14c) returned 1
	[0292.883] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0292.887] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.009] SetEvent (hEvent=0x124) returned 1
	[0293.009] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.010] SetEvent (hEvent=0x124) returned 1
	[0293.010] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.021] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.048] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.071] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.081] SetEvent (hEvent=0x124) returned 1
	[0293.082] SetEvent (hEvent=0x174) returned 1
	[0293.082] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0293.093] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.093] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0293.094] SetEvent (hEvent=0x124) returned 1
	[0293.094] SetEvent (hEvent=0x174) returned 1
	[0293.094] SetEvent (hEvent=0x14c) returned 1
	[0293.094] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.094] SetEvent (hEvent=0x168) returned 1
	[0293.095] SetEvent (hEvent=0x14c) returned 1
	[0293.095] SetEvent (hEvent=0x12c) returned 1
	[0293.095] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.096] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.104] SetEvent (hEvent=0x12c) returned 1
	[0293.104] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.104] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.132] SetEvent (hEvent=0x12c) returned 1
	[0293.133] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.148] SetEvent (hEvent=0x14c) returned 1
	[0293.148] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.201] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.202] SetEvent (hEvent=0x14c) returned 1
	[0293.202] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.203] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.314] SetEvent (hEvent=0x124) returned 1
	[0293.314] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.315] SetEvent (hEvent=0x124) returned 1
	[0293.315] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.374] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.377] SetEvent (hEvent=0x124) returned 1
	[0293.377] SetEvent (hEvent=0x12c) returned 1
	[0293.377] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.378] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.403] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.457] SetEvent (hEvent=0x174) returned 1
	[0293.458] SetEvent (hEvent=0x12c) returned 1
	[0293.458] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0293.475] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.475] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0293.475] SetEvent (hEvent=0x174) returned 1
	[0293.475] SetEvent (hEvent=0x12c) returned 1
	[0293.475] SetEvent (hEvent=0x14c) returned 1
	[0293.476] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.476] SetEvent (hEvent=0x168) returned 1
	[0293.476] SetEvent (hEvent=0x14c) returned 1
	[0293.476] SetEvent (hEvent=0x124) returned 1
	[0293.476] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.478] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.491] SetEvent (hEvent=0x124) returned 1
	[0293.491] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.492] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.520] SetEvent (hEvent=0x124) returned 1
	[0293.520] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.522] SetEvent (hEvent=0x14c) returned 1
	[0293.522] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.614] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.615] SetEvent (hEvent=0x14c) returned 1
	[0293.615] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.616] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.718] SetEvent (hEvent=0x174) returned 1
	[0293.719] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.719] SetEvent (hEvent=0x174) returned 1
	[0293.719] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.747] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.774] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.775] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.807] SetEvent (hEvent=0x174) returned 1
	[0293.807] SetEvent (hEvent=0x12c) returned 1
	[0293.807] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0293.821] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.821] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0293.822] SetEvent (hEvent=0x174) returned 1
	[0293.822] SetEvent (hEvent=0x12c) returned 1
	[0293.822] SetEvent (hEvent=0x14c) returned 1
	[0293.822] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.822] SetEvent (hEvent=0x14c) returned 1
	[0293.822] SetEvent (hEvent=0x124) returned 1
	[0293.822] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.824] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.831] SetEvent (hEvent=0x124) returned 1
	[0293.831] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.831] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.864] SetEvent (hEvent=0x124) returned 1
	[0293.864] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0293.866] SetEvent (hEvent=0x14c) returned 1
	[0293.866] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0294.002] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0294.004] SetEvent (hEvent=0x14c) returned 1
	[0294.004] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0294.005] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0294.163] SetEvent (hEvent=0x174) returned 1
	[0294.163] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0294.163] SetEvent (hEvent=0x174) returned 1
	[0294.163] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0294.182] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0294.232] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0294.253] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0294.264] SetEvent (hEvent=0x174) returned 1
	[0294.265] SetEvent (hEvent=0x12c) returned 1
	[0294.265] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0294.277] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0294.277] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0294.278] SetEvent (hEvent=0x174) returned 1
	[0294.278] SetEvent (hEvent=0x12c) returned 1
	[0294.278] SetEvent (hEvent=0x14c) returned 1
	[0294.278] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0294.279] SetEvent (hEvent=0x168) returned 1
	[0294.279] SetEvent (hEvent=0x14c) returned 1
	[0294.279] SetEvent (hEvent=0x124) returned 1
	[0294.279] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0294.283] SetEvent (hEvent=0x124) returned 1
	[0294.283] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0294.285] SetEvent (hEvent=0x124) returned 1
	[0294.285] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0294.285] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0294.333] SetEvent (hEvent=0x124) returned 1
	[0294.333] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0294.334] SetEvent (hEvent=0x14c) returned 1
	[0294.334] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0294.384] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0294.384] SetEvent (hEvent=0x14c) returned 1
	[0294.384] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0294.385] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0294.533] SetEvent (hEvent=0x174) returned 1
	[0294.533] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0294.535] SetEvent (hEvent=0x174) returned 1
	[0294.535] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0294.563] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0294.594] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0294.612] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0294.643] SetEvent (hEvent=0x174) returned 1
	[0294.644] SetEvent (hEvent=0x12c) returned 1
	[0294.644] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0294.669] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0294.669] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0294.671] SetEvent (hEvent=0x174) returned 1
	[0294.671] SetEvent (hEvent=0x12c) returned 1
	[0294.671] SetEvent (hEvent=0x14c) returned 1
	[0294.671] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0294.671] SetEvent (hEvent=0x168) returned 1
	[0294.671] SetEvent (hEvent=0x14c) returned 1
	[0294.672] SetEvent (hEvent=0x124) returned 1
	[0294.672] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0294.682] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0294.736] SetEvent (hEvent=0x124) returned 1
	[0294.736] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0294.738] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0294.791] SetEvent (hEvent=0x124) returned 1
	[0294.791] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0294.796] SetEvent (hEvent=0x14c) returned 1
	[0294.796] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0294.864] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0294.869] SetEvent (hEvent=0x14c) returned 1
	[0294.869] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0294.870] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0294.997] SetEvent (hEvent=0x174) returned 1
	[0294.997] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0294.998] SetEvent (hEvent=0x174) returned 1
	[0294.998] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.006] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.037] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.059] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.084] SetEvent (hEvent=0x174) returned 1
	[0295.085] SetEvent (hEvent=0x12c) returned 1
	[0295.085] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0295.103] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.103] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0295.104] SetEvent (hEvent=0x174) returned 1
	[0295.104] SetEvent (hEvent=0x12c) returned 1
	[0295.104] SetEvent (hEvent=0x14c) returned 1
	[0295.104] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.104] SetEvent (hEvent=0x168) returned 1
	[0295.104] SetEvent (hEvent=0x14c) returned 1
	[0295.104] SetEvent (hEvent=0x124) returned 1
	[0295.104] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.109] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.116] SetEvent (hEvent=0x124) returned 1
	[0295.116] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.117] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.143] SetEvent (hEvent=0x124) returned 1
	[0295.143] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.144] SetEvent (hEvent=0x14c) returned 1
	[0295.144] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.255] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.264] SetEvent (hEvent=0x14c) returned 1
	[0295.264] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.265] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.369] SetEvent (hEvent=0x14c) returned 1
	[0295.369] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.369] SetEvent (hEvent=0x14c) returned 1
	[0295.369] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.405] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.514] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.551] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.568] SetEvent (hEvent=0x14c) returned 1
	[0295.569] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.570] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.662] SetEvent (hEvent=0x174) returned 1
	[0295.662] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.663] SetEvent (hEvent=0x174) returned 1
	[0295.663] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.679] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.706] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.729] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.739] SetEvent (hEvent=0x174) returned 1
	[0295.739] SetEvent (hEvent=0x12c) returned 1
	[0295.739] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0295.752] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.752] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0295.752] SetEvent (hEvent=0x174) returned 1
	[0295.752] SetEvent (hEvent=0x12c) returned 1
	[0295.752] SetEvent (hEvent=0x14c) returned 1
	[0295.752] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.756] SetEvent (hEvent=0x14c) returned 1
	[0295.756] SetEvent (hEvent=0x124) returned 1
	[0295.756] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.758] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.768] SetEvent (hEvent=0x124) returned 1
	[0295.768] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.768] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.804] SetEvent (hEvent=0x124) returned 1
	[0295.804] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.805] SetEvent (hEvent=0x14c) returned 1
	[0295.805] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.851] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.851] SetEvent (hEvent=0x14c) returned 1
	[0295.851] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.852] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.945] SetEvent (hEvent=0x14c) returned 1
	[0295.945] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.945] SetEvent (hEvent=0x14c) returned 1
	[0295.945] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.959] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0295.987] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0296.008] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0296.042] SetEvent (hEvent=0x14c) returned 1
	[0296.042] SetEvent (hEvent=0x12c) returned 1
	[0296.042] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0296.042] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0296.043] SetEvent (hEvent=0x14c) returned 1
	[0296.043] SetEvent (hEvent=0x12c) returned 1
	[0296.043] SetEvent (hEvent=0x174) returned 1
	[0296.043] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0296.043] SetEvent (hEvent=0x174) returned 1
	[0296.043] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0296.086] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0296.115] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0296.172] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0296.173] SetEvent (hEvent=0x174) returned 1
	[0296.173] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0296.174] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0296.340] SetEvent (hEvent=0x14c) returned 1
	[0296.340] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0296.341] SetEvent (hEvent=0x14c) returned 1
	[0296.341] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0296.358] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0296.471] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0296.472] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0296.483] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0296.534] SetEvent (hEvent=0x14c) returned 1
	[0296.534] SetEvent (hEvent=0x12c) returned 1
	[0296.534] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0296.565] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0296.565] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0296.566] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0296.566] SetEvent (hEvent=0x14c) returned 1
	[0296.566] SetEvent (hEvent=0x12c) returned 1
	[0296.566] SetEvent (hEvent=0x174) returned 1
	[0296.566] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0296.567] SetEvent (hEvent=0x168) returned 1
	[0296.567] SetEvent (hEvent=0x174) returned 1
	[0296.567] SetEvent (hEvent=0x124) returned 1
	[0296.567] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0296.569] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0296.586] SetEvent (hEvent=0x124) returned 1
	[0296.586] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0296.589] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0296.631] SetEvent (hEvent=0x124) returned 1
	[0296.631] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0296.632] SetEvent (hEvent=0x174) returned 1
	[0296.632] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0296.705] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0296.706] SetEvent (hEvent=0x174) returned 1
	[0296.706] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0296.707] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0296.826] SetEvent (hEvent=0x174) returned 1
	[0296.826] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0296.829] SetEvent (hEvent=0x174) returned 1
	[0296.829] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0296.838] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0296.864] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0296.875] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0296.898] SetEvent (hEvent=0x174) returned 1
	[0296.899] SetEvent (hEvent=0x12c) returned 1
	[0296.899] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0296.899] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0296.900] SetEvent (hEvent=0x174) returned 1
	[0296.900] SetEvent (hEvent=0x12c) returned 1
	[0296.900] SetEvent (hEvent=0x14c) returned 1
	[0296.900] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0296.900] SetEvent (hEvent=0x168) returned 1
	[0296.900] SetEvent (hEvent=0x14c) returned 1
	[0296.900] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0297.017] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0297.050] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0297.078] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0297.093] SetEvent (hEvent=0x14c) returned 1
	[0297.093] SetEvent (hEvent=0x12c) returned 1
	[0297.093] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0297.110] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0297.110] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0297.112] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0297.112] SetEvent (hEvent=0x14c) returned 1
	[0297.112] SetEvent (hEvent=0x12c) returned 1
	[0297.112] SetEvent (hEvent=0x174) returned 1
	[0297.112] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0297.112] SetEvent (hEvent=0x168) returned 1
	[0297.112] SetEvent (hEvent=0x174) returned 1
	[0297.112] SetEvent (hEvent=0x124) returned 1
	[0297.112] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0297.114] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0297.129] SetEvent (hEvent=0x124) returned 1
	[0297.129] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0297.129] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0297.166] SetEvent (hEvent=0x124) returned 1
	[0297.166] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0297.167] SetEvent (hEvent=0x174) returned 1
	[0297.167] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0297.227] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0297.229] SetEvent (hEvent=0x174) returned 1
	[0297.229] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0297.230] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0297.371] SetEvent (hEvent=0x14c) returned 1
	[0297.371] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0297.372] SetEvent (hEvent=0x14c) returned 1
	[0297.372] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0297.389] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0297.486] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0297.509] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0297.523] SetEvent (hEvent=0x14c) returned 1
	[0297.523] SetEvent (hEvent=0x12c) returned 1
	[0297.523] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0297.538] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0297.538] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0297.539] SetEvent (hEvent=0x14c) returned 1
	[0297.539] SetEvent (hEvent=0x12c) returned 1
	[0297.539] SetEvent (hEvent=0x174) returned 1
	[0297.539] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0297.540] SetEvent (hEvent=0x168) returned 1
	[0297.540] SetEvent (hEvent=0x174) returned 1
	[0297.540] SetEvent (hEvent=0x124) returned 1
	[0297.540] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0297.662] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0297.674] SetEvent (hEvent=0x124) returned 1
	[0297.674] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0297.674] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0297.731] SetEvent (hEvent=0x124) returned 1
	[0297.731] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0297.733] SetEvent (hEvent=0x174) returned 1
	[0297.733] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0297.790] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0297.808] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0297.866] SetEvent (hEvent=0x124) returned 1
	[0297.866] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0297.867] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0297.874] SetEvent (hEvent=0x124) returned 1
	[0297.874] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0297.876] SetEvent (hEvent=0x12c) returned 1
	[0297.876] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0297.941] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0297.943] SetEvent (hEvent=0x12c) returned 1
	[0297.943] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0297.944] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0298.092] SetEvent (hEvent=0x14c) returned 1
	[0298.092] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0298.093] SetEvent (hEvent=0x14c) returned 1
	[0298.093] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0298.109] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0298.144] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0298.173] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0298.189] SetEvent (hEvent=0x14c) returned 1
	[0298.190] SetEvent (hEvent=0x174) returned 1
	[0298.190] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0298.209] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0298.209] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0298.210] SetEvent (hEvent=0x14c) returned 1
	[0298.210] SetEvent (hEvent=0x174) returned 1
	[0298.210] SetEvent (hEvent=0x12c) returned 1
	[0298.210] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0298.211] SetEvent (hEvent=0x168) returned 1
	[0298.211] SetEvent (hEvent=0x12c) returned 1
	[0298.211] SetEvent (hEvent=0x124) returned 1
	[0298.211] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0298.237] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0298.260] SetEvent (hEvent=0x124) returned 1
	[0298.260] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0298.261] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0298.301] SetEvent (hEvent=0x124) returned 1
	[0298.301] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0298.303] SetEvent (hEvent=0x12c) returned 1
	[0298.303] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0298.398] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0298.399] SetEvent (hEvent=0x12c) returned 1
	[0298.400] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0298.400] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0298.606] SetEvent (hEvent=0x14c) returned 1
	[0298.606] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0298.607] SetEvent (hEvent=0x14c) returned 1
	[0298.607] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0298.616] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0298.661] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0298.690] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0298.703] SetEvent (hEvent=0x14c) returned 1
	[0298.704] SetEvent (hEvent=0x174) returned 1
	[0298.704] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0298.721] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0298.721] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0298.723] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0298.723] SetEvent (hEvent=0x14c) returned 1
	[0298.723] SetEvent (hEvent=0x174) returned 1
	[0298.723] SetEvent (hEvent=0x12c) returned 1
	[0298.723] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0298.724] SetEvent (hEvent=0x168) returned 1
	[0298.724] SetEvent (hEvent=0x12c) returned 1
	[0298.724] SetEvent (hEvent=0x124) returned 1
	[0298.724] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0298.735] SetEvent (hEvent=0x124) returned 1
	[0298.735] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0298.737] SetEvent (hEvent=0x124) returned 1
	[0298.737] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0298.738] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0298.765] SetEvent (hEvent=0x124) returned 1
	[0298.765] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0298.798] SetEvent (hEvent=0x124) returned 1
	[0298.798] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0298.804] SetEvent (hEvent=0x12c) returned 1
	[0298.804] SetEvent (hEvent=0x174) returned 1
	[0298.804] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x102
	[0298.818] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0298.818] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0x1) returned 0x0
	[0298.819] SetEvent (hEvent=0x12c) returned 1
	[0298.819] SetEvent (hEvent=0x174) returned 1
	[0298.819] SetEvent (hEvent=0x14c) returned 1
	[0298.819] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0298.820] SetEvent (hEvent=0x168) returned 1
	[0298.820] SetEvent (hEvent=0x14c) returned 1
	[0298.820] SetEvent (hEvent=0x124) returned 1
	[0298.820] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0298.834] SetEvent (hEvent=0x124) returned 1
	[0298.834] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0298.836] SetEvent (hEvent=0x124) returned 1
	[0298.836] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0298.853] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0298.877] SetEvent (hEvent=0x124) returned 1
	[0298.877] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0298.901] SetEvent (hEvent=0x14c) returned 1
	[0298.901] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0300.333] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0300.336] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0300.347] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0300.478] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0300.519] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0300.541] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0300.621] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0300.751] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0300.837] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0300.985] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0301.209] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0301.360] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0301.401] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0301.435] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0301.466] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0301.488] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0301.525] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0301.547] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0301.593] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0301.661] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0301.694] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0301.712] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0301.812] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0302.762] SetEvent (hEvent=0x174) returned 1
	[0302.763] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0302.766] SetEvent (hEvent=0x124) returned 1
	[0302.766] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0302.767] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0315.107] SetEvent (hEvent=0x124) returned 1
	[0315.107] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0315.108] SetEvent (hEvent=0x124) returned 1
	[0315.108] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0315.932] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0315.933] SetEvent (hEvent=0x124) returned 1
	[0315.933] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) returned 0x0
	[0315.933] WaitForSingleObject (hHandle=0x104, dwMilliseconds=0xffffffff) 

Thread:
	id = 6
	os_tid = 0x7fc


Thread:
	id = 7
	os_tid = 0xde4

	[0108.892] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x3250ff58, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x3250ff58*=0x108) returned 1
	[0108.892] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0108.906] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0108.939] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0109.434] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0109.472] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0109.491] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0109.502] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0109.544] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0109.550] SetEvent (hEvent=0x12c) returned 1
	[0109.551] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0109.554] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0109.582] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0109.582] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x168
	[0109.582] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0110.020] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0110.020] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0110.049] SetEvent (hEvent=0x124) returned 1
	[0110.049] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0110.051] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0110.051] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0119.956] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0119.957] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0119.960] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0120.060] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0120.072] SetEvent (hEvent=0x124) returned 1
	[0120.072] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0120.175] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0120.175] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0120.318] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0120.318] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0120.358] SetEvent (hEvent=0x124) returned 1
	[0120.358] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0120.384] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0120.384] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0121.952] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0121.952] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0122.031] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0122.047] SetEvent (hEvent=0x124) returned 1
	[0122.047] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0122.050] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0122.050] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0122.095] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0122.095] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0122.121] SetEvent (hEvent=0x124) returned 1
	[0122.121] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0122.135] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0122.136] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0123.632] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0123.632] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0123.634] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0123.671] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0123.675] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0123.679] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0123.681] SetEvent (hEvent=0x124) returned 1
	[0123.681] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0123.685] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0123.725] SetEvent (hEvent=0x124) returned 1
	[0123.725] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0123.759] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0123.759] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0124.980] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0124.980] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0124.983] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0125.010] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0125.017] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0125.021] SetEvent (hEvent=0x124) returned 1
	[0125.021] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0125.024] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0125.024] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0125.064] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0125.064] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0125.103] SetEvent (hEvent=0x124) returned 1
	[0125.103] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0125.106] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0125.106] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0126.756] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0126.756] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0126.759] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0126.794] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0126.799] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0126.908] SetEvent (hEvent=0x124) returned 1
	[0126.908] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0126.916] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0126.916] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0127.000] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0127.001] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0127.049] SetEvent (hEvent=0x124) returned 1
	[0127.049] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0127.054] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0127.054] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0128.415] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0128.415] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0128.419] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0128.462] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0128.466] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0128.468] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0128.472] SetEvent (hEvent=0x124) returned 1
	[0128.472] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0128.479] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0128.479] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0128.594] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0128.594] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0128.621] SetEvent (hEvent=0x124) returned 1
	[0128.621] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0128.638] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0128.639] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0130.094] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0130.095] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0130.098] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0130.250] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0130.253] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0130.261] SetEvent (hEvent=0x124) returned 1
	[0130.261] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0130.265] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0130.265] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0130.317] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0130.317] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0130.347] SetEvent (hEvent=0x124) returned 1
	[0130.347] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0130.363] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0130.364] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0131.619] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0131.619] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0131.629] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0131.714] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0131.718] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0131.722] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0131.725] SetEvent (hEvent=0x124) returned 1
	[0131.725] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0131.728] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0131.728] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0131.768] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0131.769] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0131.783] SetEvent (hEvent=0x124) returned 1
	[0131.783] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0131.786] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0131.786] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0133.298] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0133.298] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0133.300] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0133.418] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0133.457] SetEvent (hEvent=0x124) returned 1
	[0133.457] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0133.497] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0133.497] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0133.558] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0133.558] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0133.582] SetEvent (hEvent=0x124) returned 1
	[0133.582] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0133.588] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0133.588] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0138.262] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0138.262] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0138.365] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0138.382] SetEvent (hEvent=0x124) returned 1
	[0138.383] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0138.392] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0138.392] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0138.489] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0138.489] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0138.532] SetEvent (hEvent=0x124) returned 1
	[0138.532] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0138.545] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0138.545] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0140.216] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0140.216] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0140.411] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0140.476] SetEvent (hEvent=0x124) returned 1
	[0140.476] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0140.485] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0140.485] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0140.533] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0140.533] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0140.557] SetEvent (hEvent=0x124) returned 1
	[0140.557] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0140.562] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0140.563] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0141.868] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0141.869] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0141.883] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0141.910] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0141.913] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0141.916] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0141.918] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0141.920] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0141.997] SetEvent (hEvent=0x124) returned 1
	[0141.997] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0142.017] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0142.017] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0143.397] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0143.397] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0143.406] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0143.429] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0143.433] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0143.437] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0143.439] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0143.477] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0143.495] SetEvent (hEvent=0x124) returned 1
	[0143.495] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0143.498] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0143.499] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0144.692] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0144.692] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0144.699] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0144.736] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0144.786] SetEvent (hEvent=0x124) returned 1
	[0144.786] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0144.790] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0144.790] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0144.833] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0144.833] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0144.847] SetEvent (hEvent=0x124) returned 1
	[0144.847] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0144.851] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0144.851] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0146.046] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0146.046] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0146.095] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0146.098] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0146.103] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0146.107] SetEvent (hEvent=0x124) returned 1
	[0146.107] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0146.111] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0146.148] SetEvent (hEvent=0x124) returned 1
	[0146.148] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0146.174] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0146.174] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0147.510] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0147.510] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0147.513] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0147.552] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0147.554] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0147.556] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0147.558] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0147.564] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0147.665] SetEvent (hEvent=0x124) returned 1
	[0147.665] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0147.695] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0147.695] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0149.005] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0149.005] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0149.009] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0149.152] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0149.210] SetEvent (hEvent=0x124) returned 1
	[0149.213] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0149.217] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0149.217] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0149.270] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0149.270] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0149.294] SetEvent (hEvent=0x124) returned 1
	[0149.294] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0149.312] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0149.313] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0150.687] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0150.687] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0150.689] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0150.826] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0150.846] SetEvent (hEvent=0x124) returned 1
	[0150.846] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0150.848] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0150.848] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0150.898] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0150.898] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0150.916] SetEvent (hEvent=0x124) returned 1
	[0150.916] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0150.937] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0150.937] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0152.478] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0152.478] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0152.533] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0152.536] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0152.571] SetEvent (hEvent=0x124) returned 1
	[0152.571] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0152.577] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0152.577] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0152.615] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0152.616] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0152.637] SetEvent (hEvent=0x124) returned 1
	[0152.637] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0152.657] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0152.657] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0155.587] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0155.587] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0155.604] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0155.641] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0155.645] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0155.705] SetEvent (hEvent=0x124) returned 1
	[0155.705] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0155.708] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0155.709] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0155.755] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0155.755] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0155.790] SetEvent (hEvent=0x124) returned 1
	[0155.790] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0155.795] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0155.795] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0156.988] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0156.988] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0157.041] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0157.054] SetEvent (hEvent=0x124) returned 1
	[0157.054] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0157.067] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0157.067] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0157.125] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0157.126] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0157.151] SetEvent (hEvent=0x124) returned 1
	[0157.151] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0157.179] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0157.179] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0158.489] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0158.490] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0158.500] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0158.583] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0158.589] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0158.592] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0158.599] SetEvent (hEvent=0x124) returned 1
	[0158.599] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0158.605] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0158.605] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0158.644] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0158.645] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0158.665] SetEvent (hEvent=0x124) returned 1
	[0158.665] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0158.669] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0158.669] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0163.180] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0163.180] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0163.261] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0163.335] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0163.386] SetEvent (hEvent=0x124) returned 1
	[0163.386] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0163.420] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0163.420] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0163.471] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0163.471] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0163.503] SetEvent (hEvent=0x124) returned 1
	[0163.503] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0163.506] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0163.506] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0165.666] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0165.666] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0165.670] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0165.750] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0165.753] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0165.755] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0165.764] SetEvent (hEvent=0x124) returned 1
	[0165.764] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0165.814] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0165.814] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0165.857] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0165.857] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0165.879] SetEvent (hEvent=0x124) returned 1
	[0165.879] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0165.884] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0165.884] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0172.816] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0172.816] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0172.859] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0172.904] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0172.908] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0172.923] SetEvent (hEvent=0x124) returned 1
	[0172.923] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0172.926] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0172.926] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0172.976] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0172.976] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0173.018] SetEvent (hEvent=0x124) returned 1
	[0173.018] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0173.027] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0173.027] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0174.939] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0174.939] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0174.942] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0174.975] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0174.979] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0174.983] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0174.989] SetEvent (hEvent=0x124) returned 1
	[0174.990] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0174.995] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0175.037] SetEvent (hEvent=0x124) returned 1
	[0175.037] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0175.058] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0175.058] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0176.552] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0176.553] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0176.596] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0176.600] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0176.602] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0176.608] SetEvent (hEvent=0x124) returned 1
	[0176.608] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0176.611] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0176.649] SetEvent (hEvent=0x124) returned 1
	[0176.649] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0176.668] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0176.668] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0178.028] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0178.029] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0178.037] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0178.067] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0178.069] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0178.074] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0178.078] SetEvent (hEvent=0x124) returned 1
	[0178.078] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0178.081] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0178.123] SetEvent (hEvent=0x124) returned 1
	[0178.123] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0178.152] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0178.153] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0179.258] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0179.258] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0179.259] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0179.288] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0179.291] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0179.299] SetEvent (hEvent=0x124) returned 1
	[0179.299] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0179.303] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0179.303] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0179.359] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0179.359] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0179.376] SetEvent (hEvent=0x124) returned 1
	[0179.376] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0179.398] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0179.398] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0180.529] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0180.529] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0180.619] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0180.678] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0180.714] SetEvent (hEvent=0x124) returned 1
	[0180.714] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0180.718] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0180.718] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0180.766] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0180.767] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0180.785] SetEvent (hEvent=0x124) returned 1
	[0180.785] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0180.806] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0180.806] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0181.990] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0181.990] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0182.021] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0182.054] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0182.059] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0182.069] SetEvent (hEvent=0x124) returned 1
	[0182.069] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0182.075] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0182.075] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0182.179] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0182.179] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0182.206] SetEvent (hEvent=0x124) returned 1
	[0182.206] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0182.211] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0182.211] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0183.416] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0183.417] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0183.420] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0183.515] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0183.518] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0183.520] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0183.525] SetEvent (hEvent=0x124) returned 1
	[0183.525] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0183.528] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0183.528] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0183.641] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0183.641] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0183.663] SetEvent (hEvent=0x124) returned 1
	[0183.663] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0183.684] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0183.684] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0184.764] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0184.764] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0184.804] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0184.859] SetEvent (hEvent=0x124) returned 1
	[0184.859] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0184.866] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0184.866] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0184.916] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0184.916] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0184.964] SetEvent (hEvent=0x124) returned 1
	[0184.964] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0184.970] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0184.970] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0186.092] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0186.092] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0186.095] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0186.145] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0186.150] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0186.154] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0186.155] SetEvent (hEvent=0x124) returned 1
	[0186.155] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0186.159] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0186.214] SetEvent (hEvent=0x124) returned 1
	[0186.214] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0186.233] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0186.233] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0187.763] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0187.763] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0187.798] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0187.885] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0187.889] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0187.893] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0187.900] SetEvent (hEvent=0x124) returned 1
	[0187.900] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0187.906] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0187.945] SetEvent (hEvent=0x124) returned 1
	[0187.945] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0187.965] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0187.965] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0189.271] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0189.271] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0189.274] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0189.311] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0189.318] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0189.321] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0189.324] SetEvent (hEvent=0x124) returned 1
	[0189.324] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0189.327] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0189.327] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0189.419] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0189.420] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0189.437] SetEvent (hEvent=0x124) returned 1
	[0189.437] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0189.441] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0189.441] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0190.508] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0190.508] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0190.513] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0190.609] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0190.611] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0190.615] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0190.618] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0190.623] SetEvent (hEvent=0x124) returned 1
	[0190.623] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0190.662] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0190.681] SetEvent (hEvent=0x124) returned 1
	[0190.681] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0190.704] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0190.704] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0191.767] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0191.767] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0191.773] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0191.795] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0191.799] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0191.801] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0191.804] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0191.807] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0191.844] SetEvent (hEvent=0x124) returned 1
	[0191.844] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0191.860] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0191.860] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0193.397] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0193.397] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0193.405] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0193.529] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0193.780] SetEvent (hEvent=0x124) returned 1
	[0193.780] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0193.915] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0193.999] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0194.174] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0194.178] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0194.181] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0194.191] SetEvent (hEvent=0x124) returned 1
	[0194.191] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0194.195] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0194.196] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0194.336] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0194.336] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0194.359] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0194.363] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0194.365] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0194.395] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0194.404] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0194.421] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0194.429] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0194.432] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0194.435] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0194.439] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0194.442] SetEvent (hEvent=0x124) returned 1
	[0194.442] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0194.444] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0194.444] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0194.465] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0194.465] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0194.527] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0194.532] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0194.534] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0194.557] SetEvent (hEvent=0x124) returned 1
	[0194.557] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0194.562] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0194.562] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0194.585] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0194.586] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0194.626] SetEvent (hEvent=0x124) returned 1
	[0194.626] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0194.633] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0194.637] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0194.639] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0194.643] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0194.646] SetEvent (hEvent=0x124) returned 1
	[0194.646] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0194.648] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0194.648] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0194.758] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0194.759] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0194.768] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0194.773] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0194.776] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0194.783] SetEvent (hEvent=0x124) returned 1
	[0194.783] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0194.823] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0194.823] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0195.010] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0195.010] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.012] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.015] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.018] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.021] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.022] SetEvent (hEvent=0x124) returned 1
	[0195.022] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.024] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0195.025] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0195.125] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0195.125] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.132] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.134] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.137] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.147] SetEvent (hEvent=0x124) returned 1
	[0195.147] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.151] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.216] SetEvent (hEvent=0x124) returned 1
	[0195.216] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.224] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.228] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.232] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.241] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.245] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.272] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.278] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.290] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.295] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.298] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.305] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.309] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.314] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.318] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.321] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.325] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.328] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.333] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.337] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.346] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.351] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.356] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.360] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.364] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.367] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.372] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.501] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.512] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.526] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.531] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.543] SetEvent (hEvent=0x124) returned 1
	[0195.543] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.553] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.566] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.576] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.578] SetEvent (hEvent=0x124) returned 1
	[0195.578] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.580] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0195.580] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0195.592] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0195.593] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.596] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.599] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.601] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.612] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.625] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.670] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.676] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.681] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.683] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.685] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.689] SetEvent (hEvent=0x124) returned 1
	[0195.689] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.690] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0195.691] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0195.703] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0195.704] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.707] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.711] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.714] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.719] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.721] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.789] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.796] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.798] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.801] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.807] SetEvent (hEvent=0x124) returned 1
	[0195.807] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.811] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0195.811] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0195.985] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0195.985] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0195.998] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.013] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.018] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.033] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.036] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.038] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.040] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.042] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.044] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.048] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.052] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.054] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.065] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.071] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.074] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.076] SetEvent (hEvent=0x124) returned 1
	[0196.076] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.078] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0196.078] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0196.251] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0196.251] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.255] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.258] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.261] SetEvent (hEvent=0x124) returned 1
	[0196.261] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.265] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0196.265] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0196.272] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0196.272] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.279] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.291] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.296] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.309] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.311] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.315] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.340] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.342] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.345] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.350] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.352] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.355] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.360] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.362] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.371] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.375] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.380] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.389] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.392] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.396] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.398] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.400] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.406] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.450] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.455] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.458] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.466] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.480] SetEvent (hEvent=0x124) returned 1
	[0196.480] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.482] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0196.482] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0196.535] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0196.535] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.551] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.553] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.561] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.564] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.568] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.570] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.572] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.575] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.577] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.583] SetEvent (hEvent=0x124) returned 1
	[0196.583] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.585] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0196.585] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0196.707] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0196.707] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.710] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.711] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.713] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.716] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.721] SetEvent (hEvent=0x124) returned 1
	[0196.721] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.724] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0196.724] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0196.793] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0196.793] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.796] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.809] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.821] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.825] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.830] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.831] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.836] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.839] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.841] SetEvent (hEvent=0x124) returned 1
	[0196.841] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.843] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0196.844] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0196.860] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0196.860] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.863] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.866] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.870] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.876] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.901] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.912] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.930] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.936] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.973] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.981] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.985] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0196.989] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.000] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.005] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.007] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.009] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.016] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.029] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.106] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.114] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.120] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.152] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.162] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.187] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.214] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.221] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.223] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.227] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.231] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.233] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.239] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.241] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.247] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.252] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.303] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.309] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.320] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.395] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.402] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.405] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0197.405] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0197.421] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0197.421] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.426] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.433] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.440] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.443] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.452] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.455] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.460] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.463] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.465] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.490] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.497] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.498] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.502] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.504] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.510] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.523] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.525] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.527] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.551] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.552] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.555] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.566] SetEvent (hEvent=0x174) returned 1
	[0197.566] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.570] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0197.570] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0197.659] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0197.659] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.662] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.667] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.679] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.682] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.690] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.699] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.708] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.713] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.716] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.718] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.726] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.728] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.731] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.735] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.736] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.741] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.744] SetEvent (hEvent=0x174) returned 1
	[0197.744] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.746] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0197.746] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0197.758] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0197.758] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.761] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.857] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.861] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.875] SetEvent (hEvent=0x174) returned 1
	[0197.875] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0197.878] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0197.878] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0197.997] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0197.997] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.003] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.006] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.010] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.013] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.019] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.023] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.030] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.040] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.046] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.054] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.058] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.067] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.071] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.075] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.078] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.081] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.083] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.085] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.091] SetEvent (hEvent=0x174) returned 1
	[0198.091] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.104] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.112] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.180] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.185] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.187] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.191] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.194] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.199] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.204] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.225] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.235] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.240] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.244] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.247] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.250] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.262] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.268] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.272] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.281] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.301] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.307] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.377] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.381] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.385] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.391] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.395] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.397] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.400] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.403] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.414] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.425] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.433] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.451] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.510] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.518] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.528] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.532] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.550] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.556] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.565] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.572] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.579] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.584] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.592] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.594] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.596] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.605] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.627] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.634] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.638] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.646] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.649] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.654] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.658] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.749] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.757] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.764] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.776] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.778] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.782] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.785] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.787] SetEvent (hEvent=0x174) returned 1
	[0198.787] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.794] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0198.794] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0198.896] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0198.896] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.905] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.911] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.913] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.927] SetEvent (hEvent=0x174) returned 1
	[0198.927] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.937] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.970] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.974] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.980] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.984] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.990] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0198.997] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.104] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.111] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.119] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.121] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.122] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.125] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.130] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.134] SetEvent (hEvent=0x174) returned 1
	[0199.134] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.136] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0199.136] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0199.193] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0199.194] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.201] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.206] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.212] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.220] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.229] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.235] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.237] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.242] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.252] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.266] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.271] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.275] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.281] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.283] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.286] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.296] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.360] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.366] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.370] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.373] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.376] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.378] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.381] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.384] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.397] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.408] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.411] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.414] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.416] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.417] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.419] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.421] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.423] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.564] SetEvent (hEvent=0x174) returned 1
	[0199.564] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.615] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.668] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.675] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.683] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.686] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.694] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.702] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.704] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.709] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.717] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.720] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.722] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.726] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.732] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.734] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.738] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.744] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.753] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.760] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.762] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.764] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.772] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.776] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.778] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.781] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.783] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.784] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.787] SetEvent (hEvent=0x174) returned 1
	[0199.787] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.791] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.794] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.798] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.808] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.815] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.818] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.828] SetEvent (hEvent=0x174) returned 1
	[0199.828] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.830] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0199.830] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0199.869] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0199.869] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.871] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.873] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.875] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.880] SetEvent (hEvent=0x174) returned 1
	[0199.880] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.885] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0199.886] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0199.910] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0199.910] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.917] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.919] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.928] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.931] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.934] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.936] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.939] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.965] SetEvent (hEvent=0x174) returned 1
	[0199.965] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.971] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.974] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.981] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.986] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.989] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0199.991] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.020] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.021] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.023] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.030] SetEvent (hEvent=0x174) returned 1
	[0200.030] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.032] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0200.032] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0200.053] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0200.053] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.055] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.057] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.059] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.060] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.062] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.064] SetEvent (hEvent=0x174) returned 1
	[0200.064] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.066] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0200.066] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0200.079] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0200.079] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.081] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.086] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.088] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.091] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.095] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.106] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.107] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.109] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.111] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.112] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.115] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.118] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.123] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.129] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.137] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.142] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.148] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.150] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.153] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.156] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.162] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.166] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.171] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.172] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.173] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.183] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.186] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.189] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.190] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.196] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.198] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.204] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.209] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.214] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.216] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.218] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.222] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.223] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.225] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.235] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.241] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.249] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.261] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.267] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.279] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.285] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.289] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.293] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.298] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.300] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.318] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.322] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.326] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.333] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.340] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.343] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.349] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.353] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.355] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.358] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.360] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.362] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.367] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.370] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.372] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.378] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.382] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.394] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.395] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.397] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.402] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.413] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.418] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.422] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.425] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.434] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.443] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.447] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.450] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.454] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.463] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.472] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.475] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.478] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.484] SetEvent (hEvent=0x174) returned 1
	[0200.484] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.487] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0200.487] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0200.504] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0200.504] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.506] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.514] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.517] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.523] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.524] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.525] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.528] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.530] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.531] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.533] SetEvent (hEvent=0x174) returned 1
	[0200.533] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.534] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0200.535] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0200.592] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0200.592] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.599] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.603] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.605] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.610] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.612] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.613] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.617] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.618] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.622] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.624] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.626] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.630] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.633] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.636] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.638] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.641] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.647] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.649] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.652] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.653] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.656] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.658] SetEvent (hEvent=0x174) returned 1
	[0200.658] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.659] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0200.659] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0200.700] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0200.700] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.703] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.715] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.719] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.721] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.724] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.725] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.726] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.729] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.731] SetEvent (hEvent=0x174) returned 1
	[0200.731] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.733] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0200.733] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0200.781] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0200.781] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.785] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.787] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.791] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.793] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.796] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.797] SetEvent (hEvent=0x174) returned 1
	[0200.797] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.799] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0200.799] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0200.849] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0200.850] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.855] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.861] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.864] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.866] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.869] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.873] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.874] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.876] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.878] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.881] SetEvent (hEvent=0x174) returned 1
	[0200.881] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.883] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0200.883] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0200.938] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0200.938] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.940] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.956] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.957] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.960] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.961] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.964] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.965] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.967] SetEvent (hEvent=0x174) returned 1
	[0200.967] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0200.969] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0200.969] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0201.033] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0201.033] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.035] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.037] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.039] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.041] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.043] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.045] SetEvent (hEvent=0x174) returned 1
	[0201.045] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.047] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0201.047] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0201.119] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0201.119] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.123] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.125] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.129] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.133] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.142] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.146] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.147] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.152] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.156] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.159] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.162] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.164] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.167] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.168] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.170] SetEvent (hEvent=0x174) returned 1
	[0201.170] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.172] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0201.172] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0201.248] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0201.248] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.252] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.253] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.257] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.260] SetEvent (hEvent=0x174) returned 1
	[0201.260] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.262] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0201.262] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0201.398] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0201.398] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.401] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.402] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.405] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.406] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.408] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.410] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.410] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.412] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.414] SetEvent (hEvent=0x174) returned 1
	[0201.414] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.417] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0201.417] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0201.485] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0201.485] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.489] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.492] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.495] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.504] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.506] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.509] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.512] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.514] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.517] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.520] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.524] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.526] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.529] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.532] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.534] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.545] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.548] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.551] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.557] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.561] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.569] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.572] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.575] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.577] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.580] SetEvent (hEvent=0x174) returned 1
	[0201.580] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.582] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0201.582] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0201.588] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0201.588] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.593] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.597] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.600] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.614] SetEvent (hEvent=0x174) returned 1
	[0201.614] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.616] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0201.616] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0201.642] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0201.642] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.645] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.647] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.651] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.654] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.657] SetEvent (hEvent=0x174) returned 1
	[0201.657] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.661] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0201.661] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0201.687] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0201.687] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.690] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.692] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.694] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.696] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.699] SetEvent (hEvent=0x174) returned 1
	[0201.699] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.701] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0201.701] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0201.755] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0201.756] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.757] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.760] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.761] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.764] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.770] SetEvent (hEvent=0x174) returned 1
	[0201.770] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.793] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0201.793] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0201.849] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0201.849] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.853] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.855] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.857] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.858] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.863] SetEvent (hEvent=0x174) returned 1
	[0201.863] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0201.866] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0201.866] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0202.018] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0202.018] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.019] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.022] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.025] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.031] SetEvent (hEvent=0x174) returned 1
	[0202.031] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.036] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0202.037] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0202.199] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0202.199] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.202] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.206] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.208] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.210] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.212] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.218] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.221] SetEvent (hEvent=0x174) returned 1
	[0202.221] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.226] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0202.227] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0202.232] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0202.232] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.234] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.239] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.242] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.244] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.246] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.247] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.248] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.252] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.254] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.257] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.260] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.263] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.266] SetEvent (hEvent=0x174) returned 1
	[0202.266] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.270] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0202.270] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0202.282] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0202.282] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.288] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.291] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.295] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.298] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.301] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.308] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.312] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.315] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.318] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.320] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.326] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.330] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.331] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.334] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.336] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.339] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.342] SetEvent (hEvent=0x174) returned 1
	[0202.342] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.346] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0202.346] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0202.361] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0202.362] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.365] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.370] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.372] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.375] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.378] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.381] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.382] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.385] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.388] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.391] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.392] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.394] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.398] SetEvent (hEvent=0x174) returned 1
	[0202.398] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.406] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.409] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.411] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.414] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.415] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.418] SetEvent (hEvent=0x174) returned 1
	[0202.418] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.421] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0202.421] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0202.427] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0202.427] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.431] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.436] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.439] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.444] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.447] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.448] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.450] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.453] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.457] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.461] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.465] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.468] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.471] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0202.472] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0202.478] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0202.478] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.481] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.483] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.486] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.489] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.492] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.496] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.498] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.500] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.503] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.506] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.509] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.511] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.520] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.521] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.523] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.524] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.525] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.527] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.530] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.534] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.547] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.550] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.554] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.555] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.561] SetEvent (hEvent=0x124) returned 1
	[0202.561] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.563] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0202.563] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0202.641] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0202.641] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.643] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.649] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.651] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.652] SetEvent (hEvent=0x124) returned 1
	[0202.652] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.653] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0202.653] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0202.683] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0202.683] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.691] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.695] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.698] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.702] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.705] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.708] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.712] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.714] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.718] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.724] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.726] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.732] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.744] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.748] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.750] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.752] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.755] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.759] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.763] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.765] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.767] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.769] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.773] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.773] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.777] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.778] SetEvent (hEvent=0x124) returned 1
	[0202.778] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0202.779] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0202.779] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0203.274] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0203.274] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.277] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.286] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.288] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.295] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.299] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.303] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.305] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.307] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.308] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.309] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.313] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.314] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.318] SetEvent (hEvent=0x124) returned 1
	[0203.318] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.319] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0203.319] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0203.359] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0203.360] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.362] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.381] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.383] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.399] SetEvent (hEvent=0x124) returned 1
	[0203.399] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.400] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0203.401] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0203.428] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0203.428] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.432] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.434] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.435] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.437] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.438] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.440] SetEvent (hEvent=0x124) returned 1
	[0203.440] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.441] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0203.441] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0203.500] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0203.500] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.501] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.502] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.503] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.505] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.506] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.508] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.509] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.510] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.512] SetEvent (hEvent=0x124) returned 1
	[0203.512] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.514] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0203.514] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0203.625] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0203.625] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.627] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.628] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.629] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.630] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.633] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.634] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.635] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.636] SetEvent (hEvent=0x124) returned 1
	[0203.636] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.637] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0203.637] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0203.801] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0203.801] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.803] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.804] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.806] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.807] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.808] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.814] SetEvent (hEvent=0x124) returned 1
	[0203.814] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.815] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0203.816] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0203.835] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0203.835] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.836] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.837] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.839] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.840] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.841] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.842] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.843] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.845] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.846] SetEvent (hEvent=0x124) returned 1
	[0203.846] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.850] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0203.850] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0203.851] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0203.851] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.852] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.853] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.854] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.855] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.857] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.858] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.860] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.862] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.863] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.864] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.865] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.867] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.868] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.869] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.870] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.872] SetEvent (hEvent=0x124) returned 1
	[0203.872] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.874] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0203.875] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0203.877] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0203.877] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.881] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.884] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.885] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.887] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.887] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.889] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.890] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.892] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.893] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.894] SetEvent (hEvent=0x124) returned 1
	[0203.894] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.896] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0203.896] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0203.906] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0203.906] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.907] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.911] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.912] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.913] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.914] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.916] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.917] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.918] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.920] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.922] SetEvent (hEvent=0x124) returned 1
	[0203.922] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.923] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0203.923] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0203.927] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0203.927] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.928] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.929] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.931] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.932] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.933] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.935] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.936] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.938] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.939] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.995] SetEvent (hEvent=0x124) returned 1
	[0203.995] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.998] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0203.999] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.000] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.001] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.002] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.004] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.005] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.006] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.007] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.008] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.009] SetEvent (hEvent=0x124) returned 1
	[0204.009] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.010] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0204.010] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0204.034] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0204.035] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.036] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.037] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.038] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.040] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.041] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.042] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.043] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.044] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.045] SetEvent (hEvent=0x124) returned 1
	[0204.045] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.047] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0204.047] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0204.066] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0204.066] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.067] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.069] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.070] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.071] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.072] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.073] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.075] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.077] SetEvent (hEvent=0x124) returned 1
	[0204.077] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.078] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0204.078] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0204.112] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0204.112] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.114] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.115] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.117] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.118] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.122] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.123] SetEvent (hEvent=0x124) returned 1
	[0204.123] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.124] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0204.124] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0204.173] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0204.173] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.175] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.176] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.178] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.179] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.180] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.181] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.182] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.184] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.185] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.187] SetEvent (hEvent=0x124) returned 1
	[0204.187] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.188] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0204.188] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0204.282] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0204.283] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.284] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.285] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.289] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.291] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.293] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.295] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.296] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.299] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.300] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.302] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.304] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.306] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.307] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.310] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.311] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.312] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.314] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.315] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.316] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.317] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.319] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.320] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.321] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.322] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.323] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.325] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.326] SetEvent (hEvent=0x124) returned 1
	[0204.326] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.328] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0204.328] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0204.452] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0204.452] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.454] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.456] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.458] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.459] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.461] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.463] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.464] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.466] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.467] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.469] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.470] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.472] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.473] SetEvent (hEvent=0x124) returned 1
	[0204.473] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.475] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0204.476] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0204.512] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0204.512] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.514] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.517] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.519] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.521] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.523] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.525] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.526] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.528] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.530] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.532] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.533] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.544] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.545] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.546] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.549] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.551] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.552] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.553] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.556] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.558] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.559] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.564] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.566] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.567] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.568] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.570] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.571] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.572] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.574] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.575] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.576] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.577] SetEvent (hEvent=0x124) returned 1
	[0204.577] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.579] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0204.579] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0204.580] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0204.580] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.581] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.583] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.584] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.586] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.588] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.589] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.590] SetEvent (hEvent=0x124) returned 1
	[0204.590] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.591] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0204.591] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0204.601] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0204.601] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.602] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.604] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.606] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.607] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.610] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.611] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.613] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.614] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.615] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.616] SetEvent (hEvent=0x124) returned 1
	[0204.616] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.617] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0204.617] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0204.633] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0204.633] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.634] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.638] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.641] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.642] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.644] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.645] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.646] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.647] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.649] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.650] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.651] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.652] SetEvent (hEvent=0x124) returned 1
	[0204.652] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.653] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0204.653] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0204.659] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0204.659] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.661] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.662] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.663] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.666] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.667] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.668] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.669] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.671] SetEvent (hEvent=0x124) returned 1
	[0204.671] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.672] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0204.672] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0204.707] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0204.707] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.709] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.712] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.713] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.715] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.716] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.718] SetEvent (hEvent=0x124) returned 1
	[0204.718] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.719] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0204.719] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0204.757] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0204.757] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.759] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.761] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.762] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.763] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.765] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.767] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.768] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.769] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.770] SetEvent (hEvent=0x124) returned 1
	[0204.770] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.772] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0204.772] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0204.828] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0204.828] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0204.846] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.452] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.552] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.556] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.557] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.560] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.562] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.563] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.564] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.565] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.566] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.568] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.569] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.570] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.572] SetEvent (hEvent=0x124) returned 1
	[0205.572] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.573] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0205.573] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0205.601] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0205.601] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.602] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.604] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.605] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.607] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.608] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.610] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.611] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.612] SetEvent (hEvent=0x124) returned 1
	[0205.612] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.613] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0205.613] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0205.642] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0205.642] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.644] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.645] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.647] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.648] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.650] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.651] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.652] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.654] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.655] SetEvent (hEvent=0x124) returned 1
	[0205.655] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.656] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0205.656] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0205.719] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0205.719] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.721] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.724] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.727] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.728] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.730] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.731] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.732] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.733] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.735] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.736] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.737] SetEvent (hEvent=0x124) returned 1
	[0205.737] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.738] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0205.738] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0205.840] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0205.840] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.847] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.849] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.850] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.851] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.852] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.854] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.855] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.856] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.858] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.860] SetEvent (hEvent=0x124) returned 1
	[0205.860] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0205.862] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0205.862] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0206.017] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0206.017] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.021] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.023] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.024] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.026] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.027] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.029] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.030] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.031] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.033] SetEvent (hEvent=0x124) returned 1
	[0206.033] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.036] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0206.036] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0206.075] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0206.076] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.078] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.079] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.080] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.081] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.084] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.085] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.087] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.089] SetEvent (hEvent=0x124) returned 1
	[0206.089] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.090] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0206.090] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0206.109] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0206.110] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.111] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.113] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.115] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.117] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.121] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.124] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.126] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.132] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.134] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.135] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.139] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.140] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.142] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.148] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.152] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.157] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.176] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.178] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.182] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.184] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.186] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.187] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.188] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.189] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.191] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.192] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.193] SetEvent (hEvent=0x124) returned 1
	[0206.193] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.195] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0206.195] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0206.205] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0206.205] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.215] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.217] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.220] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.221] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.222] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.225] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.227] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.230] SetEvent (hEvent=0x124) returned 1
	[0206.230] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.231] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0206.231] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0206.269] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0206.269] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.271] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.272] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.275] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.277] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.279] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.280] SetEvent (hEvent=0x124) returned 1
	[0206.280] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.281] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0206.282] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0206.308] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0206.308] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.309] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.311] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.312] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.313] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.314] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.318] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.319] SetEvent (hEvent=0x124) returned 1
	[0206.319] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.320] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0206.321] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0206.363] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0206.363] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.364] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.366] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.368] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.371] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.372] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.375] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.376] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.377] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.379] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.379] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.381] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.383] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.385] SetEvent (hEvent=0x124) returned 1
	[0206.385] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.386] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0206.387] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0206.433] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0206.433] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.435] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.436] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.438] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.439] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.440] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.443] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.444] SetEvent (hEvent=0x124) returned 1
	[0206.445] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.446] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0206.446] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0206.568] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0206.568] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.570] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.572] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.573] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.584] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.586] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.588] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.590] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.591] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.594] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.595] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.596] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.598] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.599] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.600] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.601] SetEvent (hEvent=0x124) returned 1
	[0206.601] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.605] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0206.605] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0206.628] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0206.628] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.630] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.633] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.634] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.635] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.638] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.642] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.643] SetEvent (hEvent=0x124) returned 1
	[0206.643] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.645] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0206.645] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0206.839] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0206.839] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.841] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.864] SetEvent (hEvent=0x124) returned 1
	[0206.864] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0206.866] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0206.866] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0207.051] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0207.051] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.053] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.053] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.055] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.058] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.059] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.060] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.063] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.064] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.065] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.067] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.079] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.084] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.088] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.091] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.093] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.094] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.095] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.097] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.098] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.099] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.100] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.102] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.105] SetEvent (hEvent=0x124) returned 1
	[0207.105] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.108] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.110] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.113] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.115] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.116] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.118] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.119] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.120] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.124] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.129] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.131] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.132] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.133] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.135] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.136] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.140] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.143] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.146] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.147] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.148] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.150] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.152] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.154] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.156] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.157] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.159] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.161] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.162] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.163] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.164] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.168] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.169] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.172] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.172] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.174] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.175] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.176] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.177] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.178] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.180] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.181] SetEvent (hEvent=0x124) returned 1
	[0207.181] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.182] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0207.182] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0207.187] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0207.187] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.189] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.190] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.193] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.194] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.196] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.197] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.198] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.200] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.201] SetEvent (hEvent=0x124) returned 1
	[0207.201] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.208] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.215] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.217] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.220] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.221] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.224] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.226] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.228] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.229] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.232] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.233] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.235] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.237] SetEvent (hEvent=0x124) returned 1
	[0207.237] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.238] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0207.238] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0207.252] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0207.252] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.296] SetEvent (hEvent=0x124) returned 1
	[0207.296] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.300] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.302] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.303] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.307] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.311] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.313] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.315] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.316] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.318] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.319] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.321] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.322] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.325] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.328] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.329] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.331] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.332] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.333] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.335] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.336] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.337] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.338] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.340] SetEvent (hEvent=0x124) returned 1
	[0207.340] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.341] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0207.341] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0207.353] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0207.354] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.358] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.359] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.361] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.362] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.363] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.365] SetEvent (hEvent=0x124) returned 1
	[0207.365] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.366] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0207.366] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0207.425] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0207.425] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.428] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.431] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.432] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.434] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.435] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.436] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.438] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.439] SetEvent (hEvent=0x124) returned 1
	[0207.439] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.440] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0207.440] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0207.485] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0207.485] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.487] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.491] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.493] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.494] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.495] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.496] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.497] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.498] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.500] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.501] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.502] SetEvent (hEvent=0x124) returned 1
	[0207.502] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.503] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0207.503] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0207.564] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0207.564] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.566] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.567] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.570] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.571] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.572] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.574] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.575] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.576] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.577] SetEvent (hEvent=0x124) returned 1
	[0207.577] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.579] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0207.579] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0207.613] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0207.613] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.615] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.618] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.620] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.622] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.623] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.624] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.626] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.627] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.628] SetEvent (hEvent=0x124) returned 1
	[0207.628] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.630] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0207.630] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0207.766] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0207.766] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.768] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.770] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.771] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.772] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.773] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.775] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.776] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.777] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.778] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.780] SetEvent (hEvent=0x124) returned 1
	[0207.780] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.781] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0207.781] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0207.910] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0207.910] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.911] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.912] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0207.916] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.004] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.025] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.029] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.031] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.032] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.033] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.035] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.036] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.038] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.043] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.053] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.054] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.081] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.085] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.088] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.091] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.097] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.099] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.102] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.103] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.114] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.120] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.123] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.125] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.127] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.128] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.129] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.131] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.132] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.134] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.138] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.140] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.143] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.144] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.145] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.147] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.148] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.149] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.151] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.152] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.153] SetEvent (hEvent=0x124) returned 1
	[0208.153] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.154] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0208.154] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0208.180] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0208.180] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.182] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.184] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.187] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.190] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.192] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.193] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.195] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.196] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.198] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.200] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.201] SetEvent (hEvent=0x124) returned 1
	[0208.201] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.204] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0208.204] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0208.239] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0208.239] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.242] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.246] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.255] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.257] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.261] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.264] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.265] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.267] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.268] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.269] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.271] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.272] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.273] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.275] SetEvent (hEvent=0x124) returned 1
	[0208.276] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.277] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0208.277] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0208.319] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0208.319] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.321] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.322] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.324] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.325] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.326] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.327] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.329] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.330] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.331] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.333] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.334] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.335] SetEvent (hEvent=0x124) returned 1
	[0208.335] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.336] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0208.336] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0208.413] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0208.413] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.415] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.418] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.420] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.421] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.422] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.425] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.426] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.427] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.429] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.431] SetEvent (hEvent=0x14c) returned 1
	[0208.431] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.433] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0208.433] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0208.497] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0208.498] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.499] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.500] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.501] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.503] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.504] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.505] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.507] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.508] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.509] SetEvent (hEvent=0x14c) returned 1
	[0208.509] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.510] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0208.510] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0208.596] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0208.596] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.598] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.600] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.601] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.603] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.604] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.605] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.607] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.608] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.609] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.610] SetEvent (hEvent=0x14c) returned 1
	[0208.610] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.612] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0208.612] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0208.614] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0208.614] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.616] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.617] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.618] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.619] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.620] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.622] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.623] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.627] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.629] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.630] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.632] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.634] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.635] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.636] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.639] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.642] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.650] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.651] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.653] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.654] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.655] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.656] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.659] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.661] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.665] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.669] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.675] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.681] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.682] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.684] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.685] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.686] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.687] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.690] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.692] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.693] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.694] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.697] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.698] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.699] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.701] SetEvent (hEvent=0x14c) returned 1
	[0208.701] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.703] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0208.703] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0208.711] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0208.711] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.713] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.724] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.725] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.726] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.728] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.729] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.730] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.731] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.732] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.733] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.734] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.736] SetEvent (hEvent=0x14c) returned 1
	[0208.736] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.737] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0208.737] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0208.792] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0208.792] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.795] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.799] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.810] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.812] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.823] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.825] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.830] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.831] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.833] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.834] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.835] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.837] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.838] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.839] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.840] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.842] SetEvent (hEvent=0x14c) returned 1
	[0208.842] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.843] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0208.843] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0208.870] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0208.871] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.872] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.873] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.874] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.876] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.877] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.878] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.879] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.880] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.882] SetEvent (hEvent=0x14c) returned 1
	[0208.882] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.883] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0208.884] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0208.890] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0208.890] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.891] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.892] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.893] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.896] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.898] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.899] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.900] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.901] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.903] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.904] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.907] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.910] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.963] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.967] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.968] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.970] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.971] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.972] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.973] SetEvent (hEvent=0x14c) returned 1
	[0208.973] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0208.975] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0208.975] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0209.002] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0209.003] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.005] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.006] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.007] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.010] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.011] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.012] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.014] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.016] SetEvent (hEvent=0x14c) returned 1
	[0209.016] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.017] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0209.017] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0209.043] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0209.043] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.044] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.046] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.047] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.048] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.049] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.051] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.052] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.053] SetEvent (hEvent=0x14c) returned 1
	[0209.053] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.055] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0209.055] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0209.071] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0209.071] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.072] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.074] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.075] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.076] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.078] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.079] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.080] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.081] SetEvent (hEvent=0x14c) returned 1
	[0209.081] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.083] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0209.083] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0209.137] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0209.137] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.139] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.140] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.161] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.163] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.165] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.166] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.168] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.169] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.174] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.176] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.178] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.181] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.197] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.202] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.204] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.205] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.206] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.207] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.209] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.210] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.212] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.213] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.214] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.218] SetEvent (hEvent=0x14c) returned 1
	[0209.218] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.219] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0209.219] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0209.366] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0209.366] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.367] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.368] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.370] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.371] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.372] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.373] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.378] SetEvent (hEvent=0x14c) returned 1
	[0209.378] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.381] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0209.381] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0209.512] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0209.512] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.514] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.515] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.516] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.518] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.519] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.520] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.522] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.523] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.524] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.526] SetEvent (hEvent=0x14c) returned 1
	[0209.526] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.527] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0209.527] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0209.569] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0209.570] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.578] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.580] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.582] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.583] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.584] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.585] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.586] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.588] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.590] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.598] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.599] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.601] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.604] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.605] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.607] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.609] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.610] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.618] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.620] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.622] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.629] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.631] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.632] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.634] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.641] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.643] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.647] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.659] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.660] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.662] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.664] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.666] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.667] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.669] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.670] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.672] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.675] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.676] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.679] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.682] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.684] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.686] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.689] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.690] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.692] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.694] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.697] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.698] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.699] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.701] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.702] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.704] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.706] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.707] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.709] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.713] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.714] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.716] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.717] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.719] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.720] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.727] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.728] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.729] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.731] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.732] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.734] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.735] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.738] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.740] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.742] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.744] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.746] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.748] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.752] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.754] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.755] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.756] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.757] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.759] SetEvent (hEvent=0x14c) returned 1
	[0209.759] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.760] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0209.760] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0209.784] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0209.785] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.786] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.787] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.788] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.789] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.792] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.793] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.794] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.795] SetEvent (hEvent=0x14c) returned 1
	[0209.795] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.796] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0209.797] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0209.826] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0209.826] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.828] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.829] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.830] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.834] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.834] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.836] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.837] SetEvent (hEvent=0x14c) returned 1
	[0209.837] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.838] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0209.839] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0209.913] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0209.913] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.973] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.981] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.981] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.982] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.984] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.985] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.986] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.988] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.989] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.990] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.991] SetEvent (hEvent=0x14c) returned 1
	[0209.991] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0209.993] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0209.993] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0210.084] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0210.084] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.087] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.088] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.090] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.095] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.097] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.099] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.115] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.117] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.119] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.120] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.122] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.124] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.128] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.131] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.134] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.135] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.136] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.139] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.141] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.143] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.145] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.148] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.150] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.152] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.153] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.155] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.156] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.157] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.158] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.159] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.161] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.162] SetEvent (hEvent=0x14c) returned 1
	[0210.162] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.163] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0210.163] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0210.279] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0210.280] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.333] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.338] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.340] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.341] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.343] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.346] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.349] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.353] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.356] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.357] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.360] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.361] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.363] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.370] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.384] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.386] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.388] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.391] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.392] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.394] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.395] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.402] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.404] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.408] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.414] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.417] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.419] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.439] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.439] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.440] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.442] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.443] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.445] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.447] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.548] SetEvent (hEvent=0x14c) returned 1
	[0210.549] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.554] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.556] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.558] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.561] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.563] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.564] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.567] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.569] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.570] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.571] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.574] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.578] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.580] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.583] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.585] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.588] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.589] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.590] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.592] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.593] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.594] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.598] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.601] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.602] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.604] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.605] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.606] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.607] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.609] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.610] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.612] SetEvent (hEvent=0x14c) returned 1
	[0210.612] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.613] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0210.613] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0210.628] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0210.628] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.629] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.631] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.632] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.634] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.635] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.637] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.638] SetEvent (hEvent=0x14c) returned 1
	[0210.638] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.639] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0210.639] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0210.655] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0210.655] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.657] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.658] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.659] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.660] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.661] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.663] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.664] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.665] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.667] SetEvent (hEvent=0x14c) returned 1
	[0210.667] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.668] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0210.668] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0210.767] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0210.767] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.769] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.770] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.772] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.773] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.775] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.777] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.778] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.779] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.780] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.783] SetEvent (hEvent=0x14c) returned 1
	[0210.783] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.784] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0210.784] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0210.866] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0210.866] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.868] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.869] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.873] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.873] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.875] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.876] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.877] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.878] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.880] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.882] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.886] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.887] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.889] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.892] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.894] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.896] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.897] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.901] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.903] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.905] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.907] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.910] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.912] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.914] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.915] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.918] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.920] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.954] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.956] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.958] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.960] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.963] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.965] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.966] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.968] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.969] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.970] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.971] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.973] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.977] SetEvent (hEvent=0x14c) returned 1
	[0210.977] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.978] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0210.979] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0210.985] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0210.986] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.988] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.991] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.991] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.993] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.994] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.996] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.997] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0210.999] SetEvent (hEvent=0x14c) returned 1
	[0210.999] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.000] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0211.000] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0211.175] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0211.175] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.177] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.179] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.180] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.199] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.201] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.203] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.207] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.208] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.210] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.211] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.212] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.215] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.217] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.218] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.220] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.221] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.225] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.226] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.227] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.229] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.230] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.231] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.233] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.234] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.235] SetEvent (hEvent=0x14c) returned 1
	[0211.235] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.236] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0211.236] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0211.266] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0211.267] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.272] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.274] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.275] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.281] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.283] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.287] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.292] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.294] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.295] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.297] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.298] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.300] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.301] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.303] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.304] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.307] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.308] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.322] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.326] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.327] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.332] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.336] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.340] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.341] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0211.342] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0211.347] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0211.347] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.349] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.350] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.352] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.356] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.358] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.360] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.361] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.363] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.364] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.366] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.367] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.368] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.370] SetEvent (hEvent=0x174) returned 1
	[0211.370] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.371] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0211.371] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0211.401] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0211.401] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.402] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.404] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.406] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.407] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.408] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.410] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.411] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.412] SetEvent (hEvent=0x174) returned 1
	[0211.412] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.413] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0211.413] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0211.433] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0211.433] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.435] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.437] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.438] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.439] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.441] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.442] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.444] SetEvent (hEvent=0x174) returned 1
	[0211.444] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.445] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0211.445] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0211.502] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0211.502] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.505] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.506] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.507] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.509] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.510] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.511] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.513] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.514] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.515] SetEvent (hEvent=0x174) returned 1
	[0211.515] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.516] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0211.516] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0211.624] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0211.624] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.625] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.627] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.628] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.629] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.630] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.632] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.633] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.635] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.636] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.637] SetEvent (hEvent=0x174) returned 1
	[0211.637] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.638] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0211.638] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0211.829] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0211.829] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.831] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.832] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.833] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.834] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.836] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.837] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.840] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.846] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.847] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.849] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.850] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.853] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.856] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.861] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.864] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.866] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.867] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.868] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.870] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.873] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.875] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.876] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.878] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.880] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.883] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.886] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.903] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.904] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.905] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.906] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.911] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.912] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.915] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.938] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.940] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.941] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.943] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.944] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.945] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.946] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.947] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.949] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.950] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.951] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.953] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.954] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.956] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.958] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.959] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.960] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.962] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.963] SetEvent (hEvent=0x174) returned 1
	[0211.963] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.964] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0211.965] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0211.971] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0211.971] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.973] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.974] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.975] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.976] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.977] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.979] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.980] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.981] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.982] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.984] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.985] SetEvent (hEvent=0x174) returned 1
	[0211.985] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0211.987] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0211.987] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0211.999] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0211.999] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.000] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.001] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.003] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.004] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.005] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.007] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.008] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.010] SetEvent (hEvent=0x174) returned 1
	[0212.010] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.011] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0212.011] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0212.030] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0212.030] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.033] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.034] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.036] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.037] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.038] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.040] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.041] SetEvent (hEvent=0x174) returned 1
	[0212.041] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.043] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0212.043] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0212.050] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0212.050] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.053] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.056] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.058] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.059] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.061] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.062] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.063] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.067] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.072] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.076] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.078] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.079] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.080] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.081] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.082] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.083] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.084] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.085] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.086] SetEvent (hEvent=0x174) returned 1
	[0212.086] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.088] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0212.088] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0212.103] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0212.103] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.105] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.107] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.110] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.111] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.112] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.113] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.115] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.116] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.117] SetEvent (hEvent=0x174) returned 1
	[0212.117] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.118] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0212.118] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0212.171] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0212.171] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.174] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.175] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.177] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.178] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.179] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.180] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.181] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.183] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.184] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.185] SetEvent (hEvent=0x174) returned 1
	[0212.185] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.186] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0212.186] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0212.216] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0212.216] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.218] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.219] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.220] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.222] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.223] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.224] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.225] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.227] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.228] SetEvent (hEvent=0x174) returned 1
	[0212.228] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.229] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0212.229] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0212.294] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0212.294] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.296] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.297] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.299] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.300] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.301] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.303] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.304] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.306] SetEvent (hEvent=0x174) returned 1
	[0212.306] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.307] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0212.307] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0212.319] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0212.319] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.321] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.323] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.325] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.326] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.328] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.329] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.330] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.331] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.332] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.334] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.335] SetEvent (hEvent=0x174) returned 1
	[0212.335] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.337] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0212.337] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0212.531] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0212.535] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.545] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.549] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.555] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.557] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.558] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.559] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.560] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.562] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.563] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.564] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.565] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.571] SetEvent (hEvent=0x174) returned 1
	[0212.571] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.572] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0212.572] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0212.879] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0212.880] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.881] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.886] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.895] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.900] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.902] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.907] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.913] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.914] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.916] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.917] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.919] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.922] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.924] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.925] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.932] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.934] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.936] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.937] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.939] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.940] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.942] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.947] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.949] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.950] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.953] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.963] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.964] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.966] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.970] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.972] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.974] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.975] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.984] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.986] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.987] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.988] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.989] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.991] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.993] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.993] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.995] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.998] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0212.999] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.000] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.003] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.007] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.008] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.008] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.012] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.015] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.015] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.020] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.021] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.024] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.026] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.028] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.034] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.035] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.038] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.039] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.040] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.042] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.044] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.046] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.048] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.050] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.051] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.054] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.057] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.059] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.060] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.062] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.064] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.067] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.068] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.069] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.071] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.073] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.075] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.077] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.079] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.081] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.082] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.084] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.085] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.088] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.091] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.093] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.095] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.096] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.097] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.101] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.105] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.106] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.107] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.109] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.110] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.112] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.113] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.115] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.116] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.117] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.119] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.120] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.121] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.123] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.124] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.126] SetEvent (hEvent=0x174) returned 1
	[0213.126] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.127] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0213.127] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0213.132] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0213.133] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.136] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.137] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.140] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.145] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.147] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.149] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.150] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.151] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.152] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.153] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.155] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.156] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.157] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.159] SetEvent (hEvent=0x174) returned 1
	[0213.159] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.160] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0213.160] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0213.181] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0213.182] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.183] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.185] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.190] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.191] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.193] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.198] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.199] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.201] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.203] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.204] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.205] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.208] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.209] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.212] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.214] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.215] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.217] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.218] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.219] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.222] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.223] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.225] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.227] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.228] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.230] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.232] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.233] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.237] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.239] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.241] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.242] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.244] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.245] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.246] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.247] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.248] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.250] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.251] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.252] SetEvent (hEvent=0x174) returned 1
	[0213.252] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.253] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0213.254] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0213.280] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0213.280] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.281] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.283] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.285] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.286] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.288] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.289] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.290] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.292] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.294] SetEvent (hEvent=0x174) returned 1
	[0213.294] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.297] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0213.297] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0213.327] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0213.327] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.329] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.331] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.332] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.334] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.335] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.336] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.338] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.340] SetEvent (hEvent=0x174) returned 1
	[0213.340] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.341] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0213.342] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0213.378] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0213.378] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.380] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.381] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.383] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.384] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.385] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.387] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.388] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.389] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.390] SetEvent (hEvent=0x174) returned 1
	[0213.390] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.392] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0213.392] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0213.497] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0213.498] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.500] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.501] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.502] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.505] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.508] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.508] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.510] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.511] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.512] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.513] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.515] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.516] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.518] SetEvent (hEvent=0x174) returned 1
	[0213.518] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.519] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0213.519] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0213.666] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0213.666] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.668] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.671] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.672] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.674] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.675] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.677] SetEvent (hEvent=0x174) returned 1
	[0213.677] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.678] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0213.678] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0213.694] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0213.694] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.696] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.697] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.705] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.709] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.710] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.712] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.719] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.726] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.728] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.729] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.730] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.733] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.735] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.738] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.739] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.742] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.743] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.745] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.748] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.749] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.750] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.751] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.752] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.754] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.757] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.759] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.763] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.764] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.766] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.768] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.770] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.773] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.775] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.776] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.778] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.779] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.781] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.783] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.785] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.786] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.788] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.789] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.790] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.791] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.795] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.798] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.799] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.801] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.802] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.803] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.805] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.807] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.808] SetEvent (hEvent=0x174) returned 1
	[0213.808] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.811] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.812] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.814] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.815] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.816] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.818] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.821] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.823] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.824] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.825] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.826] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.827] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.828] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.830] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.833] SetEvent (hEvent=0x174) returned 1
	[0213.833] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.835] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.836] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.840] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.841] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.844] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.845] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.847] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.848] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.849] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.851] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.852] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.853] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.854] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.857] SetEvent (hEvent=0x174) returned 1
	[0213.857] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.859] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.860] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.863] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.864] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.865] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.867] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.868] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.869] SetEvent (hEvent=0x174) returned 1
	[0213.869] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.871] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0213.871] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0213.876] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0213.876] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.878] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.879] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.880] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.882] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.884] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.885] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.887] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.888] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.889] SetEvent (hEvent=0x174) returned 1
	[0213.889] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.890] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0213.890] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0213.895] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0213.895] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.901] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.902] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.903] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.904] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.907] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.908] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.910] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.911] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.912] SetEvent (hEvent=0x174) returned 1
	[0213.912] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.916] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0213.917] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0213.927] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0213.927] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.929] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.930] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.931] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.934] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.934] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.935] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.937] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.938] SetEvent (hEvent=0x174) returned 1
	[0213.938] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.939] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0213.940] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0213.951] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0213.951] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.953] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.954] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.955] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.957] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.958] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.959] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.960] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.962] SetEvent (hEvent=0x174) returned 1
	[0213.962] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.963] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0213.964] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0213.975] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0213.976] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.979] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.980] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.982] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.983] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.984] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.985] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.986] SetEvent (hEvent=0x174) returned 1
	[0213.986] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0213.988] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0213.988] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0214.006] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0214.006] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.009] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.010] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.012] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.013] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.014] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.016] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.017] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.018] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.019] SetEvent (hEvent=0x174) returned 1
	[0214.019] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.021] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0214.021] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0214.043] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0214.043] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.046] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.048] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.049] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.050] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.052] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.053] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.054] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.056] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.057] SetEvent (hEvent=0x174) returned 1
	[0214.057] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.060] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0214.060] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0214.105] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0214.105] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.108] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.109] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.111] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.112] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.114] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.115] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.116] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.118] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.119] SetEvent (hEvent=0x174) returned 1
	[0214.119] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.121] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0214.121] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0214.142] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0214.142] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.144] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.145] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.149] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.153] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.154] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.156] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.158] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.159] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.160] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.169] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.190] SetEvent (hEvent=0x174) returned 1
	[0214.190] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.192] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0214.192] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0214.205] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0214.205] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.208] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.210] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.211] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.213] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.214] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.215] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.216] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.217] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.218] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.220] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.221] SetEvent (hEvent=0x174) returned 1
	[0214.221] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.222] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0214.222] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0214.228] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0214.228] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.229] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.231] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.232] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.235] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.236] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.238] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.239] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.240] SetEvent (hEvent=0x174) returned 1
	[0214.240] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.241] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0214.241] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0214.288] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0214.288] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.299] SetEvent (hEvent=0x174) returned 1
	[0214.299] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.305] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0214.305] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0214.313] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0214.313] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.329] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.331] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.332] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.335] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.341] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.343] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.344] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.347] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.349] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.350] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.352] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.358] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.363] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.364] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.365] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.367] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.368] SetEvent (hEvent=0x174) returned 1
	[0214.368] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.369] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0214.369] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0214.382] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0214.382] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.384] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.386] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.387] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.389] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.391] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.392] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.393] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.395] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.397] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.399] SetEvent (hEvent=0x174) returned 1
	[0214.399] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.400] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0214.400] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0214.451] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0214.451] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.456] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.484] SetEvent (hEvent=0x174) returned 1
	[0214.484] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.486] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0214.486] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0214.567] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0214.567] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.570] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.572] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.574] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.575] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.577] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.578] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.579] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.581] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.582] SetEvent (hEvent=0x174) returned 1
	[0214.582] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.583] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0214.583] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0214.632] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0214.632] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.635] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.639] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.640] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.642] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.644] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.645] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.647] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.649] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.650] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.655] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.658] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.660] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.661] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.663] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.664] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.665] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.666] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.668] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.669] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.671] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.674] SetEvent (hEvent=0x174) returned 1
	[0214.674] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.675] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0214.675] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0214.685] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0214.686] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.688] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.689] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.690] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.692] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.693] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.694] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.696] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.697] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.698] SetEvent (hEvent=0x174) returned 1
	[0214.699] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.699] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0214.700] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0214.721] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0214.721] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.723] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.723] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.725] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.727] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.728] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.729] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.731] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.732] SetEvent (hEvent=0x174) returned 1
	[0214.732] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.733] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0214.733] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0214.765] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0214.765] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.766] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.768] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.769] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.770] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.772] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.774] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.775] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.776] SetEvent (hEvent=0x174) returned 1
	[0214.777] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.778] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0214.778] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0214.815] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0214.815] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.818] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.821] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.822] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.825] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.826] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.827] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.829] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.830] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.836] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.837] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.839] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.840] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.841] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.843] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.844] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.848] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.863] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.865] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.867] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.869] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.871] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.872] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.873] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.875] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.876] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.881] SetEvent (hEvent=0x124) returned 1
	[0214.881] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.883] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0214.883] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0214.892] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0214.892] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.899] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.903] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.904] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.905] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.907] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.908] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.909] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.910] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.912] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.915] SetEvent (hEvent=0x124) returned 1
	[0214.915] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.917] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0214.917] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0214.933] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0214.934] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.935] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.936] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.938] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.939] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.941] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.942] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.943] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.944] SetEvent (hEvent=0x124) returned 1
	[0214.944] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.945] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0214.945] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0214.952] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0214.953] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.956] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.957] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.959] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.960] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.964] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.967] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.968] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.969] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.970] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.971] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.973] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.974] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.975] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.981] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.991] SetEvent (hEvent=0x124) returned 1
	[0214.991] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.995] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0214.999] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.003] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.004] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.008] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.014] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.016] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.017] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.018] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.019] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.024] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.027] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.028] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.029] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.030] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.032] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.033] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.074] SetEvent (hEvent=0x124) returned 1
	[0215.074] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.078] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0215.078] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0215.081] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0215.081] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.084] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.085] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.086] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.088] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.089] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.091] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.094] SetEvent (hEvent=0x124) returned 1
	[0215.094] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.096] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0215.096] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0215.253] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0215.253] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.255] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.256] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.258] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.265] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.266] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.268] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.270] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.273] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.274] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.276] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.279] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.281] SetEvent (hEvent=0x124) returned 1
	[0215.281] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.283] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0215.283] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0215.303] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0215.303] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.306] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.309] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.312] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.315] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.317] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.321] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.321] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.325] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.329] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.331] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.333] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.334] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.336] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.339] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.341] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.343] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.346] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.347] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.357] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.360] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.361] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.362] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.363] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.365] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.371] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.374] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.379] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.386] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.388] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.389] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.391] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.393] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.395] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.397] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.398] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.401] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.402] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.404] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.406] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.408] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.409] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.411] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.413] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.417] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.419] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.420] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.422] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.423] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.424] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.426] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.427] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.428] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.430] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.432] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.433] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.434] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.436] SetEvent (hEvent=0x124) returned 1
	[0215.436] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.437] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0215.437] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0215.497] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0215.497] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.498] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.501] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.501] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.503] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.504] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.507] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.513] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.515] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.517] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.518] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.520] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.521] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.522] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.524] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.525] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.526] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.528] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.529] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.534] SetEvent (hEvent=0x124) returned 1
	[0215.534] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.547] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0215.547] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0215.555] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0215.555] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.557] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.559] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.563] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.565] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.566] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.571] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.572] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.573] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.574] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.575] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.577] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.578] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.581] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.584] SetEvent (hEvent=0x124) returned 1
	[0215.584] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.585] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0215.585] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0215.645] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0215.645] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.647] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.648] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.650] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.651] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.652] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.653] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.655] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.656] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.657] SetEvent (hEvent=0x124) returned 1
	[0215.657] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.658] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0215.659] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0215.796] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0215.797] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.800] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.801] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.802] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.804] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.805] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.807] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.807] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.808] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.810] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.811] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.812] SetEvent (hEvent=0x124) returned 1
	[0215.812] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.813] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0215.813] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0215.910] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0215.911] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.912] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.913] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.914] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.917] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.921] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.923] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.939] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.942] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.944] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.945] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.947] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.950] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.952] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.953] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.955] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.956] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.959] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.964] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.966] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.969] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.971] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.973] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.975] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.976] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.977] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.980] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.983] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.984] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.986] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.988] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.990] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.992] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.993] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.995] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.997] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0215.998] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.000] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.001] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.002] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.004] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.005] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.007] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.009] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.010] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.012] SetEvent (hEvent=0x124) returned 1
	[0216.012] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.015] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.016] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.018] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.019] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.020] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.022] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.023] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.026] SetEvent (hEvent=0x124) returned 1
	[0216.026] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.034] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.036] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.037] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.038] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.039] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.041] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.042] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.044] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.045] SetEvent (hEvent=0x124) returned 1
	[0216.045] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.048] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0216.048] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0216.094] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0216.094] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.096] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.098] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.099] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.100] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.101] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.103] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.104] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.105] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.107] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.108] SetEvent (hEvent=0x124) returned 1
	[0216.108] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.109] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0216.109] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0216.130] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0216.130] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.132] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.133] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.135] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.138] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.140] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.142] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.143] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.144] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.146] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.148] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.149] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.152] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.153] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.155] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.158] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.160] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.160] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.162] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.164] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.165] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.166] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.167] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.169] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.170] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.171] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.173] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.174] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.175] SetEvent (hEvent=0x124) returned 1
	[0216.175] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.176] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0216.176] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0216.271] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0216.271] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.274] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.275] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.277] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.278] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.280] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.282] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.284] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.286] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.290] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.292] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.294] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.295] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.296] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.300] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.301] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.303] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.305] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.307] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.310] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.311] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.312] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.314] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.316] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.319] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.321] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.322] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.323] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.326] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.328] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.330] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.336] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.338] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.339] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.340] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.342] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.343] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.346] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.347] SetEvent (hEvent=0x124) returned 1
	[0216.347] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.348] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0216.349] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0216.535] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0216.535] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.545] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.547] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.586] SetEvent (hEvent=0x124) returned 1
	[0216.586] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.589] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.591] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.592] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.593] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.594] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.595] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.597] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.599] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.600] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.601] SetEvent (hEvent=0x124) returned 1
	[0216.601] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.603] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0216.603] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0216.604] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0216.604] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.606] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.607] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.608] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.610] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.611] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.612] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.613] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.615] SetEvent (hEvent=0x124) returned 1
	[0216.615] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.616] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0216.616] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0216.628] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0216.629] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.630] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.635] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.636] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.639] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.641] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.642] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.643] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.644] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.646] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.647] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.648] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.652] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.655] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.657] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.659] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.661] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.663] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.664] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.666] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.667] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.671] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.672] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.674] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.675] SetEvent (hEvent=0x124) returned 1
	[0216.675] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.678] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.679] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.681] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.682] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.684] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.688] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.690] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.692] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.696] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.697] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.702] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.705] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.710] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.711] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.713] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.715] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.718] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.721] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.724] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.727] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.728] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.729] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.731] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.733] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.734] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.735] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.736] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.738] SetEvent (hEvent=0x124) returned 1
	[0216.738] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.739] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0216.739] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0216.762] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0216.763] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.764] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.766] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.767] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.768] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.769] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.770] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.772] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.773] SetEvent (hEvent=0x124) returned 1
	[0216.773] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.775] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0216.775] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0216.816] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0216.816] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.817] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.819] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.821] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.822] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.823] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.824] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.825] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.830] SetEvent (hEvent=0x124) returned 1
	[0216.830] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.832] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0216.832] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0216.891] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0216.892] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.893] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.895] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.897] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.898] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.900] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.902] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.906] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.908] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.909] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.911] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.914] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.916] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.917] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.919] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.924] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.925] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.926] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.928] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.929] SetEvent (hEvent=0x14c) returned 1
	[0216.929] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0216.930] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0216.930] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0217.062] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0217.063] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.064] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.065] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.066] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.068] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.069] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.071] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.072] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.074] SetEvent (hEvent=0x14c) returned 1
	[0217.074] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.075] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0217.076] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0217.224] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0217.224] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.227] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.229] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.231] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.232] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.238] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.241] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.242] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.245] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.247] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.249] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.251] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.254] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.255] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.256] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.258] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.259] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.260] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.262] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.263] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.264] SetEvent (hEvent=0x14c) returned 1
	[0217.264] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.265] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0217.265] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0217.269] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0217.269] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.272] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.274] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.275] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.276] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.278] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.279] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.280] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.281] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.282] SetEvent (hEvent=0x14c) returned 1
	[0217.282] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.284] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0217.284] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0217.288] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0217.288] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.290] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.291] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.292] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.294] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.295] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.296] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.298] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.301] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.303] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.304] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.307] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.309] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.311] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.313] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.314] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.319] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.322] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.323] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.325] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.326] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.330] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.332] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.334] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.338] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.340] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.342] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.344] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.345] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.346] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.348] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.353] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.355] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.358] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.361] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.363] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.366] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.367] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.369] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.370] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.373] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.374] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.375] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.377] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.378] SetEvent (hEvent=0x14c) returned 1
	[0217.378] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.380] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0217.380] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0217.390] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0217.390] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.392] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.395] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.397] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.398] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.400] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.401] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.402] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.404] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.404] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.406] SetEvent (hEvent=0x14c) returned 1
	[0217.406] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.407] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0217.407] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0217.428] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0217.428] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.430] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.431] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.433] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.435] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.437] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.438] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.440] SetEvent (hEvent=0x14c) returned 1
	[0217.440] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.441] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0217.441] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0217.452] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0217.453] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.456] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.504] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.505] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.507] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.508] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.509] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.510] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.511] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.513] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.514] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.515] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.516] SetEvent (hEvent=0x14c) returned 1
	[0217.516] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.517] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0217.517] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0217.579] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0217.579] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.582] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.585] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.586] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.587] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.589] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.590] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.591] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.593] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.594] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.595] SetEvent (hEvent=0x14c) returned 1
	[0217.596] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.596] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0217.597] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0217.818] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0217.818] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.824] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.826] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.827] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.828] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.830] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.832] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.833] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.834] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.835] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.836] SetEvent (hEvent=0x14c) returned 1
	[0217.836] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0217.837] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0217.838] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0218.130] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0218.131] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.132] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.133] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.140] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.143] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.148] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.149] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.150] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.151] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.157] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.158] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.160] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.162] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.163] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.164] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.167] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.169] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.172] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.174] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.175] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.177] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.178] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.179] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.180] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.182] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.183] SetEvent (hEvent=0x14c) returned 1
	[0218.183] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.184] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0218.184] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0218.195] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0218.195] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.198] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.200] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.201] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.203] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.205] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.207] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.208] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.212] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.220] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.221] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.222] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.223] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.227] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.231] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.233] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.235] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.236] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.238] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.239] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.241] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.242] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.243] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.245] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.246] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.247] SetEvent (hEvent=0x14c) returned 1
	[0218.247] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.248] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0218.248] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0218.262] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0218.262] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.265] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.267] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.267] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.269] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.271] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.272] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.275] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.277] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.279] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.281] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.282] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.285] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.286] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.289] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.291] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.292] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.295] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.296] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.298] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.299] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.305] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.316] SetEvent (hEvent=0x14c) returned 1
	[0218.316] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.320] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.322] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.324] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.326] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.328] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.331] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.340] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.343] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.345] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.346] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.348] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.350] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.352] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.353] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.370] SetEvent (hEvent=0x14c) returned 1
	[0218.370] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.377] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.380] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.383] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.384] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.386] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.388] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.389] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.391] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.396] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.399] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.402] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.404] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.408] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.410] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.412] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.413] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.414] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.416] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.417] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.420] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.421] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.423] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.430] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.432] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.435] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.436] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.439] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.442] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.444] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.446] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.449] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.452] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.455] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.550] SetEvent (hEvent=0x14c) returned 1
	[0218.550] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.557] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.562] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.564] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.567] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.571] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.574] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.578] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.581] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.584] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.590] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.593] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.595] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.598] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.601] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.603] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.604] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.605] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.609] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.612] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.614] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.618] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.620] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.622] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.626] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.627] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.628] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.629] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.632] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.633] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.635] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.636] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.638] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.641] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.646] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.651] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.653] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.656] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.660] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.662] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.665] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.667] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.669] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.674] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.676] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.679] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.680] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.681] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.684] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.686] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.690] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.694] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.696] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.698] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.701] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.704] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.706] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.707] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.710] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.712] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.715] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.717] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.719] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.720] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.724] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.726] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.728] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.729] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.731] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.735] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.737] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.738] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.739] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.740] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.742] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.745] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.755] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.760] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.771] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.776] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.781] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.782] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.785] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.788] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.790] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.791] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.794] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.796] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.799] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.802] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.804] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.806] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.810] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.816] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.827] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.829] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.831] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.832] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.833] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.835] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.836] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.837] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.839] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.840] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.841] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.845] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.847] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.848] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.849] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.851] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.854] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.857] SetEvent (hEvent=0x14c) returned 1
	[0218.857] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0218.858] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0218.858] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0219.275] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0219.275] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.277] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.278] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.279] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.296] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.298] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.299] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.300] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.301] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.302] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.304] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.305] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.308] SetEvent (hEvent=0x14c) returned 1
	[0219.308] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.311] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.313] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.314] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.316] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.319] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.330] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.333] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.342] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.343] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.355] SetEvent (hEvent=0x14c) returned 1
	[0219.355] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.375] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.378] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.381] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.382] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.383] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.384] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.386] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.387] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.390] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.391] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.395] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.396] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.398] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.399] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.401] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.405] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.407] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.409] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.415] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.417] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.419] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.428] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.431] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.433] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.444] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.445] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.450] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.506] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.509] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.510] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.512] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.513] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.516] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.519] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.520] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.522] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.523] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.526] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.528] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.530] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.534] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.535] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.546] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.547] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.549] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.550] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.551] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.553] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.555] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.558] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.560] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.561] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.562] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.565] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.567] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.570] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.572] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.573] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.576] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.577] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.579] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.580] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.583] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.586] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.588] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.590] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.594] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.596] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.600] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.603] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.605] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.607] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.610] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.612] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.615] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.619] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.621] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.628] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.631] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.632] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.635] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.640] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.642] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.644] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.645] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.648] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.650] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.652] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.653] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.654] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.655] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.656] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.662] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.663] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.667] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.671] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.672] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.674] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.675] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.679] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.681] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.682] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.683] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.685] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.687] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.689] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.690] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.692] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.694] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.697] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.699] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.701] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.703] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.706] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.710] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.713] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.717] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.721] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.734] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.735] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.737] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.738] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.739] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.741] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.746] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.748] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.749] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.751] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.754] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.756] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.759] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.761] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.763] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.766] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.771] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.775] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.778] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.781] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.783] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.787] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.789] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.791] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.798] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.800] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.801] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.803] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.806] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.811] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.813] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.815] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.817] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.819] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.822] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.823] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.825] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.827] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.829] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.830] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.832] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.833] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.835] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.837] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.838] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.841] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.843] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.845] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.846] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.851] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.853] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.854] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.855] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.859] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.862] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.864] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.865] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.866] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.868] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.872] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.875] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.878] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.880] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.881] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.882] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.883] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.885] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.889] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.892] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.893] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.895] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.897] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.899] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.902] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.909] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.910] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.912] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.913] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.915] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.916] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.917] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.919] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.923] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.924] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.930] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.933] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.934] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.935] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.937] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.938] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.942] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.944] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.947] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.948] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.951] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.959] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.961] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.963] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.965] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.967] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.968] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.970] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.971] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.973] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.976] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.978] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.978] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.980] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.982] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.984] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.986] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.988] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.989] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.991] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.993] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.994] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.996] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.997] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0219.999] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.001] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.002] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.003] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.005] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.006] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.006] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.008] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.009] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.012] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.013] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.015] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.016] SetEvent (hEvent=0x174) returned 1
	[0220.016] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.018] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0220.018] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0220.320] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0220.321] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.323] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.324] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.330] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.332] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.334] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.335] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.336] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.340] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.342] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.343] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.344] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.345] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.347] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.349] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.352] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.354] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.356] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.358] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.359] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.360] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.362] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.363] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.364] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.365] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.367] SetEvent (hEvent=0x174) returned 1
	[0220.367] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.368] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0220.368] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0220.494] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0220.494] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.495] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.496] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.498] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.498] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.500] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.502] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.503] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.506] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.508] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.510] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.511] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.515] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.516] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.517] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.518] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.525] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.534] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.535] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.543] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.545] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.546] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.550] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.551] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.553] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.557] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.559] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.560] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.561] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.563] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.564] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.566] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.567] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.569] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.572] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.574] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.575] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.577] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.580] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.582] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.584] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.585] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.589] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.590] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.595] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.597] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.599] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.600] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.603] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.606] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.608] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.616] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.620] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.621] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.622] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.623] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.625] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.626] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.627] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.629] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.630] SetEvent (hEvent=0x174) returned 1
	[0220.630] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.631] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0220.631] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0220.643] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0220.643] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.646] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.647] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.649] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.650] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.652] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.653] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.655] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.656] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.671] SetEvent (hEvent=0x174) returned 1
	[0220.672] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.688] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.690] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.691] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.694] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.695] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.696] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.698] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.699] SetEvent (hEvent=0x174) returned 1
	[0220.699] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.704] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.707] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.710] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.713] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.715] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.716] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.718] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.719] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.720] SetEvent (hEvent=0x174) returned 1
	[0220.720] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.722] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0220.722] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0220.741] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0220.741] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.743] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.745] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.746] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.748] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.749] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.750] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.751] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.752] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.753] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.755] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.756] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.758] SetEvent (hEvent=0x174) returned 1
	[0220.758] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.761] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0220.761] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0220.785] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0220.786] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.787] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.789] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.789] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.795] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.797] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.805] SetEvent (hEvent=0x174) returned 1
	[0220.805] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.815] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.819] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.821] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.827] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.831] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.833] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.836] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.841] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.876] SetEvent (hEvent=0x174) returned 1
	[0220.876] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.880] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.887] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.888] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.893] SetEvent (hEvent=0x174) returned 1
	[0220.893] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.905] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0220.906] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0220.938] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0220.938] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.940] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.942] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.943] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.944] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.946] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.949] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.950] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.952] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.955] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.958] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.960] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.962] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.964] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.971] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.974] SetEvent (hEvent=0x124) returned 1
	[0220.975] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0220.978] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0220.978] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0221.098] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0221.098] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.100] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.101] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.104] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.107] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.109] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.117] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.120] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.121] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.123] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.128] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.136] SetEvent (hEvent=0x124) returned 1
	[0221.136] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.158] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0221.158] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0221.214] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0221.214] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.226] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.232] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.234] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.238] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.240] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.242] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.244] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.245] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.254] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.257] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.259] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.262] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.263] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.268] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.269] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.274] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.277] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.281] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.283] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.285] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.294] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.302] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.305] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.307] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.312] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.315] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.325] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.326] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.336] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.338] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.343] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.351] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.354] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.355] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.358] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.367] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.368] SetEvent (hEvent=0x124) returned 1
	[0221.368] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.373] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0221.373] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0221.385] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0221.385] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.387] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.397] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.406] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.430] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.433] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.434] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.438] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.443] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.445] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.446] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.450] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.453] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.491] SetEvent (hEvent=0x124) returned 1
	[0221.491] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.497] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.500] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.503] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.510] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.511] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.512] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.520] SetEvent (hEvent=0x124) returned 1
	[0221.520] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.535] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.544] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.549] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.552] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.553] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.556] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.557] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.560] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.562] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.564] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.566] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.571] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.581] SetEvent (hEvent=0x124) returned 1
	[0221.581] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.583] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0221.583] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0221.593] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0221.594] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.596] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.598] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.600] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.601] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.608] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.616] SetEvent (hEvent=0x124) returned 1
	[0221.616] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.617] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0221.617] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0221.634] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0221.634] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.636] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.657] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.659] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.660] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.664] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.665] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.667] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.669] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.671] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.676] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.678] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.679] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.681] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.697] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.708] SetEvent (hEvent=0x124) returned 1
	[0221.708] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.709] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0221.709] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0221.761] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0221.761] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.767] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.787] SetEvent (hEvent=0x124) returned 1
	[0221.787] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.789] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.795] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.811] SetEvent (hEvent=0x124) returned 1
	[0221.811] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.812] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.826] SetEvent (hEvent=0x124) returned 1
	[0221.826] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.835] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0221.835] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0221.846] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0221.846] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.847] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.868] SetEvent (hEvent=0x124) returned 1
	[0221.868] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.869] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0221.869] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0221.927] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0221.927] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.938] SetEvent (hEvent=0x124) returned 1
	[0221.938] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.939] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0221.939] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0221.973] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0221.973] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.974] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.975] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.977] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.978] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.980] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0221.982] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.001] SetEvent (hEvent=0x124) returned 1
	[0222.001] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.009] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0222.009] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0222.010] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0222.011] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.023] SetEvent (hEvent=0x124) returned 1
	[0222.023] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.028] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.029] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.030] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.032] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.033] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.035] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.037] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.038] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.040] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.042] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.047] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.049] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.051] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.052] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.053] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.055] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.056] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.057] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.058] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.059] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.064] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.069] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.073] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.076] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.087] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.089] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.092] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.094] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.096] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.099] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.101] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.103] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.105] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.106] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.108] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.109] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.111] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.112] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.117] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.118] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.120] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.121] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.122] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.123] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.125] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.129] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.131] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.132] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.133] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.135] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.137] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.138] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.140] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.141] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.143] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.145] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.146] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.148] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.151] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.153] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.156] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.157] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.159] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.160] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.162] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.163] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.180] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.181] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.183] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.184] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.186] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.187] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.189] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.191] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.192] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.196] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.197] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.200] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.202] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.204] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.205] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.206] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.207] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.208] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.209] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.211] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.214] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.216] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.217] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.220] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.221] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.224] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.225] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.228] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.237] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.239] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.241] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.243] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.244] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.246] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.247] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.249] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.250] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.253] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.254] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.271] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.275] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.276] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.280] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.281] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.288] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.291] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.292] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.294] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.296] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.300] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.302] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.303] SetEvent (hEvent=0x124) returned 1
	[0222.303] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.305] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0222.305] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0222.344] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0222.344] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.345] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.347] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.349] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.365] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.367] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.368] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.370] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.372] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.374] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.377] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.379] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.380] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.381] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.382] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.384] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.388] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.390] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.392] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.395] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.407] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.408] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.410] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.412] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.418] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.419] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.421] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.423] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.424] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.425] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.427] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.436] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.438] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.439] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.441] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.443] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.444] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.449] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.452] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.455] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.487] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.488] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.490] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.494] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.496] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.498] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.500] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.503] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.504] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.505] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.510] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.512] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.514] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.516] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.518] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.519] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.523] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.525] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.526] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.528] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.529] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.531] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.533] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.534] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.542] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.545] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.546] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.548] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.549] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.552] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.554] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.556] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.559] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.564] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.567] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.568] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.570] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.571] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.572] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.574] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.576] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.577] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.579] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.581] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.583] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.585] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.587] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.589] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.590] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.593] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.595] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.597] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.598] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.600] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.602] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.604] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.607] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.609] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.612] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.613] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.616] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.619] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.620] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.624] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.625] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.627] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.630] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.632] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.634] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.637] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.642] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.660] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.674] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.675] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.677] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.678] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.679] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.681] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.682] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.684] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.685] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.689] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.690] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.696] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.697] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.699] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.702] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.704] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.705] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.708] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.710] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.713] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.716] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.718] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.720] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.723] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.726] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.728] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.732] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.734] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.736] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.737] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.739] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.740] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.743] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.744] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.745] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.747] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.755] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.756] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.759] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.762] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.777] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.804] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.863] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.873] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.899] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.909] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.914] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.919] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.920] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.922] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.924] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0222.998] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.023] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.024] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.026] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.027] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.032] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.035] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.036] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.283] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.286] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.288] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.303] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.305] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.309] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.316] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.319] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.320] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.321] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.329] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.331] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.332] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.333] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.335] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.336] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.338] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.339] SetEvent (hEvent=0x14c) returned 1
	[0223.340] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.341] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0223.341] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0223.371] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0223.372] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.373] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.375] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.376] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.377] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.379] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.397] SetEvent (hEvent=0x14c) returned 1
	[0223.397] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.404] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0223.404] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0223.405] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0223.406] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.407] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.408] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.409] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.411] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.412] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.413] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.414] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.416] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.417] SetEvent (hEvent=0x14c) returned 1
	[0223.417] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.418] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0223.419] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0223.523] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0223.523] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.524] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.526] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.528] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.529] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.530] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.532] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.533] SetEvent (hEvent=0x14c) returned 1
	[0223.533] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.535] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0223.535] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0223.626] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0223.627] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.634] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.636] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.639] SetEvent (hEvent=0x14c) returned 1
	[0223.639] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.642] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.644] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.649] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.651] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.652] SetEvent (hEvent=0x14c) returned 1
	[0223.652] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.659] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0223.660] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0223.680] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0223.680] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.682] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.705] SetEvent (hEvent=0x14c) returned 1
	[0223.705] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.707] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.715] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.718] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.718] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.719] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.721] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.736] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.738] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.750] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.754] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.756] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.757] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.758] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.769] SetEvent (hEvent=0x14c) returned 1
	[0223.770] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.771] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.772] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.773] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.781] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.782] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.783] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.785] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.786] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.788] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.789] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.790] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.801] SetEvent (hEvent=0x14c) returned 1
	[0223.801] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.802] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.804] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.805] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.831] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.833] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.835] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.838] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.845] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.866] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.868] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.869] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.870] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.872] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.878] SetEvent (hEvent=0x14c) returned 1
	[0223.878] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.880] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.881] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.888] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.896] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.904] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.920] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.927] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.928] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.977] SetEvent (hEvent=0x14c) returned 1
	[0223.977] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.984] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.985] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.988] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.990] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0223.993] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.008] SetEvent (hEvent=0x14c) returned 1
	[0224.008] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.011] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.013] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.014] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.016] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.026] SetEvent (hEvent=0x14c) returned 1
	[0224.026] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.028] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0224.028] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0224.110] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0224.110] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.112] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.115] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.117] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.119] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.121] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.122] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.124] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.133] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.137] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.139] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.143] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.144] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.145] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.147] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.148] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.150] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.151] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.153] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.154] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.156] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.157] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.159] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.163] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.164] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.165] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.167] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.168] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.172] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.173] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.175] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.176] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.183] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.184] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.185] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.187] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.188] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.189] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.191] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.193] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.195] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.197] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.198] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.199] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.202] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.204] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.206] SetEvent (hEvent=0x14c) returned 1
	[0224.206] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.212] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.213] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.216] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.218] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.226] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.228] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.229] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.230] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.231] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.234] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.235] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.240] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.298] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.300] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.302] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.319] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.335] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.336] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.338] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.339] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.341] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.342] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.344] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.345] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.346] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.347] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.351] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.355] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.357] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.358] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.359] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.360] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.361] SetEvent (hEvent=0x14c) returned 1
	[0224.361] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.362] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0224.362] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0224.367] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0224.367] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.369] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.370] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.372] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.373] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.374] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.376] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.378] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.379] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.586] SetEvent (hEvent=0x14c) returned 1
	[0224.586] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.692] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.699] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.700] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.701] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.702] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.704] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.705] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.706] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.707] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.709] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.710] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.711] SetEvent (hEvent=0x14c) returned 1
	[0224.711] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.713] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0224.713] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0224.792] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0224.792] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.797] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.799] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.800] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.801] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.802] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.803] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.805] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.806] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.807] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.854] SetEvent (hEvent=0x14c) returned 1
	[0224.854] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0224.874] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0224.874] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0225.024] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0225.025] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.026] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.027] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.029] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.030] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.031] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.033] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.042] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.045] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.046] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.049] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.050] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.065] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.067] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.069] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.069] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.070] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.072] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.074] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.075] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.077] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.078] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.087] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.088] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.090] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.091] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.093] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.095] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.098] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.104] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.106] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.110] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.112] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.114] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.115] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.127] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.131] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.136] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.138] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.141] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.142] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.144] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.147] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.150] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.151] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.152] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.154] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.156] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.160] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.162] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.163] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.166] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.175] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.178] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.180] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.182] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.183] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.185] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.188] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.192] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.194] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.195] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.199] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.201] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.202] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.205] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.207] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.208] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.209] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.212] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.216] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.217] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.219] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.221] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.224] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.226] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.227] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.230] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.233] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.235] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.239] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.240] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.242] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.243] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.244] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.246] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.247] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.248] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.250] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.251] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.252] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.254] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.255] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.256] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.257] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.259] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.261] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.263] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.264] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.266] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.269] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.271] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.272] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.280] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.284] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.287] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.291] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.291] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.293] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.294] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.295] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.297] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.299] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.304] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.305] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.310] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.312] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.313] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.315] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.319] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.322] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.325] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.326] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.328] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.334] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.336] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.338] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.343] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.348] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.349] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.352] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.354] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.359] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.361] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.368] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.377] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.378] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.431] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.439] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.440] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.450] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.451] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.452] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.527] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.528] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.535] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.556] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.576] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.579] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.582] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.586] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.588] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.592] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.593] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.597] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.600] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.602] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.606] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.609] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.611] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.618] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.628] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.632] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.636] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.639] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.641] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.646] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.647] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.649] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.653] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.656] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.657] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.661] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.662] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.666] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.671] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.675] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.676] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.677] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.682] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.684] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.689] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.693] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.696] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.701] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.705] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.710] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.715] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.716] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.718] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.720] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.726] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.729] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.739] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.741] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.747] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.749] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.757] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.768] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.772] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.782] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.786] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.791] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.791] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.793] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.796] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.797] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.807] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.809] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.810] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.812] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.813] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.814] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.815] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.816] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.818] SetEvent (hEvent=0x14c) returned 1
	[0225.818] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0225.819] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0225.819] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0226.020] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0226.020] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.025] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.026] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.028] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.030] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.032] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.033] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.035] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.036] SetEvent (hEvent=0x174) returned 1
	[0226.036] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.038] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0226.038] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0226.098] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0226.098] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.115] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.117] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.118] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.134] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.142] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.144] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.159] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.160] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.161] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.165] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.168] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.179] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.199] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.201] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.220] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.222] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.230] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.236] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.241] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.243] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.261] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.267] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.278] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.282] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.287] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.288] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.292] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.296] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.300] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.306] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.307] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.312] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.313] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.315] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.317] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.334] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.339] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.341] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.342] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.344] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.345] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.353] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.356] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.361] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.365] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.373] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.377] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.382] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.387] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.388] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.390] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.391] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.392] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.395] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.396] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.397] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.399] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.401] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.402] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.412] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.414] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.420] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.425] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.427] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.429] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.434] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.436] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.438] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.439] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.444] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.446] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.450] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.451] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.454] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.491] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.495] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.497] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.502] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.504] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.506] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.507] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.508] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.514] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.521] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.523] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.525] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.526] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.533] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.534] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.535] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.548] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.550] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.552] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.560] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.563] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.569] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.570] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.572] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.573] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.581] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.588] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.589] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.595] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.596] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.602] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.609] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.611] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.614] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.615] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.617] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.618] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.621] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.622] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.624] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.631] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.633] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.634] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.638] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.639] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.642] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.646] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.650] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.654] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.656] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.660] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.662] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.665] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.666] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.671] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.676] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.681] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.691] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.694] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.695] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.700] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.703] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.707] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.721] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.726] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.746] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.747] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.749] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.755] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.756] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.769] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.791] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.796] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.809] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.824] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.826] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.828] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.834] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.836] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.838] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.839] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.852] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.854] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.855] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.860] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.862] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.863] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.864] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.866] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.868] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.870] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.874] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.881] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.888] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.893] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.896] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.897] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.899] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.906] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.908] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.911] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.913] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.915] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.917] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.920] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.922] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.923] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.925] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.927] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.930] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.936] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.939] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.949] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.951] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.955] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.965] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.969] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.970] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.973] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.975] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.976] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.982] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.984] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0226.986] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.025] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.031] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.036] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.037] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.039] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.040] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.041] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.043] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.045] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.046] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.047] SetEvent (hEvent=0x124) returned 1
	[0227.047] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.049] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0227.049] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0227.604] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0227.604] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.612] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.650] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.652] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.655] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.683] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.687] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.689] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.693] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.696] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.697] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.698] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.700] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.701] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.703] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.705] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.707] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.709] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.711] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.712] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.714] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.715] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.718] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.720] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.721] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.723] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.724] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.726] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.730] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.734] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.736] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.737] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.739] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.740] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.742] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.744] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.748] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.751] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.754] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.756] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.759] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.761] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.763] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.765] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.766] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.767] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.770] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.773] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.775] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.776] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.779] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.780] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.786] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.799] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.801] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.807] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.811] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.814] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.820] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.822] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.824] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.825] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.829] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.830] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.831] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.834] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.836] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.838] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.842] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.845] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.846] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.849] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.850] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.852] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.853] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.856] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.859] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.860] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.863] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.866] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.871] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.872] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.873] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.875] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.879] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.881] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.882] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.884] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.887] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.890] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.893] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.895] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.900] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.902] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.903] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.905] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.906] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.908] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.909] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.911] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.915] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.922] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.924] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.930] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.932] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.933] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.936] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.937] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.940] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.944] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.947] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.949] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.951] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.953] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.956] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.960] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.964] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.966] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.969] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.970] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.972] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.973] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.975] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.979] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.986] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.994] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.996] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.997] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0227.999] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.000] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.002] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.004] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.005] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.007] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.008] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.010] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.011] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.014] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.017] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.020] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.023] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.024] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.026] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.028] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.030] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.035] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.036] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.038] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.040] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.041] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.043] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.046] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.047] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.048] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.050] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.052] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.053] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.058] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.061] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.063] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.065] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.067] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.069] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.072] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.099] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.116] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.128] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.150] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.152] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.165] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.168] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.175] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.183] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.188] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.191] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.193] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.195] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.196] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.198] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.201] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.202] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.203] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.204] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.206] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.206] SetEvent (hEvent=0x14c) returned 1
	[0228.206] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.208] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0228.208] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0228.646] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0228.646] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.658] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.660] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.661] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.665] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.668] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.672] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.681] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.684] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.689] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.701] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.704] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.706] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.726] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.729] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.739] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.753] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.756] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.758] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.759] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.763] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.766] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.771] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.773] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.786] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.789] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.791] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.793] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.795] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.798] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.807] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.810] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.811] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.815] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.818] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.825] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.827] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.832] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.833] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.838] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.841] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.847] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.848] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.849] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.852] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.853] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.855] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.858] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.860] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.861] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.863] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.865] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.866] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.867] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.874] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.876] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.877] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.882] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.884] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.886] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.887] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.889] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.893] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.894] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.896] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.897] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.901] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.903] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.906] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.909] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.912] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.921] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.923] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.926] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.936] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.937] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.939] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.941] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.944] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.949] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.952] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.955] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.960] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.963] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.967] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.973] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.975] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.979] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.980] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.982] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.985] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.988] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.991] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.994] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0228.999] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.001] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.009] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.018] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.020] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.026] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.031] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.033] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.035] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.037] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.042] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.047] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.050] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.052] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.061] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.066] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.068] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.070] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.072] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.075] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.078] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.079] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.080] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.083] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.084] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.091] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.094] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.101] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.105] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.108] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.111] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.115] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.116] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.121] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.123] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.126] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.128] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.131] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.134] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.137] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.140] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.142] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.144] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.146] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.149] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.151] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.154] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.156] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.162] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.165] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.167] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.170] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.171] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.174] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.176] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.179] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.184] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.186] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.189] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.191] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.193] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.196] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.199] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.202] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.205] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.208] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.211] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.213] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.216] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.219] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.222] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.224] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.225] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.228] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.229] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.233] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.235] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.236] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.237] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.239] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.241] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.243] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.245] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.247] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.254] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.255] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.257] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.260] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.262] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.263] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.265] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.267] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.269] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.284] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.286] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.287] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.290] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.292] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.296] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.299] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.302] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.306] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.308] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.312] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.314] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.318] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.320] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.322] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.324] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.325] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.327] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.330] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.331] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.333] SetEvent (hEvent=0x174) returned 1
	[0229.333] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.334] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0229.334] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0229.815] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0229.815] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.817] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.821] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.822] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.829] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.831] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.833] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.836] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.838] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.841] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.849] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.872] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.875] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.881] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.885] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.892] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.897] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.904] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.909] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.912] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.916] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.917] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.923] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.935] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.938] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.940] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.974] SetEvent (hEvent=0x174) returned 1
	[0229.974] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.979] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.982] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.987] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.989] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.992] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.994] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0229.997] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.008] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.011] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.014] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.017] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.019] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.022] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.026] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.031] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.033] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.036] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.039] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.041] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.044] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.045] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.048] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.051] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.053] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.057] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.058] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.060] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.063] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.066] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.069] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.072] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.075] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.077] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.081] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.084] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.089] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.091] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.092] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.095] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.101] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.104] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.106] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.107] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.109] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.112] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.115] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.118] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.119] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.122] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.126] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.127] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.132] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.136] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.139] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.142] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.145] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.147] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.151] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.153] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.157] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.160] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.164] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.167] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.170] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.174] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.177] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.178] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.185] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.190] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.192] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.196] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.198] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.201] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.205] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.208] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.210] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.215] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.218] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.221] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.224] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.227] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.233] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.236] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.239] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.241] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.244] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.246] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.250] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.252] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.255] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.257] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.262] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.264] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.266] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.269] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.270] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.272] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.290] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.295] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.297] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.299] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.302] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.326] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.332] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.382] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.388] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.408] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.420] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.423] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.498] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.503] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.559] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.565] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.617] SetEvent (hEvent=0x174) returned 1
	[0230.617] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.631] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.679] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.725] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.731] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.741] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.756] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.757] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.759] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.760] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.762] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.763] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.764] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.767] SetEvent (hEvent=0x174) returned 1
	[0230.767] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.771] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0230.771] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0230.783] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0230.783] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.790] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.791] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.792] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.795] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.801] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.803] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.806] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.812] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.815] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.817] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.818] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.821] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.839] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.842] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.844] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.845] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.846] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.848] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.849] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.851] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.852] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.853] SetEvent (hEvent=0x174) returned 1
	[0230.853] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.855] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0230.855] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0230.921] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0230.922] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.946] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.954] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.970] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.974] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.984] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.988] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.989] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.993] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0230.997] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.001] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.004] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.007] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.016] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.018] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.020] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.022] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.023] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.025] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.028] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.048] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.049] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.051] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.052] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.054] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.056] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.058] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.060] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.062] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.065] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.067] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.090] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.091] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.092] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.096] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.097] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.101] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.102] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.103] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.108] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.124] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.128] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.137] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.138] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.140] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.142] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.144] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.149] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.168] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.171] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.172] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.174] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.176] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.178] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.179] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.181] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.185] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.187] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.189] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.193] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.195] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.200] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.204] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.206] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.217] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.220] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.221] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.222] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.224] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.232] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.236] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.238] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.239] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.241] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.244] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.246] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.253] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.258] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.262] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.265] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.267] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.268] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.271] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.275] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.278] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.280] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.282] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.285] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.286] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.287] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.289] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.291] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.293] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.296] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.297] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.299] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.302] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.303] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.311] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.314] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0231.314] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0231.316] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0231.316] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.317] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.319] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.320] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.321] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.323] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.324] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.326] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.327] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.333] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.337] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.338] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.345] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.356] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.362] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.364] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.366] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.372] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.378] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.382] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.385] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.390] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.399] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.402] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.407] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.411] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.412] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.414] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.416] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.419] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.424] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.431] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.434] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.440] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.444] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.448] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.453] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.456] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.482] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.486] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.490] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.491] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.494] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.497] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.504] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.507] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.512] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.514] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.519] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.525] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.526] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.530] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.534] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.572] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.604] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.621] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.637] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.652] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.656] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.661] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.684] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.702] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.717] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.733] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.752] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.758] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.769] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.784] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.809] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.827] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.846] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.848] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.849] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.852] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.862] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.865] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.879] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.883] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.885] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.886] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.889] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.891] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.892] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.893] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.895] SetEvent (hEvent=0x124) returned 1
	[0231.895] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.897] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0231.897] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0231.926] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0231.926] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.927] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.929] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.935] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.938] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.939] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.940] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.942] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.943] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.945] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.946] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.947] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.948] SetEvent (hEvent=0x124) returned 1
	[0231.948] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0231.949] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0231.949] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0232.085] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0232.085] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0232.087] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0232.090] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0232.091] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0232.092] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0232.093] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0232.095] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0232.096] SetEvent (hEvent=0x124) returned 1
	[0232.096] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0232.097] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0232.097] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0232.213] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0232.213] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0232.214] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0232.216] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0232.217] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0232.218] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0232.220] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0232.221] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0232.222] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0232.223] SetEvent (hEvent=0x124) returned 1
	[0232.224] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0232.225] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0232.225] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0232.401] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0232.402] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0232.403] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0232.405] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0232.406] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0232.408] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0232.408] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0232.410] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0232.411] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0232.412] SetEvent (hEvent=0x124) returned 1
	[0232.412] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0232.413] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0232.413] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0232.861] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0232.861] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0232.897] SetEvent (hEvent=0x124) returned 1
	[0232.897] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0232.905] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0232.905] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0233.073] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0233.073] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.080] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.082] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.083] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.091] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.096] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.099] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.103] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.109] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.114] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.121] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.123] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.132] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.165] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.174] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.182] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.187] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.193] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.199] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.206] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.209] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.216] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.242] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.247] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.251] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.253] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.255] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.257] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.259] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.264] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.265] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.266] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.267] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.269] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.270] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.272] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.272] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.274] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.276] SetEvent (hEvent=0x124) returned 1
	[0233.276] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.277] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0233.278] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0233.294] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0233.294] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.296] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.298] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.303] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.306] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.309] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.311] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.313] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.317] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.324] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.326] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.329] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.335] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.340] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.342] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.345] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.347] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.352] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.356] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.357] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.359] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.361] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.366] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.367] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.372] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.378] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.380] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.382] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.383] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.385] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.387] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.388] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.390] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.392] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.394] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.396] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.398] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.401] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.403] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.405] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.408] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.409] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.411] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.414] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.415] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.419] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.425] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.426] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.427] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.430] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.432] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.433] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.434] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.439] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.442] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.443] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.445] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.447] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.449] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.450] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.451] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.453] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.455] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.455] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.458] SetEvent (hEvent=0x124) returned 1
	[0233.458] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.460] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0233.460] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0233.730] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0233.730] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.731] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.733] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.734] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.735] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.736] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.738] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.739] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.740] SetEvent (hEvent=0x124) returned 1
	[0233.740] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.741] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0233.741] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0233.751] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0233.751] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.752] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.754] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.756] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.758] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.760] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.762] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.769] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.771] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.773] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.774] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.776] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.777] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.778] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.780] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.783] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.783] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.785] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.786] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.788] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.789] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.791] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.793] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.794] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.796] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.798] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.800] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.801] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.803] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.804] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.806] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.809] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.811] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.818] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.819] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.821] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.823] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.825] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.828] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.830] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.832] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.834] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.836] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.838] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.839] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.841] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.842] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.844] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.846] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.848] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.849] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.853] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.857] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.858] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.862] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.874] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.877] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.881] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.883] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.884] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.885] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.887] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.891] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.898] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.903] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.906] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.909] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.915] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.916] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.917] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.919] SetEvent (hEvent=0x14c) returned 1
	[0233.919] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.920] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0233.920] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0233.967] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0233.967] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.969] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.981] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.985] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.986] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.988] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.989] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.991] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.992] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.993] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.995] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.996] SetEvent (hEvent=0x14c) returned 1
	[0233.996] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0233.997] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0233.997] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0234.051] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0234.053] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.054] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.055] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.057] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.058] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.060] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.061] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.062] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.063] SetEvent (hEvent=0x14c) returned 1
	[0234.064] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.065] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0234.065] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0234.134] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0234.134] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.137] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.140] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.141] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.143] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.144] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.145] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.146] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.147] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.148] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.150] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.151] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.153] SetEvent (hEvent=0x14c) returned 1
	[0234.153] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.154] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0234.154] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0234.254] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0234.254] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.258] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.259] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.260] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.262] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.263] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.264] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.265] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.268] SetEvent (hEvent=0x14c) returned 1
	[0234.268] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.269] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0234.269] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0234.274] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0234.274] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.323] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.332] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.336] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.340] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.406] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.408] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.425] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.432] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.456] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.457] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.459] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.462] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.463] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.464] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.469] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.471] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.473] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.474] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.475] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.476] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.478] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.479] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.496] SetEvent (hEvent=0x14c) returned 1
	[0234.496] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.569] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0234.569] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0234.575] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0234.575] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.582] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.583] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.586] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.588] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.589] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.590] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.591] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.593] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.594] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.596] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.597] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.598] SetEvent (hEvent=0x14c) returned 1
	[0234.598] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.600] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0234.600] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0234.643] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0234.643] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.670] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.671] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.673] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.674] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.676] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.677] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.678] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.680] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.681] SetEvent (hEvent=0x14c) returned 1
	[0234.681] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.683] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0234.683] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0234.734] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0234.734] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.735] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.736] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.737] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.739] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.740] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.744] SetEvent (hEvent=0x14c) returned 1
	[0234.744] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.746] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0234.746] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0234.781] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0234.781] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.786] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.788] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.789] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.790] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.792] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.793] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.794] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.795] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.796] SetEvent (hEvent=0x14c) returned 1
	[0234.796] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.798] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0234.798] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0234.817] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0234.817] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.819] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.845] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.846] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.847] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.848] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.849] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.850] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.852] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.853] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.855] SetEvent (hEvent=0x14c) returned 1
	[0234.855] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.856] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0234.856] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0234.863] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0234.864] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.865] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.872] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.873] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.874] SetEvent (hEvent=0x14c) returned 1
	[0234.874] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.875] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0234.875] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0234.907] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0234.907] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.931] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.937] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.937] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.939] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.940] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.941] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.943] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.944] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.945] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.948] SetEvent (hEvent=0x14c) returned 1
	[0234.948] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0234.949] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0234.949] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0235.030] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0235.030] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.032] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.033] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.035] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.036] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.037] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.038] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.040] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.041] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.042] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.045] SetEvent (hEvent=0x14c) returned 1
	[0235.045] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.046] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0235.046] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0235.121] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0235.121] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.123] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.124] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.125] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.127] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.128] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.129] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.130] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.133] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.135] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.138] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.141] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.144] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.145] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.150] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.151] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.152] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.153] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.155] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.156] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.157] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.159] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.160] SetEvent (hEvent=0x14c) returned 1
	[0235.160] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.161] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0235.161] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0235.164] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0235.165] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.170] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.171] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.172] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.174] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.177] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.179] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.181] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.182] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.183] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.184] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.185] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.186] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.188] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.189] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.190] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.192] SetEvent (hEvent=0x14c) returned 1
	[0235.192] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.194] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0235.194] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0235.202] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0235.202] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.203] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.232] SetEvent (hEvent=0x14c) returned 1
	[0235.232] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.235] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.237] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.238] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.239] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.240] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.242] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.243] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.244] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.245] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.246] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.247] SetEvent (hEvent=0x14c) returned 1
	[0235.247] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.249] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0235.249] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0235.270] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0235.271] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.274] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.275] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.276] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.277] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.278] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.280] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.281] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.282] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.283] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.285] SetEvent (hEvent=0x14c) returned 1
	[0235.285] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.286] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0235.286] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0235.293] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0235.293] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.295] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.297] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.298] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.300] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.301] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.302] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.303] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.305] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.306] SetEvent (hEvent=0x14c) returned 1
	[0235.306] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.308] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0235.308] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0235.319] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0235.319] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.322] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.323] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.325] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.328] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.330] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.333] SetEvent (hEvent=0x14c) returned 1
	[0235.333] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.334] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0235.334] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0235.348] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0235.348] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.352] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.353] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.355] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.358] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.359] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.379] SetEvent (hEvent=0x14c) returned 1
	[0235.379] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.384] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.386] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.387] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.388] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.390] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.391] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.392] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.394] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.395] SetEvent (hEvent=0x14c) returned 1
	[0235.395] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.396] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0235.396] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0235.418] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0235.418] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.421] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.422] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.423] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.424] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.426] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.427] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.428] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.430] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.431] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.433] SetEvent (hEvent=0x14c) returned 1
	[0235.433] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.435] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0235.435] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0235.497] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0235.497] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.499] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.501] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0235.501] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0235.502] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0235.502] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.505] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.507] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.508] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.509] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.509] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.511] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.513] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.514] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.515] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.516] SetEvent (hEvent=0x174) returned 1
	[0235.516] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.518] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0235.518] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0235.581] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0235.581] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.606] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.608] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.609] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.611] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.614] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.624] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.626] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.627] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.628] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.630] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.631] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.632] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.633] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.636] SetEvent (hEvent=0x174) returned 1
	[0235.636] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.637] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0235.637] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0235.691] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0235.691] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.693] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.694] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.695] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.697] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.698] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.700] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.701] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.702] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.703] SetEvent (hEvent=0x174) returned 1
	[0235.703] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.705] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0235.705] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0235.726] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0235.726] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.729] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.732] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.738] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.739] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.740] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.742] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.743] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.744] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.745] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.746] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.748] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.749] SetEvent (hEvent=0x174) returned 1
	[0235.749] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.750] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0235.750] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0235.765] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0235.765] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.768] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.769] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.771] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.772] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.773] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.774] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.775] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.777] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.778] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.780] SetEvent (hEvent=0x174) returned 1
	[0235.780] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.781] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0235.781] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0235.878] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0235.878] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.891] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.923] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.925] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.926] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.927] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.929] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.930] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.931] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.933] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.934] SetEvent (hEvent=0x174) returned 1
	[0235.934] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0235.935] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0235.936] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0236.004] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0236.004] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.006] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.007] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.008] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.010] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.011] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.012] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.014] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.015] SetEvent (hEvent=0x174) returned 1
	[0236.015] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.016] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0236.017] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0236.032] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0236.032] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.034] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.035] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.036] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.038] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.039] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.043] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.046] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.049] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.053] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.060] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.069] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.071] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.074] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.078] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.081] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.082] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.086] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.102] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.107] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.113] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.115] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.116] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.118] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.120] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.122] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.125] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.126] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.130] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.134] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.136] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.138] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.142] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.144] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.147] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.149] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.152] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.161] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.162] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.167] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.170] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.172] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.175] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.215] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.226] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.232] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.241] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.246] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.253] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.283] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.302] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.328] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.337] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.456] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.461] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.527] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.536] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.551] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.586] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.593] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.604] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.607] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.614] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.622] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.624] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.632] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.634] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.639] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.641] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.683] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.690] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.695] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.709] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.715] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.718] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.720] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.723] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.724] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.726] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.728] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.732] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.745] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.751] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.753] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.758] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.761] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.763] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.765] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.774] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.780] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.782] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.785] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.788] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.792] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.794] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.796] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.799] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.802] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.803] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.804] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.806] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.809] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.811] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.821] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.823] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.824] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.826] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.837] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.842] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.851] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.853] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.856] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.859] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.873] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.880] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.884] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.897] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.905] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.908] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.914] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.917] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.924] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.937] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.938] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0236.938] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0236.952] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0236.952] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.956] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.959] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.962] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.966] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.979] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.991] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.993] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.996] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0236.998] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.000] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.003] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.006] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.011] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.015] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.018] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.019] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.022] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.024] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.027] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.033] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.042] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.057] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.060] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.064] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.070] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.072] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.074] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.081] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.082] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.086] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.088] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.090] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.092] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.093] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.103] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.105] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.108] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.109] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.112] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.114] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.116] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.123] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.127] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.129] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.132] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.134] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.136] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.142] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.145] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.150] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.155] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.159] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.166] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.175] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.182] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.184] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.186] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.190] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.192] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.196] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.198] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.202] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.208] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.210] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.213] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.215] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.219] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.220] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.225] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.232] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.240] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.243] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.244] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.289] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.297] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.303] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.306] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.308] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.309] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.311] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.312] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.313] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.314] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.315] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.316] SetEvent (hEvent=0x124) returned 1
	[0237.316] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.318] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0237.318] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0237.768] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0237.768] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.770] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.771] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.774] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.780] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.782] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.786] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.789] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.792] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.795] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.797] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.798] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.801] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.803] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.807] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.820] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.829] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.831] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.834] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.839] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.844] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.850] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.854] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.857] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.866] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.868] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.870] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.879] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.882] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.893] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.919] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.921] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.923] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.925] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.930] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.932] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.933] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.936] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.938] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.939] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.944] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.949] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.954] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.956] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.962] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.965] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.967] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.970] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.986] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.987] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.992] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.993] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.995] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.996] SetEvent (hEvent=0x124) returned 1
	[0237.996] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0237.997] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0237.997] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0238.007] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0238.007] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.012] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.014] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.016] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.017] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.018] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.020] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.021] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.023] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.028] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.032] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.034] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.037] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.039] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.041] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.047] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.048] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.052] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.073] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.074] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.076] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.077] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.078] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.079] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.081] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.082] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.084] SetEvent (hEvent=0x124) returned 1
	[0238.084] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.085] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0238.085] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0238.098] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0238.098] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.102] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.103] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.105] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.109] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.111] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.115] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.118] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.119] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.123] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.126] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.128] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.129] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.132] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.134] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.137] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.138] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.140] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.143] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.144] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.145] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.147] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.148] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.150] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.151] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.154] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.156] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.158] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.160] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.162] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.163] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.165] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.167] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.209] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.259] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.273] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0238.273] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0238.316] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0238.316] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.325] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.328] SetEvent (hEvent=0x14c) returned 1
	[0238.328] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.334] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0238.334] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0238.382] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0238.382] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.386] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.386] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.387] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.389] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.390] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.392] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.393] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.395] SetEvent (hEvent=0x14c) returned 1
	[0238.395] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.397] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0238.397] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0238.482] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0238.482] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.483] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.485] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.486] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.487] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.489] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.490] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.491] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.492] SetEvent (hEvent=0x14c) returned 1
	[0238.492] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.493] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0238.493] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0238.565] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0238.566] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.568] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.573] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.577] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.586] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.593] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.597] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.598] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.599] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.600] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.602] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.603] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.605] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.606] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.607] SetEvent (hEvent=0x14c) returned 1
	[0238.607] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.608] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0238.608] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0238.698] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0238.699] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.703] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.705] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.708] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.710] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.713] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.715] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.717] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.718] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.719] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.720] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.721] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.722] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.724] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.725] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.726] SetEvent (hEvent=0x14c) returned 1
	[0238.726] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.728] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0238.728] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0238.763] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0238.763] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.765] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.766] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.768] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.769] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.773] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.774] SetEvent (hEvent=0x14c) returned 1
	[0238.775] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.776] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0238.776] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0238.823] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0238.824] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.825] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.830] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.831] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.833] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.834] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.835] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.837] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.838] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.840] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.841] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.842] SetEvent (hEvent=0x14c) returned 1
	[0238.842] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.843] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0238.843] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0238.920] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0238.920] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.921] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.922] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.924] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.925] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.933] SetEvent (hEvent=0x14c) returned 1
	[0238.933] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.934] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0238.934] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0238.980] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0238.980] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.982] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.986] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.987] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.989] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.990] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.991] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.992] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.993] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.994] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.996] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.997] SetEvent (hEvent=0x14c) returned 1
	[0238.997] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0238.998] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0238.998] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0239.063] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0239.064] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0239.074] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0239.134] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0239.140] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0239.143] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0239.156] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0239.215] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0239.216] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0239.216] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0239.244] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0239.244] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0239.297] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0239.298] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0239.299] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0239.301] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0239.302] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0239.303] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0239.305] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0239.306] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0239.307] SetEvent (hEvent=0x174) returned 1
	[0239.307] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0239.308] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0239.308] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0239.352] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0239.352] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0239.366] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0239.367] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0239.374] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0239.414] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0239.414] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0239.420] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0239.421] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0239.425] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0239.511] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0239.554] SetEvent (hEvent=0x124) returned 1
	[0239.554] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0239.558] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0239.570] SetEvent (hEvent=0x124) returned 1
	[0239.570] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0239.573] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0239.728] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0239.752] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0239.771] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0239.772] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0239.774] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0239.774] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0239.789] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0239.829] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0239.830] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0239.830] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0239.834] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0239.834] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0239.836] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0239.836] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0239.838] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0239.838] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0239.891] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0239.970] SetEvent (hEvent=0x12c) returned 1
	[0239.970] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0239.973] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0239.995] SetEvent (hEvent=0x12c) returned 1
	[0239.995] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0239.997] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0240.006] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0240.032] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0240.034] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0240.035] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0240.035] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0240.038] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0240.039] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0240.043] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0240.057] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0240.059] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0240.069] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0240.070] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0240.070] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0240.094] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0240.094] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0240.100] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0240.104] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0240.105] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0240.227] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0240.293] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0240.332] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0240.348] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0240.351] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0240.351] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0240.361] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0240.361] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0240.363] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0240.364] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0240.366] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0240.367] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0240.368] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0240.372] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0240.373] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0240.374] SetEvent (hEvent=0x174) returned 1
	[0240.374] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0240.375] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0240.375] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0240.463] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0240.463] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0240.487] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0240.487] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0240.489] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0240.489] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0240.491] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0240.649] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0240.652] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0240.670] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0240.685] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0240.687] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0240.699] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0240.732] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0240.732] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0240.740] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0240.740] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0240.742] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0240.742] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0240.744] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0240.744] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0241.064] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0241.146] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0241.204] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0241.376] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0241.425] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0241.425] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0242.815] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0242.816] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0242.855] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0242.891] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0242.895] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0242.895] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0242.933] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0242.934] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0242.969] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0243.043] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0243.043] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0243.070] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0243.070] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0243.167] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0243.299] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0243.339] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0243.350] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0243.350] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0243.394] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0243.394] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0243.455] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0243.497] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0243.536] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0243.536] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0243.628] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0243.629] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0243.640] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0243.677] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0243.677] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0244.140] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0244.140] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0244.178] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0244.214] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0244.245] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0244.245] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0244.344] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0244.344] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0244.361] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0244.436] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0244.467] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0244.467] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0244.534] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0244.534] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0244.559] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0244.588] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0244.588] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0244.732] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0244.732] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0244.883] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0244.942] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0244.988] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0244.996] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0244.996] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0245.032] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0245.032] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0245.066] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0245.096] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0245.096] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0245.161] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0245.162] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0245.240] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0245.282] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0245.282] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0245.334] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0245.335] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0245.716] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0245.862] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0245.896] SetEvent (hEvent=0x124) returned 1
	[0245.896] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0245.949] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0245.967] SetEvent (hEvent=0x124) returned 1
	[0245.967] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0245.972] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0246.007] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0246.028] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0246.038] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0246.038] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0246.081] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0246.081] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0246.133] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0246.344] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0246.409] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0246.409] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0246.480] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0246.480] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0246.523] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0246.564] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0246.564] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0246.614] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0246.614] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0246.759] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0246.773] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0246.850] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0247.002] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0247.067] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0247.067] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0247.168] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0247.168] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0247.185] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0247.220] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0247.220] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0247.353] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0247.353] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0247.448] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0247.477] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0247.477] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0247.519] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0247.520] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0247.934] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0248.001] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0248.027] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0248.037] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0248.059] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0248.059] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0248.157] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0248.157] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0248.177] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0248.184] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0248.232] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0248.269] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0248.272] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0248.316] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0248.316] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0248.350] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0248.390] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0248.391] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0248.489] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0248.489] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0248.665] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0248.691] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0248.744] SetEvent (hEvent=0x124) returned 1
	[0248.744] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0248.794] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0248.795] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0248.833] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0248.833] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0248.880] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0248.895] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0248.895] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0249.044] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0249.044] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0249.062] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0249.093] SetEvent (hEvent=0x124) returned 1
	[0249.093] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0249.122] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0249.122] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0249.159] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0249.160] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0249.207] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0249.207] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0249.241] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0249.241] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0249.270] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0249.424] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0249.424] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0249.561] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0249.561] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0249.678] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0249.680] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0249.725] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0249.758] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0249.794] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0249.794] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0249.900] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0249.900] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0249.947] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0249.954] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0249.954] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0250.135] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0250.136] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0250.165] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0250.192] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0250.192] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0250.265] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0250.265] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0250.357] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0250.432] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0250.485] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0250.511] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0250.511] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0250.736] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0250.736] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0250.748] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0250.797] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0250.875] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0250.875] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0250.942] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0250.942] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0250.990] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0250.990] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0251.095] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0251.095] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0251.192] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0251.218] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0251.273] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0251.280] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0251.280] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0251.332] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0251.332] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0251.369] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0251.425] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0251.496] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0251.496] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0251.591] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0251.591] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0251.668] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0251.710] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0251.710] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0251.786] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0251.786] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0251.949] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0251.988] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0252.029] SetEvent (hEvent=0x174) returned 1
	[0252.029] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0252.040] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0252.088] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0252.122] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0252.159] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0252.159] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0252.283] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0252.283] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0252.413] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0252.446] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0252.474] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0252.474] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0252.519] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0252.519] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0252.523] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0252.526] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0252.526] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0252.576] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0252.576] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0252.728] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0252.748] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0252.771] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0252.800] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0252.804] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0252.804] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0252.818] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0252.818] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0252.832] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0252.863] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0252.863] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0252.909] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0252.909] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0253.026] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0253.120] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0253.120] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0253.369] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0253.369] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0253.465] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0253.516] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0253.524] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0253.571] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0253.571] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0253.716] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0253.716] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0253.779] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0253.820] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0253.855] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0253.855] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0253.923] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0253.923] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0253.929] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0253.951] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0253.951] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0254.017] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0254.017] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0254.108] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0254.132] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0254.160] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0254.190] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0254.191] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0254.230] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0254.230] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0254.293] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0254.308] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0254.321] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0254.343] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0254.343] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0254.395] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0254.396] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0254.446] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0254.478] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0254.478] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0254.605] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0254.608] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0254.653] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0254.710] SetEvent (hEvent=0x14c) returned 1
	[0254.710] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0254.745] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0254.793] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0254.805] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0254.836] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0254.837] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0254.898] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0254.898] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0254.952] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0254.984] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0254.993] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0254.993] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0255.054] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0255.054] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0255.078] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0255.132] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0255.138] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0255.138] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0255.143] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0255.144] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0255.654] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0255.747] SetEvent (hEvent=0x12c) returned 1
	[0255.747] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0255.751] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0255.751] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0256.153] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0256.153] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0256.198] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0256.221] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0256.229] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0256.229] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0256.234] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0256.234] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0256.252] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0256.256] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0256.256] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0256.315] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0256.315] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0256.318] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0256.321] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0256.436] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0256.479] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0256.499] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0256.515] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0256.517] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0256.517] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0256.517] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0256.517] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0256.526] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0256.554] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0256.554] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0256.557] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0256.558] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0256.560] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0256.569] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0256.724] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0257.111] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0257.251] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0258.002] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0258.002] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0258.062] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0258.062] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0258.118] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0258.146] SetEvent (hEvent=0x14c) returned 1
	[0258.146] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0258.220] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0258.220] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0258.257] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0258.257] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0258.289] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0258.289] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0258.341] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0258.341] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0258.370] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0258.401] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0258.401] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0258.546] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0258.546] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0258.822] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0258.872] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0258.946] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0258.973] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0259.197] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0259.197] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0259.329] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0259.329] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0259.346] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0259.374] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0259.380] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0259.380] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0259.469] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0259.469] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0259.481] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0259.537] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0259.537] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0259.572] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0259.574] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0259.660] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0259.693] SetEvent (hEvent=0x174) returned 1
	[0259.693] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0259.733] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0259.749] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0259.779] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0259.832] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0259.833] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0259.888] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0259.889] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0259.897] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0259.955] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0259.962] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0259.962] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0260.046] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0260.046] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0260.052] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0260.157] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0260.157] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0260.253] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0260.253] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0260.368] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0260.386] SetEvent (hEvent=0x14c) returned 1
	[0260.386] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0260.473] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0260.473] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0260.516] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0260.516] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0260.557] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0260.557] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0260.653] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0260.654] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0260.700] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0260.738] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0260.778] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0260.815] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0260.815] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0260.859] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0260.859] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0260.887] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0260.936] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0260.936] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0261.041] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0261.041] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0261.221] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0261.278] SetEvent (hEvent=0x12c) returned 1
	[0261.278] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0261.334] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0261.378] SetEvent (hEvent=0x12c) returned 1
	[0261.378] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0261.411] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0261.456] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0261.578] SetEvent (hEvent=0x12c) returned 1
	[0261.578] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0261.606] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0261.606] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0261.816] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0261.816] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0261.832] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0261.834] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0261.834] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0261.835] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0261.835] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0261.850] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0261.852] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0261.852] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0261.891] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0261.892] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0261.897] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0261.899] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0261.965] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0262.006] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0262.041] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0262.046] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0262.046] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0262.065] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0262.065] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0262.073] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0262.299] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0262.366] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0262.366] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0262.432] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0262.432] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0262.495] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0262.495] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0262.530] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0262.531] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0262.596] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0262.597] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0262.644] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0262.644] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0262.777] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0262.846] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0262.866] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0262.889] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0262.889] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0262.961] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0262.961] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0263.014] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0263.075] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0263.151] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0263.152] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0263.271] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0263.271] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0263.292] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0263.320] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0263.320] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0263.473] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0263.473] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0263.549] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0263.590] SetEvent (hEvent=0x14c) returned 1
	[0263.590] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0263.640] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0263.640] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0263.649] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0263.649] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0263.687] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0263.748] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0263.789] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0263.823] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0263.851] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0263.905] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0263.905] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0264.001] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0264.001] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0264.037] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0264.161] SetEvent (hEvent=0x14c) returned 1
	[0264.161] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0264.190] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0264.191] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0264.219] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0264.219] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0264.255] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0264.255] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0264.308] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0264.308] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0264.349] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0264.366] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0264.366] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0264.417] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0264.417] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0264.421] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0265.372] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0265.574] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0265.692] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0265.755] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0265.770] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0265.770] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0266.917] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0266.918] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0266.949] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0266.964] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0266.980] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0266.981] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0267.092] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0267.092] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0267.166] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0267.226] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0267.227] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0267.465] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0267.465] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0267.470] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0267.532] SetEvent (hEvent=0x124) returned 1
	[0267.532] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0267.570] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0267.616] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0267.738] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0267.744] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0267.744] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0267.834] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0267.834] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0267.937] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0267.937] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0268.042] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0268.042] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0268.075] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0268.075] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0268.150] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0268.150] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0268.211] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0268.283] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0268.283] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0268.593] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0268.593] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0268.792] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0269.690] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0269.771] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0269.780] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0269.780] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0269.939] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0269.940] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0270.009] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0270.009] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0270.026] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0270.026] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0270.034] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0270.034] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0270.183] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0270.183] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0270.231] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0270.267] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0270.268] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0270.349] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0270.349] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0270.696] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0270.933] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0270.960] SetEvent (hEvent=0x12c) returned 1
	[0270.960] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0270.992] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0271.048] SetEvent (hEvent=0x12c) returned 1
	[0271.048] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0271.064] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0271.090] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0271.123] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0271.302] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0271.302] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0271.514] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0271.514] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0271.535] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0271.587] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0271.597] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0271.640] SetEvent (hEvent=0x12c) returned 1
	[0271.640] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0271.688] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0271.689] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0272.015] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0272.015] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0272.092] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0272.092] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0272.154] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0272.154] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0272.234] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0272.264] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0272.265] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0272.367] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0272.367] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0272.687] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0272.742] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0272.789] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0272.824] SetEvent (hEvent=0x124) returned 1
	[0272.824] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0272.848] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0272.886] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0272.999] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0273.045] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0273.090] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0273.098] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0273.098] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0273.181] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0273.181] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0273.284] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0273.287] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0273.296] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0273.297] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0273.297] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0273.326] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0273.326] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0273.329] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0273.329] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0273.329] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0273.331] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0273.331] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0273.883] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0273.938] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0273.968] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0274.001] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0274.030] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0274.069] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0274.095] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0274.118] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0274.118] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0274.163] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0274.163] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0274.179] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0274.184] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0274.200] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0274.207] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0274.207] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0274.265] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0274.265] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0274.275] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0274.277] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0274.277] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0274.282] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0274.282] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0274.295] SetEvent (hEvent=0x12c) returned 1
	[0274.295] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.110] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.188] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.225] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.239] SetEvent (hEvent=0x12c) returned 1
	[0275.239] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.244] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.291] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.412] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.426] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0275.426] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0275.447] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0275.447] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.459] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.496] SetEvent (hEvent=0x12c) returned 1
	[0275.496] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.499] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.503] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.522] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0275.523] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0275.529] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0275.529] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.532] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0275.532] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0275.533] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0275.533] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.535] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.596] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.598] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.610] SetEvent (hEvent=0x124) returned 1
	[0275.610] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.612] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.617] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.621] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.622] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.623] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0275.623] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0275.630] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0275.630] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.646] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.656] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.657] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0275.657] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0275.690] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0275.690] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.694] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.697] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.756] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.766] SetEvent (hEvent=0x124) returned 1
	[0275.766] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.779] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.794] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.803] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.832] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.834] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0275.834] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0275.834] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0275.834] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.839] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.848] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.884] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0275.884] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0275.888] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0275.888] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.891] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.916] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.963] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.986] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0275.988] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0275.988] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0275.997] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0275.997] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0276.016] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0276.032] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0276.033] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0276.033] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0276.052] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0276.052] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0276.071] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0276.071] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0276.077] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0276.077] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0276.081] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0276.144] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0276.172] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0276.176] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0276.177] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0276.178] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0276.179] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0276.179] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0276.439] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0276.520] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0276.555] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0276.555] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0276.693] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0276.693] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0276.752] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0276.838] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0276.880] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0276.880] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0276.979] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0276.979] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0277.078] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0277.103] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0277.151] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0277.192] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0277.192] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0277.232] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0277.232] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0277.280] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0277.312] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0277.312] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0277.413] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0277.413] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0277.439] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0277.470] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0277.470] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0277.584] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0277.584] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0277.672] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0277.696] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0277.752] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0277.792] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0277.792] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0277.872] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0277.873] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0277.892] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0277.924] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0277.925] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0277.999] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0277.999] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0278.026] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0278.054] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0278.056] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0278.128] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0278.128] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0278.182] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0278.249] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0278.285] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0278.363] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0278.363] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0278.448] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0278.448] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0278.464] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0278.502] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0278.502] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0278.508] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0278.508] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0278.510] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0278.510] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0278.512] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0278.513] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0278.573] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0278.581] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0278.606] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0278.619] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0278.641] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0278.646] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0278.646] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0278.647] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0278.647] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0278.657] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0278.658] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0278.658] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0278.688] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0278.689] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0278.692] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0278.695] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0278.820] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0278.847] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0278.858] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0278.869] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0278.888] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0278.899] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0278.899] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0278.900] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0278.900] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0278.921] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0278.937] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0278.966] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0278.966] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0278.974] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0278.974] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0278.990] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.054] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0279.054] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0279.060] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0279.060] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.078] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.080] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0279.080] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0279.081] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0279.082] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.084] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.100] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.101] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0279.101] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0279.132] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0279.132] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.140] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0279.140] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0279.143] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0279.144] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.146] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.207] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.248] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.267] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.270] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0279.270] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0279.271] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0279.272] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.288] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.305] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.371] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0279.372] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0279.377] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0279.377] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.380] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.440] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.454] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.461] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.475] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.509] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.512] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.515] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0279.515] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0279.516] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0279.516] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.517] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.572] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.585] SetEvent (hEvent=0x174) returned 1
	[0279.585] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.591] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0279.591] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0279.597] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0279.597] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.621] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.665] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0279.665] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0279.668] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0279.668] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.678] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.679] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0279.679] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0279.702] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0279.702] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.705] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.707] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.759] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.778] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.785] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.788] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0279.788] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0279.790] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0279.790] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.806] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.823] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.825] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0279.825] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0279.855] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0279.855] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.859] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.861] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.910] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.962] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.967] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.981] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0279.981] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0279.982] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0279.982] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.993] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0279.995] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0279.995] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0280.016] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0280.016] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.019] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.022] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.075] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.093] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.095] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.109] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0280.109] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0280.110] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0280.110] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.118] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.145] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0280.145] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0280.149] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0280.149] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.151] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.207] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.236] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.238] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.240] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0280.240] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0280.262] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0280.262] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.265] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.277] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.278] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0280.278] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0280.307] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0280.307] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.310] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.312] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.394] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.412] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.415] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.432] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.433] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0280.433] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0280.434] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0280.434] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.446] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.447] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0280.448] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0280.472] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0280.472] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.475] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.477] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.539] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.548] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.581] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.592] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.623] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0280.623] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0280.624] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0280.624] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.633] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.637] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0280.637] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0280.665] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0280.665] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.670] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.672] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.716] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.724] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.748] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.768] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.769] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0280.769] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0280.770] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0280.771] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.783] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.784] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0280.785] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0280.807] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0280.807] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.811] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.812] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0280.812] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0280.813] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0280.813] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.855] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.858] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.890] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.899] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.925] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.928] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0280.928] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0280.929] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0280.929] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.931] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.948] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0280.949] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0280.949] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0280.986] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0280.986] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0281.001] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0281.003] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0281.003] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0281.005] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0281.005] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0281.031] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0281.068] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0281.105] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0281.107] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0281.108] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0281.108] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0281.108] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0281.108] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0281.110] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0281.110] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0281.366] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0281.366] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0281.387] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0281.388] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0281.388] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0281.424] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0281.424] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0281.430] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0281.431] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0281.431] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0281.433] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0281.433] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0281.490] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0281.504] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0281.528] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0281.551] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0281.558] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0281.559] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0281.560] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0281.560] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0281.561] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0281.575] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0281.610] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0281.611] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0281.616] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0281.616] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0281.619] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0281.633] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0281.685] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0281.720] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0281.751] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0281.768] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0281.793] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0281.799] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0281.799] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0281.800] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0281.800] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0281.802] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0281.841] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0281.844] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0281.844] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0281.852] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0281.852] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0281.880] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0281.880] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0281.883] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0281.883] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0281.885] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0281.886] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0281.887] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0281.887] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0281.951] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0281.966] SetEvent (hEvent=0x12c) returned 1
	[0281.966] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0281.990] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.000] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.024] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.026] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0282.027] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0282.028] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0282.028] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.041] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.066] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0282.066] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0282.098] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0282.098] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.104] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0282.104] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0282.117] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0282.118] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.187] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.190] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.224] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.247] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0282.247] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0282.251] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0282.251] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.265] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.266] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0282.266] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0282.300] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0282.300] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.303] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.306] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.368] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.394] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.420] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.437] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.439] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0282.440] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0282.441] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0282.441] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.442] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.450] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.453] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0282.453] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0282.476] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0282.476] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.479] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.481] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.515] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.536] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.555] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.576] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.579] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0282.579] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0282.580] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0282.581] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.582] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.592] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.592] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0282.593] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0282.615] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0282.615] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.617] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.618] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0282.618] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0282.619] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0282.619] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.653] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.670] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.693] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.711] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.713] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0282.713] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0282.714] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0282.714] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.716] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.726] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.750] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0282.750] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0282.754] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0282.754] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.756] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.788] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.814] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.834] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.853] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.856] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0282.856] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0282.857] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0282.857] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.870] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.872] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0282.873] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0282.903] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0282.904] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.906] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.908] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0282.908] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0282.910] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0282.910] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.930] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.960] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.992] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0282.993] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0282.993] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0283.008] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0283.008] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.041] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.043] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0283.044] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0283.046] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0283.046] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.048] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0283.048] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0283.049] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0283.049] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.069] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.104] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.128] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.145] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.157] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.159] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0283.159] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0283.181] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0283.181] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.184] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.201] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.252] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.281] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.287] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.304] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.339] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0283.339] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0283.340] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0283.340] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.348] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.371] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0283.371] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0283.378] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0283.378] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.381] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.440] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.457] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.460] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.461] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0283.461] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0283.462] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0283.462] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.474] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.482] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.507] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0283.507] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0283.511] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0283.511] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.513] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.562] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.581] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.601] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.603] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.642] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.651] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.652] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0283.652] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0283.673] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0283.674] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.676] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.678] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.732] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.772] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.775] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.777] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0283.777] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0283.778] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0283.778] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.797] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.814] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.815] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0283.815] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0283.850] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0283.850] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.855] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.918] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.921] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.938] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.957] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.959] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0283.959] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0283.962] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0283.962] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.963] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.993] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0283.995] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.030] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0284.030] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0284.033] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0284.033] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.036] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.061] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.099] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.127] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.148] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.150] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0284.150] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0284.151] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0284.151] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.152] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.166] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.200] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0284.200] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0284.206] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0284.206] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.209] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0284.209] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0284.211] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0284.211] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.297] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.349] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.376] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.386] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0284.386] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0284.387] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0284.387] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.397] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.398] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0284.399] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0284.409] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0284.409] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.435] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0284.435] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0284.439] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0284.439] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.443] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.495] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.515] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.534] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.536] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0284.536] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0284.536] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0284.538] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.542] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.550] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.552] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0284.553] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0284.576] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0284.576] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.580] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.583] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.638] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.658] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.662] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.666] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0284.667] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0284.670] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0284.671] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.688] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.698] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.724] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0284.724] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0284.728] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0284.728] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.730] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.780] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.799] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.818] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.819] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0284.820] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0284.820] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0284.820] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.834] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.836] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0284.836] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0284.859] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0284.859] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.863] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.865] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.921] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.973] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.978] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.993] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0284.995] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.004] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.005] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0285.005] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0285.028] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0285.028] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.033] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.035] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.093] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.103] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.111] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.129] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.163] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0285.163] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0285.173] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0285.174] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.176] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.183] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.185] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0285.185] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0285.204] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0285.205] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.207] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.209] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.263] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.282] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.304] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0285.304] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0285.305] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0285.305] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.313] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.314] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0285.314] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0285.371] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0285.371] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.375] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.378] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.429] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.456] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.461] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.468] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.486] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.490] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.521] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.523] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.541] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.555] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.584] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.586] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0285.586] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0285.586] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0285.586] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.602] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.604] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0285.604] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0285.637] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0285.637] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.642] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.643] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0285.644] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0285.646] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0285.646] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.694] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.711] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.730] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.747] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.749] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0285.749] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0285.750] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0285.750] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.762] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.787] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0285.787] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0285.789] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0285.789] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.792] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.828] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.843] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.859] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.875] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.877] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.878] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.886] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.909] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0285.909] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0285.912] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0285.912] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.914] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.961] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.963] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.980] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.993] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0285.995] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.005] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.008] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0286.008] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0286.029] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0286.029] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.032] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.033] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0286.033] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0286.035] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0286.036] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.103] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.106] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.128] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.150] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.152] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0286.153] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0286.154] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0286.154] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.170] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.172] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0286.172] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0286.210] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0286.210] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.233] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.234] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0286.234] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0286.236] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0286.236] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.299] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.365] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.388] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.390] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.418] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0286.418] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0286.425] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0286.425] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.426] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.450] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.498] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0286.498] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0286.523] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0286.523] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.524] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0286.524] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0286.527] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0286.527] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.589] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.614] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.636] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.638] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0286.638] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0286.639] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0286.639] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.648] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.659] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.688] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0286.688] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0286.690] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0286.691] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.694] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.741] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.761] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.776] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.778] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0286.778] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0286.778] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0286.778] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.783] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.788] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.811] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0286.811] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0286.817] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0286.817] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.819] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.872] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.889] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.906] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.908] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.908] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.916] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.920] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.939] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0286.939] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0286.943] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0286.943] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0286.945] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.002] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.019] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.040] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.042] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0287.042] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0287.042] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0287.042] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.048] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.057] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.059] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0287.060] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0287.061] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0287.061] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.082] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0287.082] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0287.085] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0287.085] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.087] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.139] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.155] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.168] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.169] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0287.169] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0287.170] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0287.170] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.177] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.178] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0287.178] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0287.190] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0287.190] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.203] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0287.203] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0287.206] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0287.206] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.208] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.266] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.285] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.306] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.307] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.351] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.353] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0287.353] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0287.366] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0287.366] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.375] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0287.375] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0287.377] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0287.377] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.383] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.430] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.451] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.469] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0287.469] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0287.471] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0287.471] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.490] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.498] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.519] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.522] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.524] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.573] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.592] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.660] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.666] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0287.666] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0287.668] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0287.668] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.679] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.687] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.690] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0287.690] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0287.712] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0287.712] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.714] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.715] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0287.715] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0287.717] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0287.717] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.758] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.778] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.785] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.804] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0287.804] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0287.806] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0287.806] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.815] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.826] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.844] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0287.844] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0287.850] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0287.850] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.870] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0287.870] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0287.871] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0287.872] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.961] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.964] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.983] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.985] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0287.987] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0287.987] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0288.027] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0288.027] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.030] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.038] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.067] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0288.067] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0288.071] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0288.071] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.073] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.096] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.105] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.121] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0288.121] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0288.124] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0288.124] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.126] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.140] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.141] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0288.141] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0288.169] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0288.169] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.177] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.179] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0288.179] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0288.181] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0288.181] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.208] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.241] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.243] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.259] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0288.259] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0288.261] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0288.261] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.265] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.274] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.304] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0288.304] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0288.308] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0288.308] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.310] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.325] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.339] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.365] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.371] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0288.375] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0288.400] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0288.400] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.437] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.454] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0288.454] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0288.478] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0288.478] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.482] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.485] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0288.485] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0288.492] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0288.492] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.511] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.522] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.526] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0288.526] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0288.535] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0288.535] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.537] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0288.538] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0288.595] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0288.595] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.605] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.626] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0288.627] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0288.630] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0288.632] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.634] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.656] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.708] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.743] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.758] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.773] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.774] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.776] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0288.776] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0288.910] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0288.910] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.949] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.951] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0288.951] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0288.988] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0288.988] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.994] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0288.997] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.000] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0289.000] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0289.008] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0289.008] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.037] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.061] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.075] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.112] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.115] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0289.115] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0289.118] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0289.119] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.130] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.135] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.170] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0289.170] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0289.175] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0289.175] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.177] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0289.177] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0289.179] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0289.179] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.208] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.236] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.261] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.262] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0289.262] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0289.263] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0289.263] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.271] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.293] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.303] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0289.303] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0289.306] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0289.306] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.308] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.328] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.338] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.340] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0289.340] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0289.340] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0289.340] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.341] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0289.342] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0289.375] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0289.376] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.383] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.407] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0289.407] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0289.446] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0289.447] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.449] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.472] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.489] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.498] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.500] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0289.500] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0289.500] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0289.500] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.501] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0289.501] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0289.544] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0289.544] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.552] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.578] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0289.578] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0289.581] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0289.581] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.584] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.606] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.611] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.612] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.613] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.615] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.616] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.617] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.619] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.620] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.621] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.622] SetEvent (hEvent=0x14c) returned 1
	[0289.622] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.623] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0289.623] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0289.687] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0289.687] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.694] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.710] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.713] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.725] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.726] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0289.726] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0289.750] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0289.750] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.754] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.756] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.780] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.799] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.807] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.809] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.810] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0289.810] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0289.810] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0289.810] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.811] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0289.811] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0289.865] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0289.866] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.876] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.901] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0289.901] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0289.904] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0289.904] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.906] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.927] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.939] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.940] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0289.940] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0289.941] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0289.941] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0289.942] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0289.942] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0290.143] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0290.143] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.151] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.154] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0290.154] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0290.178] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0290.179] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.183] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.185] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.208] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.218] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.219] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.220] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.226] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.227] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.229] SetEvent (hEvent=0x124) returned 1
	[0290.229] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.230] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0290.230] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0290.271] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0290.271] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.277] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.292] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.293] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0290.294] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0290.294] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0290.294] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.315] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.336] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0290.336] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0290.338] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0290.339] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.341] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.362] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.380] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.387] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.389] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0290.389] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0290.389] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0290.389] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.392] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0290.392] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0290.447] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0290.450] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.453] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.469] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.490] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.493] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0290.493] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0290.496] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0290.496] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.498] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.520] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.532] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.533] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.534] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0290.535] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0290.660] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0290.661] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.670] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.693] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0290.693] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0290.696] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0290.696] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.699] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.723] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.732] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.734] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0290.734] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0290.735] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0290.735] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.737] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0290.737] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0290.805] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0290.805] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.819] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.821] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0290.821] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0290.845] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0290.845] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.848] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.850] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.872] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.883] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.884] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.886] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0290.886] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0290.914] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0290.914] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.923] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.925] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0290.925] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0290.948] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0290.948] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.951] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.953] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.963] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.976] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.987] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.988] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0290.988] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0290.989] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0290.989] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0290.990] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0290.990] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0291.073] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0291.073] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.081] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.083] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.108] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0291.108] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0291.110] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0291.111] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.113] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.136] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.156] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.163] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.180] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.183] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.193] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.195] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.245] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0291.248] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0291.263] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0291.263] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.266] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.268] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.286] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.297] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.311] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.312] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0291.312] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0291.313] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0291.313] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.324] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.348] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0291.348] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0291.351] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0291.351] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.353] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.373] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.384] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.396] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.399] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.408] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.453] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0291.453] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0291.486] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0291.486] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.489] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.489] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0291.490] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0291.492] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0291.492] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.517] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.526] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.534] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.548] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.551] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0291.551] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0291.552] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0291.552] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.560] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.561] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0291.561] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0291.584] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0291.585] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.588] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.591] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.610] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.611] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.621] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.633] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.634] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0291.634] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0291.634] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0291.635] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.645] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.647] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0291.647] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0291.669] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0291.669] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.671] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.672] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0291.672] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0291.674] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0291.674] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.694] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.720] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.740] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.744] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0291.744] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0291.745] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0291.745] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.754] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.776] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.782] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0291.782] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0291.784] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0291.784] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.787] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.808] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.820] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.832] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.834] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0291.834] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0291.835] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0291.835] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.843] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.881] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0291.881] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0291.883] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0291.883] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.886] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.887] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.888] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.890] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.891] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.892] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.894] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.895] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.898] SetEvent (hEvent=0x124) returned 1
	[0291.898] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0291.899] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0291.899] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0292.033] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0292.034] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0292.048] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0292.049] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0292.051] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0292.051] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0292.360] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0292.360] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0292.456] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0292.480] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0292.480] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0292.570] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0292.570] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0292.577] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0292.578] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0292.578] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0292.580] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0292.581] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0292.612] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0292.629] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0292.650] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0292.651] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0292.651] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0292.651] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0292.652] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0292.663] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0292.704] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0292.705] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0292.709] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0292.709] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0292.713] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0292.736] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0292.769] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0292.791] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0292.793] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0292.793] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0292.794] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0292.794] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0292.803] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0292.819] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0292.832] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0292.832] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0292.835] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0292.836] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0292.838] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0292.859] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0292.868] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0292.883] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0292.887] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0292.887] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0292.888] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0292.888] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0292.896] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0292.934] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0292.934] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0292.939] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0292.939] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0292.942] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0292.963] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0292.968] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0292.983] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0292.992] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.007] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.008] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0293.008] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0293.009] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0293.009] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.021] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.041] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0293.042] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0293.044] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0293.044] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.048] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0293.048] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0293.049] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0293.050] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.071] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.081] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.093] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.094] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0293.094] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0293.095] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0293.095] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.103] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.104] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0293.104] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0293.129] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0293.129] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.132] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.133] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0293.133] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0293.148] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0293.148] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.171] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.185] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.202] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0293.202] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0293.203] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0293.203] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.239] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.241] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0293.241] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0293.263] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0293.263] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.265] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.266] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0293.266] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0293.267] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0293.268] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.288] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.298] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.313] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.315] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0293.315] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0293.315] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0293.315] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.328] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.374] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.377] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.379] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.403] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.455] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.474] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.475] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0293.475] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0293.476] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0293.476] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.490] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.494] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0293.494] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0293.516] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0293.516] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.520] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.522] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.545] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.564] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.572] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.613] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.615] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0293.615] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0293.616] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0293.616] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.618] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.621] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.629] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.632] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0293.632] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0293.659] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0293.659] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.663] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.666] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.687] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.704] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.717] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.719] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0293.719] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0293.719] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0293.719] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.721] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.745] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.747] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0293.747] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0293.769] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0293.769] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.771] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.773] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0293.773] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0293.775] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0293.775] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.796] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.807] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.821] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.822] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.824] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.831] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.857] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0293.857] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0293.863] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0293.863] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.866] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.887] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.904] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.906] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.922] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.949] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.971] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0293.983] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.002] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.005] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0294.005] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0294.006] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0294.006] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.011] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.022] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.024] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0294.024] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0294.077] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0294.077] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.085] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.090] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.118] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.131] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.140] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.159] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.162] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0294.162] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0294.163] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0294.163] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.181] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.228] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0294.228] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0294.231] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0294.231] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.233] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.254] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.264] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.276] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.278] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0294.278] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0294.279] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0294.279] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.283] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0294.283] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0294.285] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0294.285] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.289] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0294.289] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0294.316] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0294.316] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.325] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0294.325] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0294.332] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0294.332] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.334] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.356] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.371] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.384] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.385] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.393] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0294.393] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0294.394] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0294.394] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.459] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0294.459] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0294.462] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0294.462] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.498] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.526] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0294.526] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0294.531] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0294.531] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.533] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0294.533] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0294.534] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0294.534] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.549] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.554] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.562] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.590] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0294.590] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0294.594] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0294.594] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.596] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.613] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.643] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.669] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.670] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0294.671] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0294.672] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0294.672] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.682] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.699] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.737] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.766] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.779] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0294.779] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0294.788] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0294.788] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.791] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0294.791] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0294.795] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0294.795] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.825] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.841] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.865] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.870] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0294.870] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0294.871] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0294.871] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.887] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.889] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0294.890] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0294.920] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0294.920] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.925] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0294.925] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0294.929] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0294.929] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.932] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.959] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.979] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.996] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0294.997] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0294.997] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0294.998] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0294.998] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.006] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.030] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0295.031] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0295.036] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0295.036] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.039] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.059] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.061] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.077] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.084] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.103] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.104] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0295.104] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0295.104] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0295.104] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.109] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.116] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.140] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0295.140] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0295.142] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0295.142] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.144] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.165] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.177] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.255] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.264] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0295.264] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0295.265] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0295.266] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.276] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0295.277] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0295.280] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0295.280] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.297] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.307] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0295.307] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0295.309] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0295.309] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.344] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0295.344] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0295.350] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0295.350] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.368] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.369] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.380] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0295.380] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0295.404] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0295.404] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.509] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0295.509] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0295.513] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0295.513] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.545] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0295.545] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0295.549] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0295.549] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.566] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.569] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0295.569] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0295.570] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0295.571] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.577] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.585] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.586] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0295.586] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0295.608] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0295.608] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.611] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.614] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.635] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.647] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.661] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.663] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0295.663] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0295.663] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0295.663] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.678] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.701] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0295.702] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0295.705] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0295.705] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.707] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.729] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.739] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.752] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.756] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.767] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.798] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0295.799] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0295.803] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0295.803] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.805] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.827] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.836] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.851] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.858] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0295.858] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0295.863] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0295.863] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.866] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.884] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0295.884] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0295.887] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0295.887] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.919] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0295.919] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0295.924] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0295.924] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.942] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.944] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0295.944] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0295.945] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0295.945] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.959] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.983] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0295.984] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0295.986] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0295.986] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0295.989] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.009] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.017] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.034] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.042] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.044] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0296.044] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0296.058] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0296.058] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.081] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.083] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0296.083] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0296.109] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0296.110] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.114] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.115] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0296.115] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0296.144] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0296.146] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.153] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.172] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.174] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0296.174] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0296.175] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0296.175] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.177] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.194] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.195] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0296.195] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0296.205] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0296.206] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.253] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0296.253] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0296.256] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0296.257] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.259] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0296.259] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0296.261] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0296.261] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.300] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.314] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.338] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.340] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0296.340] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0296.341] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0296.341] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.354] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0296.354] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0296.357] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0296.357] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.390] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.467] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0296.467] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0296.470] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0296.470] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.472] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.473] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.475] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.476] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.478] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.479] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.480] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.481] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.483] SetEvent (hEvent=0x104) returned 1
	[0296.483] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.532] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.561] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.566] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0296.566] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0296.567] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0296.567] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.570] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.586] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.589] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0296.589] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0296.626] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0296.626] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.630] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.633] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.641] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.666] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.690] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.703] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.705] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.706] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0296.706] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0296.708] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0296.708] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.709] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0296.709] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0296.736] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0296.736] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.744] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.768] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0296.768] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0296.771] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0296.771] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.774] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.796] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.807] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.821] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.825] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0296.825] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0296.826] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0296.826] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.830] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.837] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.861] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0296.861] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0296.864] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0296.864] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.866] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.875] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.888] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.898] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.899] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0296.899] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0296.900] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0296.900] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0296.902] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0296.902] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0297.008] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0297.008] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.017] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.044] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0297.045] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0297.049] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0297.049] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.052] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.079] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.092] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.110] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.111] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0297.112] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0297.113] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0297.113] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.128] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.157] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.163] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0297.163] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0297.165] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0297.165] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.167] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.188] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.201] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.227] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.229] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0297.229] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0297.230] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0297.230] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.243] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.246] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0297.246] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0297.288] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0297.288] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.293] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.296] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.325] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.333] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.348] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.369] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.370] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0297.371] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0297.372] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0297.372] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.373] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.388] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.389] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0297.389] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0297.462] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0297.462] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.485] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.487] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.509] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.522] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.538] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.539] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0297.539] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0297.620] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0297.620] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.662] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.668] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.673] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.726] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0297.727] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0297.730] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0297.730] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.733] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.766] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.787] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.789] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0297.789] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0297.804] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0297.806] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.808] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.835] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.864] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.867] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0297.867] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0297.871] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0297.872] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.874] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.876] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.905] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.923] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.941] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.943] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0297.943] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0297.945] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0297.945] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.956] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.978] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0297.996] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0297.996] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0297.999] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0298.000] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.002] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.029] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.052] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.055] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.067] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.091] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.092] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0298.092] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0298.093] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0298.093] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.106] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.108] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0298.108] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0298.138] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0298.138] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.139] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0298.139] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0298.143] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0298.143] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.146] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.174] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.189] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.209] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.211] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0298.211] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0298.211] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0298.211] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.258] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.261] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0298.261] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0298.296] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0298.296] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.300] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.301] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0298.301] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0298.303] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0298.303] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.316] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.332] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.340] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.362] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.370] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.398] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.400] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0298.400] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0298.401] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0298.401] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.403] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.465] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.468] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0298.468] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0298.503] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0298.503] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.507] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.510] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.538] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.584] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.600] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.605] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0298.606] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0298.607] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0298.607] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.615] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.616] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0298.616] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0298.650] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0298.651] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.656] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.661] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0298.661] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0298.665] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0298.665] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.691] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.703] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.721] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.723] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0298.723] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0298.724] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0298.724] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.735] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0298.735] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0298.737] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0298.737] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.749] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.762] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0298.762] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0298.764] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0298.764] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.798] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0298.798] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0298.803] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0298.804] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.818] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.819] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0298.820] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0298.820] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0298.820] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.834] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0298.834] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0298.836] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0298.836] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.850] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0298.850] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0298.874] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0298.874] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.876] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.902] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.917] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.933] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.939] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.944] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.945] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.947] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.948] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.949] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.950] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.952] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.953] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.955] SetEvent (hEvent=0x14c) returned 1
	[0298.955] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.961] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0298.961] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0298.978] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0298.978] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.980] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.981] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.983] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.986] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.987] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.989] SetEvent (hEvent=0x14c) returned 1
	[0298.989] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0298.991] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0298.991] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0299.117] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0299.117] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.118] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.120] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.121] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.122] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.123] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.125] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.126] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.128] SetEvent (hEvent=0x14c) returned 1
	[0299.128] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.136] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0299.136] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0299.233] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0299.233] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.235] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.236] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.238] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.240] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.241] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.243] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.244] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.245] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.246] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.248] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.249] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.254] SetEvent (hEvent=0x14c) returned 1
	[0299.254] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.256] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.258] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.259] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.261] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.262] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.264] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.266] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.267] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.268] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.270] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.271] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.272] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.273] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.274] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.275] SetEvent (hEvent=0x14c) returned 1
	[0299.275] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.276] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0299.276] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0299.349] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0299.349] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.351] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.353] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.369] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.371] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.373] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.374] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.376] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.377] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.379] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.380] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.381] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.382] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.383] SetEvent (hEvent=0x14c) returned 1
	[0299.383] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.385] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0299.385] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0299.462] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0299.462] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.466] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.468] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.470] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.473] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.478] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.483] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.489] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.492] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.502] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.507] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.508] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.510] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.511] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.513] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.514] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.516] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.517] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.518] SetEvent (hEvent=0x14c) returned 1
	[0299.518] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.519] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0299.519] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0299.711] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0299.711] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.713] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.714] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.715] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.717] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.719] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.720] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.727] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.728] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.730] SetEvent (hEvent=0x14c) returned 1
	[0299.730] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.731] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0299.731] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0299.758] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0299.758] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.763] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.767] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.769] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.777] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.778] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.785] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.789] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.808] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.812] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.813] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.823] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.824] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.825] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.827] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.829] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.831] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.835] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.836] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.839] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.845] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.846] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.847] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.849] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.850] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.851] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.853] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.855] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.856] SetEvent (hEvent=0x14c) returned 1
	[0299.856] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.857] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0299.857] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0299.881] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0299.881] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.882] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.883] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.885] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.886] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.887] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.888] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.890] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.891] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.893] SetEvent (hEvent=0x14c) returned 1
	[0299.893] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.894] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0299.894] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0299.926] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0299.926] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.928] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.930] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.931] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.932] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.933] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.934] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.935] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.937] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.938] SetEvent (hEvent=0x14c) returned 1
	[0299.938] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.939] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0299.939] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0299.954] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0299.954] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.959] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.960] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.962] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.963] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.964] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.965] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.966] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.968] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.969] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.971] SetEvent (hEvent=0x14c) returned 1
	[0299.971] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0299.972] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0299.972] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0300.004] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0300.004] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.005] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.007] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.008] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.009] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.011] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.012] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.013] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.016] SetEvent (hEvent=0x14c) returned 1
	[0300.016] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.017] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0300.017] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0300.033] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0300.033] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.035] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.036] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.037] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.040] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.041] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.043] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.044] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.046] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.047] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.048] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.049] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.050] SetEvent (hEvent=0x14c) returned 1
	[0300.050] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.052] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0300.052] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0300.123] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0300.123] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.124] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.127] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.128] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.129] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.131] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.132] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.134] SetEvent (hEvent=0x14c) returned 1
	[0300.134] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.135] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0300.135] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0300.157] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0300.157] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.159] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.160] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.161] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.163] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.164] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.165] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.167] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.168] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.170] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.172] SetEvent (hEvent=0x14c) returned 1
	[0300.172] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.174] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0300.174] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0300.313] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0300.313] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.316] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.317] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.318] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.320] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.322] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.326] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.327] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.330] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.331] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.333] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.336] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.336] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.337] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.339] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.340] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.341] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.346] SetEvent (hEvent=0x104) returned 1
	[0300.346] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.348] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0300.348] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0300.457] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0300.457] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.460] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.461] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.466] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.468] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.469] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.470] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.471] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.473] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.474] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.475] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.476] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.478] SetEvent (hEvent=0x104) returned 1
	[0300.478] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.479] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0300.479] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0300.502] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0300.502] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.504] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.505] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.507] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.509] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.510] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.512] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.513] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.515] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.516] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.517] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.518] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.519] SetEvent (hEvent=0x104) returned 1
	[0300.519] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.521] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0300.521] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0300.530] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0300.530] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.531] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.532] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.537] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.538] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.539] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.541] SetEvent (hEvent=0x104) returned 1
	[0300.541] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.542] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0300.542] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0300.606] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0300.607] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.609] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.610] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.611] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.613] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.614] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.616] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.618] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.619] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.620] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.621] SetEvent (hEvent=0x104) returned 1
	[0300.621] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.622] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0300.622] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0300.686] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0300.686] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.688] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.689] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.717] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.719] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.721] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.723] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.735] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.736] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.751] SetEvent (hEvent=0x104) returned 1
	[0300.751] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.753] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0300.753] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0300.812] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0300.813] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.816] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.827] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.828] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.829] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.831] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.832] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.833] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.834] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.835] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.836] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.837] SetEvent (hEvent=0x104) returned 1
	[0300.837] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.839] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0300.839] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0300.973] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0300.974] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.975] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.976] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.978] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.979] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.981] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.982] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.983] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.984] SetEvent (hEvent=0x104) returned 1
	[0300.984] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0300.986] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0300.986] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0301.198] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0301.198] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.199] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.200] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.204] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.205] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.207] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.209] SetEvent (hEvent=0x104) returned 1
	[0301.209] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.210] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0301.210] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0301.305] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0301.305] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.307] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.311] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.313] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.314] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.316] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.319] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.323] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.327] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.328] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.329] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.331] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.332] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.334] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.338] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.341] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.342] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.343] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.348] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.349] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.350] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.352] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.353] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.354] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.356] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.357] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.358] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.360] SetEvent (hEvent=0x104) returned 1
	[0301.360] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.361] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0301.361] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0301.366] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0301.367] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.368] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.371] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.377] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.379] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.382] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.384] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.389] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.391] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.393] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.394] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.396] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.397] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.399] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.400] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.401] SetEvent (hEvent=0x104) returned 1
	[0301.401] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.404] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.405] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.407] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.434] SetEvent (hEvent=0x104) returned 1
	[0301.434] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.436] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.437] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.438] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.440] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.442] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.448] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.449] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.451] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.453] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.454] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.456] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.457] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.459] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.460] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.461] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.463] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.464] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.465] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.466] SetEvent (hEvent=0x104) returned 1
	[0301.466] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.468] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.469] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.487] SetEvent (hEvent=0x104) returned 1
	[0301.487] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.489] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0301.489] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0301.511] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0301.511] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.513] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.514] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.515] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.517] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.518] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.524] SetEvent (hEvent=0x104) returned 1
	[0301.524] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.526] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.527] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.529] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.531] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.535] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.536] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.538] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.546] SetEvent (hEvent=0x104) returned 1
	[0301.546] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.548] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0301.548] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0301.581] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0301.582] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.583] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.585] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.588] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.589] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.591] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.593] SetEvent (hEvent=0x104) returned 1
	[0301.593] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.594] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0301.594] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0301.651] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0301.651] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.652] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.654] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.655] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.657] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.658] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.660] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.661] SetEvent (hEvent=0x104) returned 1
	[0301.661] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.663] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0301.663] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0301.680] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0301.680] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.683] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.684] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.685] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.687] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.689] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.691] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.692] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.693] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.694] SetEvent (hEvent=0x104) returned 1
	[0301.694] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.702] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.703] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.704] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.705] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.706] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.708] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.709] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.710] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.711] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.712] SetEvent (hEvent=0x104) returned 1
	[0301.712] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.713] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0301.713] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0301.779] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0301.779] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.789] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.790] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.793] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.797] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.799] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.801] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.803] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.805] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.807] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.808] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.811] SetEvent (hEvent=0x104) returned 1
	[0301.811] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.813] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0301.813] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0301.890] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0301.890] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.892] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.894] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.897] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.903] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.904] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.906] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.908] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.910] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.911] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.913] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.916] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.917] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.919] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.920] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.922] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.925] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.927] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.931] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.936] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.937] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.939] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.941] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.943] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.944] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.945] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.947] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.950] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.951] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.953] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.955] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.957] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.962] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.964] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.965] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.967] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.970] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.971] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.972] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.973] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.976] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.977] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.978] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.982] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.983] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.985] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.987] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.989] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0301.990] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.008] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.010] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.014] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.016] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.018] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.023] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.025] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.026] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.028] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.029] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.030] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.033] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.040] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.041] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.045] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.047] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.048] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.049] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.051] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.052] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.054] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.055] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.058] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.060] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.061] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.063] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.064] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.067] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.068] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.070] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.072] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.074] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.075] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.077] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.078] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.080] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.082] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.084] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.086] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.088] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.089] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.091] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.093] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.094] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.097] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.098] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.101] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.103] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.110] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.112] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.113] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.115] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.117] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.120] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.122] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.124] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.126] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.129] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.131] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.133] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.134] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.136] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.141] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.144] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.145] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.147] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.149] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.150] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.151] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.153] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.155] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.156] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.158] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.160] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.162] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.164] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.165] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.183] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.185] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.187] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.188] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.189] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.192] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.197] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.197] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.199] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.200] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.202] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.204] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.205] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.207] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.207] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.209] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.211] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.213] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.221] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.225] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.227] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.229] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.231] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.244] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.250] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.255] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.256] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.258] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.260] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.266] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.267] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.269] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.271] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.272] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.273] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.276] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.277] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.279] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.284] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.285] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.287] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.289] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.291] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.293] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.294] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.296] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.297] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.299] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.301] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.303] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.305] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.307] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.308] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.310] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.311] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.313] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.315] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.317] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.319] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.320] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.322] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.324] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.326] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.328] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.329] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.331] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.332] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.333] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.334] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.337] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.339] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.347] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.349] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.350] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.352] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.354] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.356] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.357] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.359] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.361] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.366] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.368] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.370] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.372] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.373] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.374] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.375] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.380] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.382] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.383] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.384] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.387] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.389] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.390] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.391] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.394] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.396] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.397] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.399] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.402] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.404] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.406] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.440] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.444] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.454] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.464] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.468] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.470] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.473] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.478] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.488] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.490] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.492] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.496] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.499] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.501] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.506] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.508] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.512] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.517] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.518] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.523] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.525] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.529] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.531] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.533] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.539] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.543] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.544] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.548] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.550] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.553] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.560] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.564] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.570] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.574] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.580] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.585] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.590] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.595] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.602] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.604] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.608] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.611] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.618] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.620] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.628] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.632] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.634] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.640] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.644] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.645] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.649] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.652] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.654] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.658] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.666] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.669] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.673] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.678] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.683] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.690] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.692] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.693] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.695] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.696] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.698] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.705] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.711] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.712] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.716] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.719] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.740] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.743] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.747] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.750] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.756] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.759] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.762] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.765] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.767] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0302.767] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0302.768] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0302.768] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.771] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.773] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.774] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.781] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.802] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.827] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.831] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.847] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.855] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.924] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.977] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.980] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0302.981] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.000] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.015] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.018] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.032] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.044] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.050] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.055] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.061] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.066] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.072] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.075] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.079] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.081] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.086] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.095] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.108] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.113] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.116] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.122] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.127] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.131] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.135] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.139] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.145] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.147] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.151] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.157] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.159] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.165] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.167] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.170] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.173] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.177] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.180] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.185] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.191] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.197] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.199] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.206] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.212] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.229] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.232] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.235] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.237] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.241] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.246] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.248] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.251] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.255] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.258] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.260] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.261] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.264] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.272] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.278] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.282] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.286] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.288] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.298] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.304] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.313] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.315] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.321] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.326] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.339] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.345] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.349] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.351] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.352] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.355] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.359] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.360] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.365] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.368] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.371] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.372] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.375] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.381] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.387] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.391] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.394] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.398] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.399] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.402] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.404] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.406] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.409] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.410] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.419] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.424] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.487] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.491] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.493] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.495] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.497] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.498] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.499] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.500] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.504] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.506] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.510] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.517] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.520] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.522] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.525] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.527] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.530] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.532] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.536] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.539] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.548] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.552] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.554] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.556] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.559] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.561] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.562] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.564] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.566] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.568] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.571] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.573] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.575] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.576] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.577] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.595] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.597] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.600] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.604] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.605] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.607] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.609] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.613] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.616] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.623] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.626] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.631] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.635] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.636] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.638] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.652] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.654] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.657] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.665] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.668] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.670] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.671] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.673] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.674] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.676] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.679] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.681] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.685] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.694] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.710] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.717] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.720] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.721] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.754] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.764] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.767] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.774] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.775] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.780] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.782] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.784] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.785] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.818] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.820] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.824] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.829] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.831] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.834] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.839] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.842] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.843] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.848] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.853] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.859] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.861] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.864] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.877] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.883] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.887] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.888] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.895] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.900] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.904] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.908] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.910] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.911] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.916] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.922] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.925] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.927] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.931] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.934] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.937] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.940] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.942] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.946] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.947] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.950] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.956] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.964] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.965] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.968] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.975] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.976] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.982] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.985] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.987] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.995] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0303.998] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.001] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.002] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.006] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.011] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.013] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.018] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.022] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.023] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.025] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.029] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.030] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.035] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.040] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.045] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.048] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.049] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.054] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.057] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.059] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.079] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.082] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.087] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.091] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.095] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.099] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.103] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.104] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.105] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.110] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.115] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.119] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.120] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.126] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.127] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.132] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.134] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.138] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.143] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.149] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.151] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.153] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.161] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.164] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.165] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.170] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.174] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.176] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.181] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.196] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.199] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.204] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.206] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.207] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.209] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.211] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.212] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.225] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.227] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.228] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.229] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.231] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.232] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.238] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.243] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.298] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.311] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.313] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.314] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.315] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.336] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.337] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.339] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.340] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.342] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.371] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.373] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.379] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.381] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.383] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.389] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.392] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.395] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.397] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.399] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.401] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.405] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.406] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.408] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.410] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.411] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.421] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.423] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.460] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.466] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.470] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.474] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.477] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.479] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.480] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.495] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.500] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.501] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.503] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.504] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.506] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.528] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.533] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.542] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.558] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.560] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.564] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.565] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.572] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.576] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.580] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.584] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.586] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.590] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.592] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.595] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.597] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.599] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.600] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.603] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.604] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.607] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.611] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.615] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.617] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.620] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.625] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.632] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.634] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.637] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.639] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.642] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.643] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.645] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.647] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.648] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.653] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.657] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.659] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.667] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.670] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.671] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.682] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.687] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.690] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.695] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.696] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.698] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.699] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.702] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.704] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.706] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.710] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.712] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.715] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.718] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.720] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.723] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.724] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.725] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.727] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.742] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.748] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.751] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.755] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.756] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.767] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.771] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.774] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.775] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.777] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.786] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.815] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.817] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.820] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.821] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.823] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.826] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.827] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.828] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.829] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.830] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.832] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.835] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.838] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.840] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.842] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.843] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.845] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.846] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.865] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.868] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.871] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.876] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.878] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.880] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.882] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.886] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.887] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.889] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.891] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.894] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.896] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.898] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.900] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.902] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.920] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.927] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.933] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.936] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.938] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.940] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.943] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.951] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.955] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.957] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.959] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.964] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.971] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.972] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.975] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.991] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0304.992] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.002] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.005] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.006] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.010] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.015] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.017] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.023] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.026] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.030] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.035] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.036] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.041] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.045] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.050] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.054] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.056] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.061] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.066] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.072] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.075] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.079] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.083] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.088] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.094] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.098] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.099] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.101] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.104] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.106] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.109] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.114] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.120] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.123] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.127] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.130] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.133] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.134] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.136] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.139] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.141] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.147] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.150] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.152] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.155] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.157] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.161] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.165] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.167] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.170] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.173] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.174] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.176] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.179] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.181] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.183] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.187] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.189] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.191] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.195] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.196] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.200] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.205] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.210] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.213] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.223] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.224] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.230] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.238] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.240] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.247] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.249] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.253] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.257] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.261] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.262] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.267] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.270] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.271] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.274] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.276] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.280] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.284] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.288] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.292] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.293] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.298] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.302] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.305] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.308] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.310] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.316] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.321] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.327] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.329] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.331] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.335] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.338] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.339] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.354] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.357] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.358] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.360] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.364] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.365] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.367] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.368] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.369] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.371] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.372] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.392] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.403] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.404] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.405] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.419] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.423] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.424] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.447] SetEvent (hEvent=0x12c) returned 1
	[0305.447] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.448] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0305.448] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0305.678] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0305.678] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.680] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.681] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.683] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.684] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.685] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.686] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.687] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.688] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.689] SetEvent (hEvent=0x12c) returned 1
	[0305.689] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.691] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0305.691] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0305.700] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0305.700] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.706] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.709] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.713] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.718] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.721] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.722] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.725] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.728] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.730] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.732] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.735] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.740] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.743] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.745] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.747] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.758] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.761] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.764] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.767] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.771] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.772] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.773] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.775] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.778] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.781] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.784] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.790] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.792] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.875] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.889] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.892] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.895] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.898] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.901] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.905] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.910] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.912] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.916] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.922] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.925] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.929] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.932] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.936] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.939] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.940] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.942] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.945] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.948] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.957] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.960] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.964] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.966] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.968] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.971] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.972] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.974] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.977] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.981] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.984] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.987] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.988] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.991] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.994] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0305.999] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.001] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.003] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.006] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.011] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.015] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.019] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.020] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.023] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.026] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.028] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.032] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.035] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.037] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.039] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.041] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.043] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.045] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.047] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.049] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.050] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.051] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.059] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.059] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0306.060] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0306.073] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0306.073] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.077] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.084] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.087] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.088] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.091] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.093] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.095] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.096] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.097] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.098] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.100] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.101] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.103] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.105] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.108] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.113] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.115] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.117] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.118] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.119] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.121] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.141] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.148] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.150] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.162] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.164] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.171] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.173] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.174] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.177] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.179] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.180] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.182] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.228] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.235] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.241] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.252] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.255] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.256] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.272] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.274] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.293] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.299] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.304] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.310] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.314] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.316] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.322] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.330] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.336] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.338] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.343] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.350] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.356] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.361] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.366] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.369] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.373] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.376] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.379] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.380] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.382] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.385] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.388] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.392] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.395] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.398] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.401] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.404] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.406] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.408] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.412] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.416] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.419] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.423] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.450] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.452] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.453] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.457] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.460] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.462] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.464] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.466] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.469] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.472] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.478] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.480] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.486] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.489] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.491] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.496] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.505] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.520] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.526] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.531] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.537] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.541] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.550] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.551] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.553] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.558] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.562] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.565] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.571] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.575] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.583] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.589] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.595] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.599] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.601] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.607] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.611] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.616] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.622] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.625] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.633] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.638] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.647] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.651] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.656] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.659] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.663] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.664] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.666] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.668] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.675] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.699] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.705] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.707] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.710] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.724] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.731] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.740] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.742] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.747] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.749] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.754] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.761] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.763] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.764] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.769] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.782] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.794] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.830] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.850] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.861] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.865] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.866] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.868] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.870] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.873] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.878] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.882] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.890] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.895] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.900] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.903] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.909] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.915] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.921] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.926] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.928] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.930] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.937] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.943] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.945] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.947] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.948] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.952] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.954] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.955] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.963] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.964] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.971] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.979] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.987] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.990] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0306.995] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.000] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.004] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.243] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.340] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.452] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.470] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.476] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.478] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.483] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.485] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.487] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.488] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.498] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.503] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.510] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.513] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.517] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.521] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.532] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.537] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.538] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.539] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.540] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.542] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.543] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.545] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.547] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.548] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.550] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.552] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.553] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.555] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.556] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.558] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.656] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.673] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.674] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.676] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.677] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.679] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.680] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.701] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.702] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.704] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.705] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.706] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.708] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.735] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.746] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.755] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.760] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.766] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.783] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.788] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.792] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.793] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.795] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.797] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.799] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.807] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.808] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.809] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.811] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.813] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.815] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.816] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.821] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.823] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.831] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.833] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.835] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.839] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.843] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.844] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.845] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.847] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.850] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.852] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.856] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.857] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.859] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.862] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.863] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.864] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.866] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.868] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.872] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.874] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.879] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.880] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.883] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.885] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.888] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.890] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.894] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.914] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.917] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.919] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.921] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.927] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.928] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.931] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.933] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.935] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.938] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.940] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.946] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.955] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.959] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.960] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.961] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.967] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.968] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.970] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.971] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.973] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.975] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.977] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.978] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.980] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.983] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.987] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.991] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.994] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0307.998] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.002] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.004] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.007] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.008] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.011] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.013] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.015] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.018] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.020] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.023] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.026] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.027] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.031] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.033] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.037] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.038] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.040] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.044] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.047] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.051] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.059] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.062] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.064] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.069] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.072] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.074] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.079] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.083] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.085] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.091] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.094] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.095] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.097] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.101] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.105] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.108] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.110] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.111] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.115] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.117] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.123] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.124] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.126] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.130] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.134] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.136] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.139] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.141] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.143] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.146] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.148] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.149] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.150] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.158] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.161] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.163] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.167] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.169] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.170] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.172] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.173] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.176] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.178] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.180] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.186] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.189] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.190] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.192] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.195] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.196] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.208] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.213] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.225] SetEvent (hEvent=0x12c) returned 1
	[0308.225] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.228] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.233] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.237] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.239] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.242] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.245] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.250] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.252] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.255] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.263] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.266] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.270] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.274] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.275] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.280] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.285] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.287] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.288] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.289] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.291] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.293] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.294] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.296] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.297] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.298] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.299] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.301] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.302] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.304] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.306] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.308] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.310] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.313] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.315] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.318] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.320] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.322] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.323] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.325] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.330] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.333] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.335] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.338] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.341] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.344] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.346] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.348] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.350] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.351] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.352] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.353] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.354] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.355] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.360] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.363] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.365] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.367] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.369] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.372] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.373] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.375] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.377] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.380] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.381] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.383] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.386] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.388] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.392] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.394] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.395] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.397] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.398] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.400] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.402] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.405] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.407] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.408] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.410] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.411] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.413] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.414] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.417] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.420] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.422] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.442] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.444] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.445] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.446] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.448] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.450] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.455] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.460] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.461] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.463] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.467] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.468] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.471] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.476] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.480] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.483] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.485] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.488] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.490] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.492] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.495] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.500] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.503] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.505] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.507] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.509] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.513] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.514] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.515] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.517] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.518] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.520] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.521] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.522] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.523] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.526] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.528] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.530] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.532] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.534] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.535] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.537] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.538] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.540] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.543] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.544] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.548] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.552] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.556] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.570] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.571] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.573] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.575] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.576] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.577] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.579] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.580] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.581] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.582] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.584] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.587] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.588] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.590] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.591] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.593] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.594] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.595] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.596] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.598] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.601] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.604] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.616] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.618] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.620] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.622] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.624] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.625] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.626] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.630] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.631] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.633] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.634] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.636] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.638] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.639] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.640] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.642] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.643] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.644] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.651] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.654] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.656] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.658] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.660] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.661] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.664] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.667] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.669] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.671] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.673] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.676] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.678] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.679] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.681] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.684] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.686] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.687] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.688] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.690] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.691] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.696] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.698] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.699] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.701] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.702] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.704] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.706] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.708] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.709] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.711] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.713] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.715] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.716] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.718] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.719] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.721] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.722] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.723] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.724] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.726] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.728] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.731] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.732] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.733] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.734] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.735] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.736] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.737] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.739] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.741] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.743] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.745] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.747] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.748] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.749] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.750] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.756] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.757] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.760] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.762] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.764] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.765] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.768] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.770] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.771] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.773] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.782] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.784] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.786] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.787] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.788] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.791] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.792] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.797] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.800] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.804] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.806] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.810] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.813] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.815] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.818] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.819] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.820] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.822] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.824] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.826] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.828] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.829] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.831] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.833] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.834] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.836] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.840] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.842] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.844] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.846] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.847] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.848] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.858] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.860] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.864] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.874] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.877] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.880] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.885] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.888] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.891] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.893] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.898] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.902] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.905] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.907] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.909] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.919] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.922] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.924] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.926] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.931] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.935] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.944] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.947] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.950] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.955] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.958] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.962] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.966] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.969] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.971] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.977] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.981] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.983] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.985] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.988] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.991] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.993] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0308.995] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.001] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.001] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.003] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.004] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.010] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.013] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.014] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.018] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.023] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.026] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.027] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.029] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.031] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.034] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.041] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.043] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.049] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.060] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.062] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.068] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.071] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.074] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.078] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.079] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.083] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.084] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.086] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.087] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.092] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.094] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.099] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.100] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.102] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.103] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.105] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.107] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.108] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.111] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.113] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.119] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.124] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.125] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.129] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.134] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.141] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.143] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.148] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.153] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.155] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.162] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.164] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.172] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.177] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.185] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.189] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.193] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.199] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.205] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.207] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.224] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.229] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.233] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.235] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.242] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.254] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.257] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.259] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.262] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.268] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.276] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.280] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.281] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.282] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.290] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.292] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.294] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.295] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.296] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.300] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0309.300] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0309.301] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0309.301] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.303] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.305] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.308] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.310] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.324] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.325] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.327] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.335] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.354] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.375] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.389] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.392] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.397] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.399] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.400] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.403] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.412] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.416] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.419] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.423] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.425] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.450] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.454] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.456] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.458] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.461] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.467] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.471] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.475] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.478] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.481] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.483] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.486] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.490] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.491] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.494] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.497] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.498] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.501] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.503] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.504] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.510] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.512] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.516] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.521] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.525] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.526] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.530] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.533] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.535] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.536] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.539] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.541] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.543] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.545] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.554] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.556] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.558] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.561] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.563] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.565] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.567] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.570] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.582] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.585] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.587] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.589] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.590] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.592] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.593] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.594] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.597] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.598] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.600] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.601] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.602] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.605] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.607] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.609] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.610] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.612] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.613] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.616] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.618] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.619] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.620] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.622] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.624] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.625] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.626] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.628] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.629] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.631] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.633] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.636] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.638] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.639] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.641] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.642] SetEvent (hEvent=0x14c) returned 1
	[0309.642] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.645] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.647] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.649] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.650] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.652] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.654] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.656] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.658] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.660] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.661] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.663] SetEvent (hEvent=0x14c) returned 1
	[0309.664] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.665] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0309.665] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0309.666] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0309.667] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.669] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.671] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.672] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.673] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.675] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.677] SetEvent (hEvent=0x14c) returned 1
	[0309.677] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.679] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0309.679] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0309.680] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0309.680] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.681] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.683] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.685] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.688] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.689] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.690] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.692] SetEvent (hEvent=0x14c) returned 1
	[0309.692] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.694] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.698] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.700] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.701] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.704] SetEvent (hEvent=0x14c) returned 1
	[0309.704] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.706] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0309.706] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0309.708] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0309.708] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.710] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.713] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.716] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.718] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.719] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.720] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.721] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.722] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.723] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.725] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.726] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.728] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.734] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.735] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.750] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.757] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.759] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.768] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.771] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.772] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.788] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.797] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.823] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.829] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.830] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.837] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.839] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.841] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.843] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.854] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.857] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.864] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.872] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.874] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.881] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.891] SetEvent (hEvent=0x14c) returned 1
	[0309.891] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.894] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.896] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.900] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.902] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.912] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.960] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.984] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.987] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.988] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.991] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.993] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0309.998] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.005] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.010] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.013] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.018] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.019] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.023] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.025] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.027] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.029] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.030] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.032] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.034] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.035] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.036] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.039] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.040] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.042] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.046] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.047] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.049] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.051] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.054] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.055] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.057] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.061] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.063] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.065] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.067] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.070] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.073] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.074] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.076] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.078] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.081] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.096] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.098] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.101] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.103] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.104] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.105] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.107] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.109] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.111] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.113] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.115] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.116] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.117] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.122] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.124] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.125] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.127] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.128] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.131] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.131] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.133] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.139] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.140] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.142] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.144] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.145] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.146] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.148] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.150] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.153] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.155] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.156] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.157] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.158] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.160] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.162] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.164] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.166] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.167] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.172] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.173] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.180] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.182] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.183] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.185] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.186] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.187] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.188] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.190] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.191] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.194] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.195] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.197] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.198] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.200] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.202] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.203] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.206] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.207] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.209] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.211] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.212] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.220] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.224] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.277] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.281] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.283] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.286] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.288] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.290] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.292] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.294] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.295] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.298] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.299] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.301] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.302] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.304] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.306] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.309] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.312] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.321] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.324] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.327] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.331] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.333] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.335] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.337] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.344] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.345] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.348] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.349] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.354] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.357] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.360] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.361] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.364] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.365] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.368] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.369] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.371] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.375] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.378] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.379] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.384] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.390] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.400] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.404] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.407] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.410] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.412] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.413] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.415] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.419] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.421] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.423] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.443] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.447] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.450] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.451] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.453] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.458] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.460] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.464] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.466] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.470] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.472] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.477] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.482] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.484] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.492] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.498] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.501] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.503] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.506] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.508] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.510] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.513] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.515] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.522] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.527] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.532] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.536] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.537] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.539] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.544] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.546] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.549] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.550] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.556] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.558] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.560] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.564] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.565] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.567] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0310.568] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0310.569] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0310.570] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.574] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.576] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.580] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.581] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.583] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.586] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.592] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.594] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.597] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.601] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.602] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.603] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.607] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.610] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.611] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.612] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.621] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.623] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.625] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.627] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.628] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.630] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.632] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.635] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.637] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.640] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.647] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.649] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.650] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.652] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.654] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.655] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.656] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.658] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.660] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.661] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.662] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.664] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.666] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.671] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.673] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.676] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.678] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.680] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.682] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.684] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.687] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.695] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.697] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.698] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.701] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.703] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.704] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.705] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.708] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.711] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.712] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.714] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.715] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.717] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.718] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.719] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.720] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.722] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.723] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.724] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.725] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.726] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.729] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.730] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.731] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.732] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.733] SetEvent (hEvent=0x12c) returned 1
	[0310.733] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0310.735] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0310.735] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0311.077] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0311.077] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.079] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.091] SetEvent (hEvent=0x12c) returned 1
	[0311.091] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.093] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0311.093] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0311.172] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0311.172] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.174] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.177] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.199] SetEvent (hEvent=0x12c) returned 1
	[0311.199] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.202] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.203] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.208] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.211] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.212] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.225] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.229] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.231] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.235] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.238] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.240] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.242] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.243] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.245] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.246] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.248] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.250] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.252] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.254] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.256] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.258] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.259] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.261] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.264] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.265] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.267] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.268] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.270] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.271] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.273] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.274] SetEvent (hEvent=0x12c) returned 1
	[0311.274] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.275] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0311.275] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0311.293] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0311.293] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.294] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.296] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.310] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.312] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.313] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.314] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.315] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.317] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.318] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.320] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.321] SetEvent (hEvent=0x12c) returned 1
	[0311.321] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.322] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0311.323] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0311.330] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0311.331] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.332] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.334] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.335] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.336] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.338] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.339] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.341] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.342] SetEvent (hEvent=0x12c) returned 1
	[0311.342] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.343] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0311.343] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0311.350] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0311.350] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.352] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.353] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.354] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.355] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.356] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.358] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.359] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.361] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.362] SetEvent (hEvent=0x12c) returned 1
	[0311.362] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.364] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0311.364] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0311.374] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0311.374] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.375] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.377] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.378] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.379] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.381] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.382] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.383] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.384] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.386] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.387] SetEvent (hEvent=0x12c) returned 1
	[0311.387] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.389] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0311.389] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0311.409] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0311.409] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.411] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.413] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.414] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.415] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.416] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.418] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.419] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.422] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.423] SetEvent (hEvent=0x12c) returned 1
	[0311.423] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.424] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0311.424] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0311.495] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0311.495] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.497] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.498] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.499] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.500] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.502] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.504] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.505] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.507] SetEvent (hEvent=0x12c) returned 1
	[0311.507] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.510] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0311.510] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0311.552] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0311.552] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.554] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.562] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.564] SetEvent (hEvent=0x12c) returned 1
	[0311.564] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.565] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0311.565] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0311.674] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0311.674] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.675] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.677] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.678] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.680] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.681] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.683] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.684] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.685] SetEvent (hEvent=0x12c) returned 1
	[0311.685] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.686] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0311.686] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0311.801] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0311.802] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.805] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.807] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.808] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.810] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.811] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.813] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.815] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.818] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.819] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.821] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.823] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.824] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.826] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.828] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.829] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.831] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.832] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.833] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.835] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.840] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.842] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.843] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.844] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.846] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.847] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.848] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.850] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.852] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.853] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.855] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.856] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.857] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.859] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.860] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.861] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.862] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.864] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.866] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.869] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.870] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.871] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.872] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.877] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.878] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.880] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.881] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.886] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.887] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.888] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.891] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.893] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.894] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.897] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.899] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.900] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.901] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.903] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.904] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.906] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.907] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.909] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.911] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.914] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.918] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.922] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.925] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.927] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.930] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.932] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.933] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.934] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.935] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.937] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.938] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.940] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.943] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.945] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.947] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.949] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.951] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.953] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.955] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.959] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.960] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.962] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.963] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.965] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.968] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.969] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.970] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.972] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.973] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.975] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.980] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.982] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.984] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.986] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.987] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.989] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.991] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.992] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.994] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.997] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0311.998] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.005] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.006] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.008] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.010] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.012] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.013] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.014] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.015] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.016] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.018] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.020] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.022] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.023] SetEvent (hEvent=0x12c) returned 1
	[0312.023] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.024] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0312.024] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0312.040] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0312.040] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.047] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.049] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.067] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.070] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.072] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.073] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.074] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.076] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.077] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.078] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.080] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.081] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.091] SetEvent (hEvent=0x12c) returned 1
	[0312.091] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.093] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0312.093] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0312.153] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0312.153] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.155] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.156] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.157] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.158] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.159] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.161] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.162] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.163] SetEvent (hEvent=0x12c) returned 1
	[0312.163] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.164] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0312.165] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0312.192] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0312.192] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.194] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.196] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.204] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.207] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.209] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.210] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.211] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.213] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.225] SetEvent (hEvent=0x12c) returned 1
	[0312.225] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.229] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.231] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.235] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.236] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.239] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.240] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.241] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.244] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.246] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.248] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.249] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.251] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.252] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.254] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.256] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.257] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.260] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.262] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.263] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.264] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.266] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.269] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.272] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.273] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.274] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.275] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.276] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.278] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.279] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.280] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.282] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.283] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.286] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.287] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.289] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.290] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.292] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.293] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.297] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.299] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.301] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.303] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.304] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.306] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.309] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.311] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.312] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.314] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.316] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.317] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.319] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.320] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.322] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.323] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.325] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.327] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.328] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.330] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.333] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.335] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.336] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.338] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.339] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.342] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.342] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.344] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.345] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.347] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.349] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.351] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.354] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.360] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.363] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.364] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.369] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.371] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.374] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.375] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.376] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.378] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.380] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.385] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.386] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.393] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.394] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.396] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.399] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.402] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.409] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.411] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.413] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.414] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.415] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.417] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.418] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.419] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.422] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.442] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.443] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.444] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.446] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.448] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.449] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.450] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.451] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.453] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.455] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.457] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.462] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.463] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.465] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.467] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.468] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.470] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.471] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.473] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.474] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.476] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.477] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.478] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.479] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.481] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.482] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.483] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.485] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.487] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.488] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.490] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.492] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.494] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.495] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.497] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.503] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.504] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.506] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.507] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.510] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.511] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.514] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.515] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.520] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.523] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.525] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.526] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.528] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.529] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.531] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.533] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.535] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.536] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.538] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.539] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.541] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.544] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.546] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.549] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.551] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.553] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.556] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.557] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.560] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.561] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.563] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.564] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.566] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.568] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.569] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.572] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.574] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.576] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.578] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.580] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.581] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.583] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.586] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.588] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.590] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.592] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.594] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.595] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.597] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.599] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.602] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.603] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.605] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.606] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.607] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.608] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.609] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.612] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.614] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.616] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.618] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.627] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.631] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.632] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.634] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.635] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.637] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.639] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.641] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.643] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.645] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.647] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.649] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.650] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.651] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.653] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.656] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.657] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.659] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.682] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.754] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.755] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.758] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.761] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.765] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.766] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.770] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.772] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.774] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.776] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.778] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.780] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.782] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.785] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.790] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.793] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.795] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.802] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.805] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.807] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.815] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.817] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.818] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.820] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.821] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.823] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.828] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.830] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.832] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.834] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.836] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.838] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.841] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.847] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.851] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.852] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.853] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.856] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.858] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.860] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.866] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.868] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.870] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.872] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.874] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.876] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.877] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.880] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.882] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.882] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.884] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.887] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.890] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.894] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.896] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.901] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.902] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.905] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.907] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.909] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.911] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.913] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.915] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.917] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.918] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.919] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.921] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.927] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.930] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.933] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.935] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.938] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.942] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.947] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.950] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.952] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.953] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.955] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.957] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.960] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.962] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.965] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.967] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.968] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.970] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.980] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.984] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.985] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.988] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.990] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.992] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.993] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.995] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.998] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0312.999] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.002] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.004] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.006] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.008] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.014] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.015] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.019] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.021] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.024] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.027] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.032] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.035] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.039] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.040] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.042] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.043] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.045] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.047] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.050] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.051] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.054] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.055] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.056] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.057] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.059] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.061] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.063] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.064] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.067] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.068] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.069] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.070] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.072] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.076] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.078] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.086] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.089] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.090] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0313.090] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0313.091] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0313.091] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.092] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.095] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.097] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.099] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.101] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.102] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.104] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.106] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.108] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.119] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.122] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.124] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.128] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.130] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.132] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.140] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.146] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.149] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.151] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.154] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.160] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.163] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.165] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.168] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.171] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.175] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.178] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.180] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.181] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.183] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.185] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.188] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.192] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.197] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.198] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.202] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.204] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.208] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.210] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.210] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.213] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.221] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.222] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.227] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.230] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.231] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.233] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.235] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.236] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.238] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.240] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.241] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.243] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.245] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.247] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.248] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.249] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.250] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.252] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.254] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.256] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.258] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.263] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.266] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.267] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.268] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.270] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.273] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.275] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.279] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.281] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.284] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.285] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.287] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.288] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.289] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.292] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.294] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.295] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.298] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.300] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.303] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.304] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.305] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.307] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.308] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.309] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.311] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.313] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.314] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.315] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.316] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.318] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.320] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.322] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.324] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.325] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.329] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.330] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.332] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.333] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.335] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.336] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.338] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.339] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.340] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.342] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.343] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.345] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.346] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.348] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.350] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.351] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.352] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.353] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.355] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.356] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.357] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.359] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.360] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.362] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.363] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.365] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.366] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.368] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.370] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.372] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.374] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.375] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.376] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.377] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.379] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.381] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.382] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.383] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.385] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.386] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.396] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.398] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.400] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.401] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.403] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.404] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.406] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.407] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.409] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.410] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.412] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.414] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.416] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.418] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.420] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.423] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.424] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.445] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.447] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.448] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.449] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.451] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.453] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.454] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.455] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.457] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.459] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.460] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.461] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.462] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.464] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.466] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.469] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.470] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.471] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.474] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.475] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.477] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.478] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.480] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.482] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.483] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.485] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.487] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.488] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.490] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.492] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.494] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.496] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.497] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.499] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.499] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.501] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.503] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.505] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.506] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.508] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.510] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.511] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.514] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.516] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.518] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.520] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.521] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.524] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.527] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.528] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.530] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.531] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.533] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.535] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.536] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.538] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.541] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.542] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.543] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.545] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.547] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.549] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.550] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.551] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.554] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.555] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.560] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.562] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.563] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.565] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.567] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.569] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.570] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.572] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.573] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.574] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.577] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.578] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.581] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.586] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.587] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.589] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.590] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.591] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.592] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.606] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.607] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.609] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.611] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.612] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.616] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.618] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.620] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.621] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.624] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.625] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.628] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.630] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.631] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.632] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.634] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.636] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.638] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.639] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.641] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.642] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.644] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.648] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.649] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.651] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.653] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.655] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.656] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.659] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.660] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.663] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.664] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.666] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.668] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.669] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.671] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.672] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.674] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.675] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.679] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.683] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.684] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.686] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.688] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.690] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.693] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.696] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.704] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.710] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.713] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.714] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.716] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.718] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.721] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.723] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.726] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.728] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.730] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.733] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.739] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.743] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.750] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.752] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.755] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.757] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.759] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.760] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.761] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.763] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.785] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.791] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.792] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.793] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.795] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.797] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.799] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.802] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.805] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.806] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.808] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.810] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.813] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.814] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.821] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.824] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.825] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.827] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.829] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.830] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.833] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.834] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.838] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.845] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.848] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.849] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.854] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.857] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.860] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.862] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.863] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.865] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.866] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.867] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.869] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.872] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.876] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.880] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.881] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.883] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.886] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.888] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.890] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.891] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.894] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.901] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.902] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.906] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.911] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.912] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.913] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.915] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.916] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.916] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.920] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.923] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.927] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.928] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.931] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.933] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.936] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.939] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.940] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.944] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.947] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.951] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.954] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.960] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.964] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.967] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.968] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.970] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.971] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.972] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.975] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.981] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.982] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.985] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.986] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.991] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.995] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0313.998] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.003] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.005] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.007] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.010] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.014] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.022] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.024] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.028] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.030] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.032] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.033] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.035] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.039] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.041] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.048] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.050] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.054] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.056] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.057] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.057] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.076] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.077] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.079] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.088] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.090] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.093] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.097] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.098] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.099] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.101] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.103] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.112] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.113] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.115] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.118] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.120] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.123] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.126] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.128] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.137] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.139] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.141] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.149] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.153] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.154] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.157] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.158] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.160] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.164] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.166] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.182] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.183] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.187] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.196] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.199] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.201] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.205] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.207] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.210] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.211] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.213] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.223] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.226] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.227] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.229] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.231] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.233] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.239] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.241] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.242] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.243] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.249] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.250] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.253] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.254] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.255] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.258] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.259] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.264] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.266] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.268] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.270] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.272] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.274] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.275] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.277] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.279] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.281] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.283] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.284] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.286] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.287] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.288] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.290] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.294] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.295] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.297] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.299] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.300] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.302] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.304] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.305] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.307] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.308] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.309] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.311] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.314] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.316] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.318] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.321] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.323] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.324] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.326] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.328] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.329] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.331] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.333] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.334] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.336] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.339] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.340] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.342] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.344] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.345] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.348] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.350] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.351] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.353] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.354] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.355] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.357] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.359] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.360] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.363] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.367] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.369] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.371] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.372] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.374] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.376] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.378] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.382] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.384] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.385] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.390] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.392] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.394] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.396] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.398] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.406] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.408] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.412] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.413] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.417] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.418] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.420] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.423] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.445] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.448] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.452] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.492] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.494] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0314.494] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0314.564] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0314.565] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.611] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.634] SetEvent (hEvent=0x124) returned 1
	[0314.634] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.649] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0314.649] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0314.668] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0314.668] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.669] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.671] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.672] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.674] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.675] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.676] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.678] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.679] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.681] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.683] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.684] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.688] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.690] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.691] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.693] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.694] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.695] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.697] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.700] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.701] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.704] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.706] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.707] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.709] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.710] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.712] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.713] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.715] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.717] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.718] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.719] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.721] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.722] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.723] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.724] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.726] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.727] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.728] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.730] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.731] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.735] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.736] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.739] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.740] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.742] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.743] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.745] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.746] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.748] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.750] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.752] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.753] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.754] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.756] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.758] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.759] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.760] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.763] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.767] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.776] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.778] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.780] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.781] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.782] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.784] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.787] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.789] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.791] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.821] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.825] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.828] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.834] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.838] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.841] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.852] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.862] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.866] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.869] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.871] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.874] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.876] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.878] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.880] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.882] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.886] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.888] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.890] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.892] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.896] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.900] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.901] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.903] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.906] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.908] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.911] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.922] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.928] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.930] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.931] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.934] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.938] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.944] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.945] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.948] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.951] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.952] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.955] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.966] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.969] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.973] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.975] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.984] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.987] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0314.997] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.000] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.005] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.011] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.016] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.018] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.022] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.025] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.028] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.032] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.040] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.041] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.045] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.048] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.052] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.053] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.057] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.061] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.064] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.066] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.068] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.071] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.072] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.075] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.076] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.079] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.081] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.082] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.085] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.095] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.098] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.100] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.103] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.106] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.107] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0315.107] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0315.108] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0315.108] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.113] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.116] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.120] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.124] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.126] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.129] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.131] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.133] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.135] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.138] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.142] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.143] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.144] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.146] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.147] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.149] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.153] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.156] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.160] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.163] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.164] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.169] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.172] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.175] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.178] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.183] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.187] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.190] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.192] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.194] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.197] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.198] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.200] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.202] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.205] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.209] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.210] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.211] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.224] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.228] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.230] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.232] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.236] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.239] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.241] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.248] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.251] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.253] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.255] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.256] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.259] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.261] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.264] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.268] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.270] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.272] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.274] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.282] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.287] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.289] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.291] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.294] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.295] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.297] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.299] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.305] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.308] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.311] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.314] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.316] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.317] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.318] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.320] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.321] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.323] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.324] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.326] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.328] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.329] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.331] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.332] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.333] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.337] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.340] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.341] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.343] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.345] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.350] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.354] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.357] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.358] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.361] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.363] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.365] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.367] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.371] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.374] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.375] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.376] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.379] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.381] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.385] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.390] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.394] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.396] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.399] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.401] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.402] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.404] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.405] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.406] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.409] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.410] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.412] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.415] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.416] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.418] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.421] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.448] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.452] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.453] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.454] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.456] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.458] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.463] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.467] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.468] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.471] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.473] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.476] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.479] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.483] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.493] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.494] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.497] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.500] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.508] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.510] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.513] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.520] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.522] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.523] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.524] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.526] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.528] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.529] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.531] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.536] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.538] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.539] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.540] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.543] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.547] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.549] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.552] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.555] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.559] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.563] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.567] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.571] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.575] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.577] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.579] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.583] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.586] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.589] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.593] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.594] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.598] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.601] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.603] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.604] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.607] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.609] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.611] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.616] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.622] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.629] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.633] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.639] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.641] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.643] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.645] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.651] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.656] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.658] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.659] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.665] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.669] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.673] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.675] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.685] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.688] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.690] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.692] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.694] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.696] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.699] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.703] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.705] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.708] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.711] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.715] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.717] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.719] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.721] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.724] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.727] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.729] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.733] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.735] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.737] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.738] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.741] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.742] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.746] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.748] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.749] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.751] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.753] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.759] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.763] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.767] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.769] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.772] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.774] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.776] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.779] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.781] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.783] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.784] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.794] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.798] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.805] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.807] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.809] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.810] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.812] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.814] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.815] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.820] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.822] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.825] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.826] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.828] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.829] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.831] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.836] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.838] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.839] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.841] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.846] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.850] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.851] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.862] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.866] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.869] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.871] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.874] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.877] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.881] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.883] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.888] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.892] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.894] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.895] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.897] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.898] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.901] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.905] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.906] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.907] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.909] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.911] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.914] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.917] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.925] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.927] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.932] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.934] timeEndPeriod (uPeriod=0x1) returned 0x0
	[0315.934] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xea60) returned 0x0
	[0315.934] timeBeginPeriod (uPeriod=0x1) returned 0x0
	[0315.934] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.936] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.941] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.942] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.944] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.949] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.950] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.952] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.955] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.957] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.958] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.964] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.965] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.966] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.969] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.970] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.972] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.976] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.979] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.981] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.983] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.984] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.986] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.987] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.991] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.992] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0315.999] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.001] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.003] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.005] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.006] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.009] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.013] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.015] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.018] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.021] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.024] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.027] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.028] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.031] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.035] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.040] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.042] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.044] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.046] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.047] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.048] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.049] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.051] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.053] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.054] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.058] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.060] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.063] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.068] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.070] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.071] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.073] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.074] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.076] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.078] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.079] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.080] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.084] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.085] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.089] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.091] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.103] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.104] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.106] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.108] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.111] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.112] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.114] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.115] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.116] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.118] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.120] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.122] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.124] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.125] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.127] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.128] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.129] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.130] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.133] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.136] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.138] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.141] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.143] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.144] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.148] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.150] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.152] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.154] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.163] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.164] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.166] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.168] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.169] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.172] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.173] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.175] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.178] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.180] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.183] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.184] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.186] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.188] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.191] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.193] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.196] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.198] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.202] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.204] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.206] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.208] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.209] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.211] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.213] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.224] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.296] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.298] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.301] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.443] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.571] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.584] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.630] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.632] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.632] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.634] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.635] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.636] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.638] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.639] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.642] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.643] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.644] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.646] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.918] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.920] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.921] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.923] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.924] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.927] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.928] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.930] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.931] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.933] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.934] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.936] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.937] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.939] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.941] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.943] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.945] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.946] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.947] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.951] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.953] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.954] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.955] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.957] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.958] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.960] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.961] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.963] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.964] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.966] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) returned 0x102
	[0316.968] NtWaitForSingleObject (Object=0xffffffff, Alertable=0, Time=0x3250fedc) 

Thread:
	id = 8
	os_tid = 0x7e8

	[0108.929] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x3264ff58, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x3264ff58*=0x10c) returned 1
	[0108.929] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x100000, lpStartAddress=0x44bd00, lpParameter=0x123fa000, dwCreationFlags=0x10000, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x110
	[0108.930] CloseHandle (hObject=0x110) returned 1
	[0108.930] SetEvent (hEvent=0x104) returned 1
	[0108.938] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x124
	[0108.938] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0109.556] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0110.051] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0119.957] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0120.060] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0120.175] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0120.384] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0121.952] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0122.031] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0122.050] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0122.122] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0123.632] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0123.671] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0123.682] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0123.759] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0124.980] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0125.011] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0125.022] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0125.106] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0126.757] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0126.794] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0126.915] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0127.054] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0128.415] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0128.462] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0128.478] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0128.624] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0130.095] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0130.251] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0130.262] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0130.348] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0131.620] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0131.714] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0131.727] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0131.786] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0133.298] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0133.418] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0133.497] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0133.588] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0138.262] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0138.365] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0138.386] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0138.543] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0140.217] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0140.412] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0140.485] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0140.562] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0141.869] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0141.911] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0142.017] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0143.397] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0143.429] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0143.498] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0144.692] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0144.737] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0144.787] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0144.851] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0146.046] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0146.095] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0146.108] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0146.173] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0147.511] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0147.552] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0147.694] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0149.005] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0149.152] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0149.217] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0149.296] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0150.687] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0150.826] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0150.848] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0150.917] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0152.478] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0152.533] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0152.574] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0152.638] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0155.587] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0155.642] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0155.708] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0155.795] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0156.988] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0157.041] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0157.067] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0157.155] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0158.490] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0158.583] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0158.604] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0158.668] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0163.180] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0163.335] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0163.419] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0163.506] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0165.666] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0165.750] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0165.814] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0165.884] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0172.816] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0172.904] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0172.926] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0173.019] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0174.939] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0174.975] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0174.993] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0175.057] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0176.553] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0176.597] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0176.609] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0176.668] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0178.029] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0178.067] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0178.079] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0178.152] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0179.258] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0179.288] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0179.302] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0179.378] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0180.529] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0180.678] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0180.718] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0180.786] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0181.990] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0182.054] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0182.070] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0182.208] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0183.417] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0183.515] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0183.526] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0183.664] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0184.764] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0184.804] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0184.864] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0184.969] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0186.092] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0186.145] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0186.157] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0186.233] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0187.764] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0187.885] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0187.901] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0187.965] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0189.271] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0189.311] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0189.326] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0189.440] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0190.508] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0190.609] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0190.625] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0190.683] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0191.767] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0191.795] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0191.859] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0193.397] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0193.405] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0193.914] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0194.195] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0194.442] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0194.559] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0194.633] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0194.647] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0194.823] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0195.024] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0195.150] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0195.222] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0195.553] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0195.579] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0195.690] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0195.811] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0196.077] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0196.263] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0196.481] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0196.585] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0196.724] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0196.842] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0197.243] SetEvent (hEvent=0x14c) returned 1
	[0197.243] SetEvent (hEvent=0x104) returned 1
	[0197.243] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0197.253] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0197.303] SetEvent (hEvent=0x14c) returned 1
	[0197.303] SetEvent (hEvent=0x104) returned 1
	[0197.303] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0197.387] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0197.395] SetEvent (hEvent=0x12c) returned 1
	[0197.396] SetEvent (hEvent=0x14c) returned 1
	[0197.396] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0197.402] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0197.402] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0197.406] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0197.406] SetEvent (hEvent=0x12c) returned 1
	[0197.406] SetEvent (hEvent=0x14c) returned 1
	[0197.406] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0197.417] SetEvent (hEvent=0x168) returned 1
	[0197.417] SetEvent (hEvent=0x14c) returned 1
	[0197.417] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x3000, flProtect=0x4) returned 0x33120000
	[0197.418] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x100000, lpStartAddress=0x44bd00, lpParameter=0x123fa240, dwCreationFlags=0x10000, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138
	[0197.419] CloseHandle (hObject=0x138) returned 1
	[0197.419] SetEvent (hEvent=0x104) returned 1
	[0197.419] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0197.426] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0202.472] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0202.480] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0202.563] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0202.653] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0202.779] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0203.318] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0203.400] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0203.440] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0203.512] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0203.636] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0203.814] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0203.846] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0203.872] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0203.896] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0203.923] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0203.998] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0204.009] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0204.045] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0204.077] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0204.123] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0204.187] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0204.326] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0204.473] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0204.577] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0204.590] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0204.616] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0204.652] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0204.671] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0204.718] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0204.770] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0205.572] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0205.612] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0205.655] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0205.737] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0205.860] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0206.033] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0206.089] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0206.193] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0206.230] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0206.281] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0206.319] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0206.386] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0206.445] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0206.601] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0206.643] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0206.866] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0207.108] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0207.181] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0207.208] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0207.237] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0207.300] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0207.340] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0207.365] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0207.439] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0207.502] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0207.577] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0207.628] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0207.780] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0208.153] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0208.201] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0208.276] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0208.335] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0208.415] SetEvent (hEvent=0x104) returned 1
	[0208.415] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0208.415] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0211.341] SetEvent (hEvent=0x104) returned 1
	[0211.341] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0211.347] SetEvent (hEvent=0x174) returned 1
	[0211.348] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0214.815] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0214.821] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0214.881] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0214.915] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0214.944] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0214.995] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0215.076] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0215.094] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0215.281] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0215.436] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0215.534] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0215.584] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0215.657] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0215.812] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0216.014] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0216.034] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0216.045] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0216.109] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0216.175] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0216.347] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0216.589] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0216.601] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0216.615] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0216.675] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0216.738] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0216.773] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0216.830] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0216.903] SetEvent (hEvent=0x104) returned 1
	[0216.903] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0216.903] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0219.563] SetEvent (hEvent=0x104) returned 1
	[0219.563] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0219.565] SetEvent (hEvent=0x174) returned 1
	[0219.565] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0220.955] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0220.959] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0220.975] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0221.136] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0221.368] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0221.497] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0221.520] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0221.581] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0221.616] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0221.708] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0221.789] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0221.812] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0221.827] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0221.869] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0221.939] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0222.001] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0222.028] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0222.303] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0223.309] SetEvent (hEvent=0x104) returned 1
	[0223.309] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0223.310] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0226.020] SetEvent (hEvent=0x104) returned 1
	[0226.020] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0226.024] SetEvent (hEvent=0x174) returned 1
	[0226.025] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0226.870] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0226.881] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0227.047] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0228.116] SetEvent (hEvent=0x104) returned 1
	[0228.116] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0228.116] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0229.051] SetEvent (hEvent=0x104) returned 1
	[0229.051] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0229.052] SetEvent (hEvent=0x174) returned 1
	[0229.052] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0231.314] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0231.316] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0231.896] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0231.948] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0232.096] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0232.224] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0232.412] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0232.905] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0233.276] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0233.458] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0233.741] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0233.758] SetEvent (hEvent=0x104) returned 1
	[0233.758] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0233.758] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0235.500] SetEvent (hEvent=0x104) returned 1
	[0235.500] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0235.502] SetEvent (hEvent=0x174) returned 1
	[0235.502] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0236.938] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0236.956] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0237.316] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0237.996] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0238.084] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0238.272] SetEvent (hEvent=0x104) returned 1
	[0238.272] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0238.278] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0239.217] SetEvent (hEvent=0x104) returned 1
	[0239.217] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0239.244] SetEvent (hEvent=0x174) returned 1
	[0239.244] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0239.375] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0239.422] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0239.425] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0239.558] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0239.573] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0239.752] SetEvent (hEvent=0x174) returned 1
	[0239.753] SetEvent (hEvent=0x14c) returned 1
	[0239.753] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0239.771] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0239.771] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0239.773] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0239.773] SetEvent (hEvent=0x174) returned 1
	[0239.773] SetEvent (hEvent=0x14c) returned 1
	[0239.773] SetEvent (hEvent=0x12c) returned 1
	[0239.773] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0239.773] SetEvent (hEvent=0x168) returned 1
	[0239.773] SetEvent (hEvent=0x12c) returned 1
	[0239.773] SetEvent (hEvent=0x104) returned 1
	[0239.773] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0239.775] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0239.830] SetEvent (hEvent=0x104) returned 1
	[0239.830] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0239.830] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0239.837] SetEvent (hEvent=0x104) returned 1
	[0239.837] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0239.838] SetEvent (hEvent=0x12c) returned 1
	[0239.838] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0240.034] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0240.034] SetEvent (hEvent=0x12c) returned 1
	[0240.035] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0240.035] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0240.360] SetEvent (hEvent=0x174) returned 1
	[0240.360] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0240.361] SetEvent (hEvent=0x174) returned 1
	[0240.361] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0240.464] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0240.490] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0240.649] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0240.670] SetEvent (hEvent=0x174) returned 1
	[0240.671] SetEvent (hEvent=0x14c) returned 1
	[0240.671] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0240.685] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0240.685] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0240.686] SetEvent (hEvent=0x174) returned 1
	[0240.686] SetEvent (hEvent=0x14c) returned 1
	[0240.686] SetEvent (hEvent=0x12c) returned 1
	[0240.686] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0240.686] SetEvent (hEvent=0x12c) returned 1
	[0240.686] SetEvent (hEvent=0x104) returned 1
	[0240.686] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0240.688] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0240.699] SetEvent (hEvent=0x104) returned 1
	[0240.699] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0240.699] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0240.742] SetEvent (hEvent=0x104) returned 1
	[0240.742] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0240.744] SetEvent (hEvent=0x12c) returned 1
	[0240.744] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0241.414] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0241.454] SetEvent (hEvent=0x12c) returned 1
	[0241.454] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0242.802] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0243.354] SetEvent (hEvent=0x174) returned 1
	[0243.354] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0243.395] SetEvent (hEvent=0x174) returned 1
	[0243.395] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0243.507] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0244.027] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0244.239] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0244.245] SetEvent (hEvent=0x174) returned 1
	[0244.245] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0244.319] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0245.021] SetEvent (hEvent=0x12c) returned 1
	[0245.021] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0245.032] SetEvent (hEvent=0x12c) returned 1
	[0245.032] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0245.102] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0245.293] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0245.368] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0245.948] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0245.971] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0246.008] SetEvent (hEvent=0x12c) returned 1
	[0246.009] SetEvent (hEvent=0x14c) returned 1
	[0246.009] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0246.028] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0246.029] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0246.039] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0246.039] SetEvent (hEvent=0x12c) returned 1
	[0246.039] SetEvent (hEvent=0x14c) returned 1
	[0246.039] SetEvent (hEvent=0x174) returned 1
	[0246.039] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0246.075] SetEvent (hEvent=0x168) returned 1
	[0246.075] SetEvent (hEvent=0x174) returned 1
	[0246.075] SetEvent (hEvent=0x104) returned 1
	[0246.075] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0246.132] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0246.345] SetEvent (hEvent=0x104) returned 1
	[0246.345] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0246.410] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0246.605] SetEvent (hEvent=0x104) returned 1
	[0246.605] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0246.614] SetEvent (hEvent=0x174) returned 1
	[0246.614] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0247.002] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0247.065] SetEvent (hEvent=0x174) returned 1
	[0247.066] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0247.126] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0248.096] SetEvent (hEvent=0x12c) returned 1
	[0248.096] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0248.157] SetEvent (hEvent=0x12c) returned 1
	[0248.157] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0248.268] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0248.423] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0248.555] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0248.794] SetEvent (hEvent=0x104) returned 1
	[0248.794] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0248.834] SetEvent (hEvent=0x12c) returned 1
	[0248.834] SetEvent (hEvent=0x14c) returned 1
	[0248.834] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0248.880] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0248.880] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0248.902] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0248.902] SetEvent (hEvent=0x12c) returned 1
	[0248.902] SetEvent (hEvent=0x14c) returned 1
	[0248.902] SetEvent (hEvent=0x174) returned 1
	[0248.902] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0249.032] SetEvent (hEvent=0x168) returned 1
	[0249.032] SetEvent (hEvent=0x174) returned 1
	[0249.032] SetEvent (hEvent=0x104) returned 1
	[0249.032] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0249.061] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0249.122] SetEvent (hEvent=0x104) returned 1
	[0249.122] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0249.160] SetEvent (hEvent=0x104) returned 1
	[0249.160] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0249.207] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0249.534] SetEvent (hEvent=0x104) returned 1
	[0249.534] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0249.561] SetEvent (hEvent=0x174) returned 1
	[0249.561] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0249.758] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0249.794] SetEvent (hEvent=0x174) returned 1
	[0249.794] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0249.806] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0250.599] SetEvent (hEvent=0x12c) returned 1
	[0250.599] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0250.736] SetEvent (hEvent=0x12c) returned 1
	[0250.736] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0250.798] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0251.053] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0251.192] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0251.218] SetEvent (hEvent=0x12c) returned 1
	[0251.219] SetEvent (hEvent=0x14c) returned 1
	[0251.219] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0251.273] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0251.273] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0251.280] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0251.280] SetEvent (hEvent=0x12c) returned 1
	[0251.280] SetEvent (hEvent=0x14c) returned 1
	[0251.280] SetEvent (hEvent=0x174) returned 1
	[0251.280] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0251.327] SetEvent (hEvent=0x168) returned 1
	[0251.327] SetEvent (hEvent=0x174) returned 1
	[0251.327] SetEvent (hEvent=0x104) returned 1
	[0251.327] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0251.367] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0251.454] SetEvent (hEvent=0x104) returned 1
	[0251.454] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0251.553] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0251.716] SetEvent (hEvent=0x104) returned 1
	[0251.716] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0251.786] SetEvent (hEvent=0x174) returned 1
	[0251.787] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0252.156] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0252.199] SetEvent (hEvent=0x174) returned 1
	[0252.199] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0252.244] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0252.806] SetEvent (hEvent=0x12c) returned 1
	[0252.806] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0252.818] SetEvent (hEvent=0x12c) returned 1
	[0252.818] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0252.868] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0253.209] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0253.465] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0253.516] SetEvent (hEvent=0x12c) returned 1
	[0253.516] SetEvent (hEvent=0x14c) returned 1
	[0253.517] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0253.524] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0253.524] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0253.571] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0253.571] SetEvent (hEvent=0x12c) returned 1
	[0253.571] SetEvent (hEvent=0x14c) returned 1
	[0253.571] SetEvent (hEvent=0x174) returned 1
	[0253.571] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0253.714] SetEvent (hEvent=0x168) returned 1
	[0253.714] SetEvent (hEvent=0x174) returned 1
	[0253.714] SetEvent (hEvent=0x104) returned 1
	[0253.714] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0253.778] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0253.821] SetEvent (hEvent=0x104) returned 1
	[0253.821] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0253.855] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0253.990] SetEvent (hEvent=0x104) returned 1
	[0253.990] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0254.017] SetEvent (hEvent=0x174) returned 1
	[0254.017] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0254.160] SetEvent (hEvent=0x14c) returned 1
	[0254.160] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0254.161] SetEvent (hEvent=0x174) returned 1
	[0254.161] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0254.198] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0254.346] SetEvent (hEvent=0x104) returned 1
	[0254.346] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0254.396] SetEvent (hEvent=0x104) returned 1
	[0254.396] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0254.446] SetEvent (hEvent=0x104) returned 1
	[0254.446] SwitchToThread () returned 1
	[0254.478] SetEvent (hEvent=0x104) returned 1
	[0254.478] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0254.506] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0254.805] SetEvent (hEvent=0x14c) returned 1
	[0254.805] SetEvent (hEvent=0x174) returned 1
	[0254.805] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0254.865] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0254.994] SetEvent (hEvent=0x104) returned 1
	[0254.994] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0255.054] SetEvent (hEvent=0x104) returned 1
	[0255.054] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0255.131] SetEvent (hEvent=0x104) returned 1
	[0255.131] SwitchToThread () returned 1
	[0255.136] SetEvent (hEvent=0x104) returned 1
	[0255.136] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0255.139] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0256.221] SetEvent (hEvent=0x12c) returned 1
	[0256.221] SetEvent (hEvent=0x14c) returned 1
	[0256.221] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0256.231] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0256.257] SetEvent (hEvent=0x104) returned 1
	[0256.257] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0256.315] SetEvent (hEvent=0x104) returned 1
	[0256.315] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0256.318] SetEvent (hEvent=0x104) returned 1
	[0256.318] SwitchToThread () returned 1
	[0256.319] SetEvent (hEvent=0x104) returned 1
	[0256.319] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0256.319] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0256.515] SetEvent (hEvent=0x174) returned 1
	[0256.515] SetEvent (hEvent=0x12c) returned 1
	[0256.515] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0256.517] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0256.527] SetEvent (hEvent=0x104) returned 1
	[0256.527] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0256.553] SetEvent (hEvent=0x104) returned 1
	[0256.553] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0256.558] SetEvent (hEvent=0x104) returned 1
	[0256.558] SwitchToThread () returned 1
	[0256.558] SetEvent (hEvent=0x104) returned 1
	[0256.558] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0256.558] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0257.251] SetEvent (hEvent=0x14c) returned 1
	[0257.251] SetEvent (hEvent=0x174) returned 1
	[0257.251] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0258.018] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0258.263] SetEvent (hEvent=0x104) returned 1
	[0258.263] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0258.341] SetEvent (hEvent=0x104) returned 1
	[0258.341] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0258.370] SetEvent (hEvent=0x104) returned 1
	[0258.370] SwitchToThread () returned 1
	[0258.396] SetEvent (hEvent=0x104) returned 1
	[0258.396] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0258.491] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0258.973] SetEvent (hEvent=0x12c) returned 1
	[0258.973] SetEvent (hEvent=0x14c) returned 1
	[0258.973] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0259.255] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0259.379] SetEvent (hEvent=0x104) returned 1
	[0259.379] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0259.469] SetEvent (hEvent=0x104) returned 1
	[0259.469] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0259.507] SetEvent (hEvent=0x104) returned 1
	[0259.507] SwitchToThread () returned 1
	[0259.545] SetEvent (hEvent=0x104) returned 1
	[0259.545] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0259.555] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0259.779] SetEvent (hEvent=0x174) returned 1
	[0259.779] SetEvent (hEvent=0x12c) returned 1
	[0259.779] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0259.869] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0259.962] SetEvent (hEvent=0x104) returned 1
	[0259.962] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0260.046] SetEvent (hEvent=0x104) returned 1
	[0260.046] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0260.052] SetEvent (hEvent=0x104) returned 1
	[0260.052] SwitchToThread () returned 1
	[0260.157] SetEvent (hEvent=0x104) returned 1
	[0260.157] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0260.212] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0260.557] SetEvent (hEvent=0x14c) returned 1
	[0260.557] SetEvent (hEvent=0x174) returned 1
	[0260.557] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0260.610] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0260.815] SetEvent (hEvent=0x104) returned 1
	[0260.815] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0260.859] SetEvent (hEvent=0x104) returned 1
	[0260.859] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0260.936] SetEvent (hEvent=0x104) returned 1
	[0260.936] SwitchToThread () returned 1
	[0260.954] SetEvent (hEvent=0x104) returned 1
	[0260.954] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0260.989] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0261.832] SetEvent (hEvent=0x12c) returned 1
	[0261.832] SetEvent (hEvent=0x14c) returned 1
	[0261.832] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0261.835] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0261.851] SetEvent (hEvent=0x104) returned 1
	[0261.851] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0261.892] SetEvent (hEvent=0x104) returned 1
	[0261.892] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0261.897] SetEvent (hEvent=0x104) returned 1
	[0261.897] SwitchToThread () returned 1
	[0261.897] SetEvent (hEvent=0x104) returned 1
	[0261.897] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0261.897] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0262.047] SetEvent (hEvent=0x104) returned 1
	[0262.047] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0262.066] SetEvent (hEvent=0x12c) returned 1
	[0262.066] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0262.390] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0262.630] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0262.777] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0262.846] SetEvent (hEvent=0x12c) returned 1
	[0262.847] SetEvent (hEvent=0x174) returned 1
	[0262.847] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0262.866] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0262.866] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0262.889] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0262.889] SetEvent (hEvent=0x12c) returned 1
	[0262.889] SetEvent (hEvent=0x174) returned 1
	[0262.889] SetEvent (hEvent=0x14c) returned 1
	[0262.889] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0262.957] SetEvent (hEvent=0x168) returned 1
	[0262.957] SetEvent (hEvent=0x14c) returned 1
	[0262.958] SetEvent (hEvent=0x104) returned 1
	[0262.958] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0263.012] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0263.076] SetEvent (hEvent=0x104) returned 1
	[0263.076] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0263.158] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0263.377] SetEvent (hEvent=0x104) returned 1
	[0263.377] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0263.473] SetEvent (hEvent=0x14c) returned 1
	[0263.474] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0263.850] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0263.904] SetEvent (hEvent=0x14c) returned 1
	[0263.904] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0263.932] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0266.897] SetEvent (hEvent=0x12c) returned 1
	[0266.897] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0266.918] SetEvent (hEvent=0x12c) returned 1
	[0266.918] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0267.014] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0267.269] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0267.470] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0267.570] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0267.617] SetEvent (hEvent=0x12c) returned 1
	[0267.617] SetEvent (hEvent=0x174) returned 1
	[0267.617] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0267.739] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0267.739] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0267.746] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0267.746] SetEvent (hEvent=0x12c) returned 1
	[0267.746] SetEvent (hEvent=0x174) returned 1
	[0267.746] SetEvent (hEvent=0x14c) returned 1
	[0267.746] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0267.809] SetEvent (hEvent=0x168) returned 1
	[0267.810] SetEvent (hEvent=0x14c) returned 1
	[0267.810] SetEvent (hEvent=0x104) returned 1
	[0267.810] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0267.936] SetEvent (hEvent=0x104) returned 1
	[0267.936] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0268.042] SetEvent (hEvent=0x104) returned 1
	[0268.042] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0268.075] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0268.469] SetEvent (hEvent=0x104) returned 1
	[0268.469] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0268.594] SetEvent (hEvent=0x14c) returned 1
	[0268.594] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0269.771] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0269.778] SetEvent (hEvent=0x14c) returned 1
	[0269.778] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0269.810] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0271.318] SetEvent (hEvent=0x12c) returned 1
	[0271.318] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0271.515] SetEvent (hEvent=0x12c) returned 1
	[0271.515] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0272.093] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0272.324] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0272.687] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0272.847] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0273.045] SetEvent (hEvent=0x12c) returned 1
	[0273.046] SetEvent (hEvent=0x174) returned 1
	[0273.046] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0273.090] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0273.090] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0273.099] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0273.099] SetEvent (hEvent=0x12c) returned 1
	[0273.099] SetEvent (hEvent=0x174) returned 1
	[0273.099] SetEvent (hEvent=0x14c) returned 1
	[0273.099] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0273.176] SetEvent (hEvent=0x168) returned 1
	[0273.176] SetEvent (hEvent=0x14c) returned 1
	[0273.176] SetEvent (hEvent=0x104) returned 1
	[0273.176] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0273.283] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0273.296] SetEvent (hEvent=0x104) returned 1
	[0273.296] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0273.297] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0273.329] SetEvent (hEvent=0x104) returned 1
	[0273.329] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0273.331] SetEvent (hEvent=0x14c) returned 1
	[0273.331] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0274.117] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0274.133] SetEvent (hEvent=0x14c) returned 1
	[0274.133] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0274.157] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0275.427] SetEvent (hEvent=0x12c) returned 1
	[0275.428] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0275.447] SetEvent (hEvent=0x12c) returned 1
	[0275.447] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0275.503] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0275.529] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0275.534] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0275.536] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0275.612] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0275.617] SetEvent (hEvent=0x174) returned 1
	[0275.618] SetEvent (hEvent=0x12c) returned 1
	[0275.618] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0275.621] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0275.621] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0275.622] SetEvent (hEvent=0x174) returned 1
	[0275.622] SetEvent (hEvent=0x12c) returned 1
	[0275.622] SetEvent (hEvent=0x14c) returned 1
	[0275.622] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0275.622] SetEvent (hEvent=0x14c) returned 1
	[0275.622] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0275.656] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0275.695] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0275.756] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0275.778] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0275.809] SetEvent (hEvent=0x14c) returned 1
	[0275.809] SetEvent (hEvent=0x12c) returned 1
	[0275.809] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0275.832] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0275.833] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0275.834] SetEvent (hEvent=0x14c) returned 1
	[0275.834] SetEvent (hEvent=0x12c) returned 1
	[0275.834] SetEvent (hEvent=0x174) returned 1
	[0275.834] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0275.834] SetEvent (hEvent=0x168) returned 1
	[0275.834] SetEvent (hEvent=0x174) returned 1
	[0275.834] SetEvent (hEvent=0x104) returned 1
	[0275.834] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0275.839] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0275.848] SetEvent (hEvent=0x104) returned 1
	[0275.848] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0275.849] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0275.889] SetEvent (hEvent=0x104) returned 1
	[0275.889] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0275.891] SetEvent (hEvent=0x174) returned 1
	[0275.891] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0275.987] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0275.987] SetEvent (hEvent=0x174) returned 1
	[0275.988] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0275.988] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0276.178] SetEvent (hEvent=0x14c) returned 1
	[0276.178] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0276.180] SetEvent (hEvent=0x14c) returned 1
	[0276.180] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0276.627] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0276.907] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0277.078] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0277.103] SetEvent (hEvent=0x14c) returned 1
	[0277.104] SetEvent (hEvent=0x12c) returned 1
	[0277.104] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0277.151] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0277.152] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0277.161] SetEvent (hEvent=0x14c) returned 1
	[0277.161] SetEvent (hEvent=0x12c) returned 1
	[0277.161] SetEvent (hEvent=0x174) returned 1
	[0277.161] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0277.202] SetEvent (hEvent=0x168) returned 1
	[0277.202] SetEvent (hEvent=0x174) returned 1
	[0277.202] SetEvent (hEvent=0x104) returned 1
	[0277.202] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0277.264] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0277.285] SetEvent (hEvent=0x104) returned 1
	[0277.285] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0277.380] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0277.540] SetEvent (hEvent=0x104) returned 1
	[0277.540] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0277.584] SetEvent (hEvent=0x174) returned 1
	[0277.584] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0277.751] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0277.791] SetEvent (hEvent=0x174) returned 1
	[0277.791] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0277.798] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0278.369] SetEvent (hEvent=0x14c) returned 1
	[0278.369] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0278.448] SetEvent (hEvent=0x14c) returned 1
	[0278.448] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0278.465] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0278.510] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0278.572] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0278.620] SetEvent (hEvent=0x14c) returned 1
	[0278.620] SetEvent (hEvent=0x12c) returned 1
	[0278.620] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0278.642] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0278.642] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0278.646] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0278.647] SetEvent (hEvent=0x14c) returned 1
	[0278.647] SetEvent (hEvent=0x12c) returned 1
	[0278.647] SetEvent (hEvent=0x174) returned 1
	[0278.647] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0278.647] SetEvent (hEvent=0x168) returned 1
	[0278.647] SetEvent (hEvent=0x174) returned 1
	[0278.647] SetEvent (hEvent=0x104) returned 1
	[0278.647] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0278.648] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0278.657] SetEvent (hEvent=0x104) returned 1
	[0278.657] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0278.658] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0278.693] SetEvent (hEvent=0x104) returned 1
	[0278.693] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0278.695] SetEvent (hEvent=0x174) returned 1
	[0278.695] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0278.886] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0278.889] SetEvent (hEvent=0x174) returned 1
	[0278.889] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0278.899] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0279.080] SetEvent (hEvent=0x14c) returned 1
	[0279.080] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0279.082] SetEvent (hEvent=0x14c) returned 1
	[0279.082] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0279.101] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0279.144] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0279.206] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0279.249] SetEvent (hEvent=0x14c) returned 1
	[0279.249] SetEvent (hEvent=0x12c) returned 1
	[0279.249] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0279.267] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0279.268] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0279.271] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0279.271] SetEvent (hEvent=0x14c) returned 1
	[0279.271] SetEvent (hEvent=0x12c) returned 1
	[0279.271] SetEvent (hEvent=0x174) returned 1
	[0279.271] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0279.271] SetEvent (hEvent=0x168) returned 1
	[0279.271] SetEvent (hEvent=0x174) returned 1
	[0279.271] SetEvent (hEvent=0x104) returned 1
	[0279.271] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0279.273] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0279.288] SetEvent (hEvent=0x104) returned 1
	[0279.289] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0279.289] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0279.378] SetEvent (hEvent=0x104) returned 1
	[0279.378] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0279.380] SetEvent (hEvent=0x12c) returned 1
	[0279.380] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0279.461] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0279.475] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0279.511] SetEvent (hEvent=0x104) returned 1
	[0279.511] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0279.512] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0279.516] SetEvent (hEvent=0x104) returned 1
	[0279.516] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0279.517] SetEvent (hEvent=0x174) returned 1
	[0279.517] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0279.621] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0279.649] SetEvent (hEvent=0x174) returned 1
	[0279.649] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0279.667] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0279.789] SetEvent (hEvent=0x14c) returned 1
	[0279.789] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0279.790] SetEvent (hEvent=0x14c) returned 1
	[0279.790] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0279.827] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0279.859] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0279.910] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0279.966] SetEvent (hEvent=0x14c) returned 1
	[0279.967] SetEvent (hEvent=0x12c) returned 1
	[0279.967] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0279.981] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0279.981] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0279.981] SetEvent (hEvent=0x14c) returned 1
	[0279.982] SetEvent (hEvent=0x12c) returned 1
	[0279.982] SetEvent (hEvent=0x174) returned 1
	[0279.982] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0279.982] SetEvent (hEvent=0x168) returned 1
	[0279.982] SetEvent (hEvent=0x174) returned 1
	[0279.982] SetEvent (hEvent=0x104) returned 1
	[0279.982] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0279.983] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0279.994] SetEvent (hEvent=0x104) returned 1
	[0279.994] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0279.995] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0280.020] SetEvent (hEvent=0x104) returned 1
	[0280.020] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0280.022] SetEvent (hEvent=0x174) returned 1
	[0280.022] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0280.095] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0280.108] SetEvent (hEvent=0x174) returned 1
	[0280.108] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0280.109] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0280.239] SetEvent (hEvent=0x14c) returned 1
	[0280.239] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0280.262] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0280.277] SetEvent (hEvent=0x104) returned 1
	[0280.277] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0280.278] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0280.311] SetEvent (hEvent=0x104) returned 1
	[0280.311] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0280.312] SetEvent (hEvent=0x14c) returned 1
	[0280.312] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0280.414] SetEvent (hEvent=0x12c) returned 1
	[0280.414] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0280.432] SetEvent (hEvent=0x14c) returned 1
	[0280.432] SetEvent (hEvent=0x12c) returned 1
	[0280.432] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0280.433] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0280.448] SetEvent (hEvent=0x104) returned 1
	[0280.448] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0280.472] SetEvent (hEvent=0x104) returned 1
	[0280.472] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0280.475] SetEvent (hEvent=0x104) returned 1
	[0280.475] SwitchToThread () returned 1
	[0280.475] SetEvent (hEvent=0x104) returned 1
	[0280.475] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0280.475] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0280.622] SetEvent (hEvent=0x174) returned 1
	[0280.622] SetEvent (hEvent=0x14c) returned 1
	[0280.622] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0280.624] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0280.636] SetEvent (hEvent=0x104) returned 1
	[0280.636] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0280.666] SetEvent (hEvent=0x104) returned 1
	[0280.666] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0280.670] SetEvent (hEvent=0x104) returned 1
	[0280.670] SwitchToThread () returned 1
	[0280.670] SetEvent (hEvent=0x104) returned 1
	[0280.670] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0280.670] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0280.768] SetEvent (hEvent=0x12c) returned 1
	[0280.768] SetEvent (hEvent=0x174) returned 1
	[0280.768] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0280.769] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0280.785] SetEvent (hEvent=0x104) returned 1
	[0280.785] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0280.807] SetEvent (hEvent=0x104) returned 1
	[0280.807] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0280.810] SetEvent (hEvent=0x104) returned 1
	[0280.810] SwitchToThread () returned 1
	[0280.811] SetEvent (hEvent=0x104) returned 1
	[0280.811] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0280.811] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0280.921] SetEvent (hEvent=0x14c) returned 1
	[0280.921] SetEvent (hEvent=0x12c) returned 1
	[0280.921] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0280.929] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0280.949] SetEvent (hEvent=0x104) returned 1
	[0280.949] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0280.986] SetEvent (hEvent=0x104) returned 1
	[0280.986] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0281.002] SetEvent (hEvent=0x104) returned 1
	[0281.002] SwitchToThread () returned 1
	[0281.002] SetEvent (hEvent=0x104) returned 1
	[0281.002] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0281.003] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0281.106] SetEvent (hEvent=0x174) returned 1
	[0281.106] SetEvent (hEvent=0x14c) returned 1
	[0281.107] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0281.107] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0281.388] SetEvent (hEvent=0x104) returned 1
	[0281.388] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0281.424] SetEvent (hEvent=0x104) returned 1
	[0281.424] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0281.430] SetEvent (hEvent=0x104) returned 1
	[0281.430] SwitchToThread () returned 1
	[0281.430] SetEvent (hEvent=0x104) returned 1
	[0281.430] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0281.431] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0281.550] SetEvent (hEvent=0x174) returned 1
	[0281.550] SetEvent (hEvent=0x12c) returned 1
	[0281.550] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0281.559] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0281.576] SetEvent (hEvent=0x104) returned 1
	[0281.576] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0281.611] SetEvent (hEvent=0x104) returned 1
	[0281.611] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0281.616] SetEvent (hEvent=0x104) returned 1
	[0281.616] SwitchToThread () returned 1
	[0281.616] SetEvent (hEvent=0x104) returned 1
	[0281.616] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0281.617] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0281.793] SetEvent (hEvent=0x14c) returned 1
	[0281.793] SetEvent (hEvent=0x174) returned 1
	[0281.793] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0281.800] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0281.844] SetEvent (hEvent=0x104) returned 1
	[0281.844] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0281.852] SwitchToThread () returned 1
	[0281.879] SetEvent (hEvent=0x104) returned 1
	[0281.879] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0281.883] SetEvent (hEvent=0x104) returned 1
	[0281.883] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0281.885] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0282.024] SetEvent (hEvent=0x12c) returned 1
	[0282.024] SetEvent (hEvent=0x14c) returned 1
	[0282.024] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0282.027] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0282.041] SetEvent (hEvent=0x104) returned 1
	[0282.041] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0282.066] SetEvent (hEvent=0x104) returned 1
	[0282.066] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0282.098] SetEvent (hEvent=0x104) returned 1
	[0282.098] SwitchToThread () returned 1
	[0282.103] SetEvent (hEvent=0x104) returned 1
	[0282.103] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0282.104] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0282.247] SetEvent (hEvent=0x174) returned 1
	[0282.247] SetEvent (hEvent=0x12c) returned 1
	[0282.247] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0282.250] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0282.266] SetEvent (hEvent=0x104) returned 1
	[0282.266] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0282.300] SetEvent (hEvent=0x104) returned 1
	[0282.300] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0282.303] SetEvent (hEvent=0x104) returned 1
	[0282.303] SwitchToThread () returned 1
	[0282.304] SetEvent (hEvent=0x104) returned 1
	[0282.304] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0282.304] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0282.437] SetEvent (hEvent=0x14c) returned 1
	[0282.437] SetEvent (hEvent=0x174) returned 1
	[0282.437] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0282.440] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0282.453] SetEvent (hEvent=0x104) returned 1
	[0282.453] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0282.476] SetEvent (hEvent=0x104) returned 1
	[0282.476] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0282.479] SetEvent (hEvent=0x104) returned 1
	[0282.479] SwitchToThread () returned 1
	[0282.480] SetEvent (hEvent=0x104) returned 1
	[0282.480] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0282.480] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0282.576] SetEvent (hEvent=0x12c) returned 1
	[0282.576] SetEvent (hEvent=0x14c) returned 1
	[0282.576] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0282.579] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0282.592] SetEvent (hEvent=0x104) returned 1
	[0282.592] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0282.615] SetEvent (hEvent=0x104) returned 1
	[0282.615] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0282.617] SetEvent (hEvent=0x104) returned 1
	[0282.617] SwitchToThread () returned 1
	[0282.617] SetEvent (hEvent=0x104) returned 1
	[0282.617] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0282.618] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0282.711] SetEvent (hEvent=0x174) returned 1
	[0282.711] SetEvent (hEvent=0x12c) returned 1
	[0282.711] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0282.714] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0282.727] SetEvent (hEvent=0x104) returned 1
	[0282.727] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0282.750] SetEvent (hEvent=0x104) returned 1
	[0282.750] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0282.754] SetEvent (hEvent=0x104) returned 1
	[0282.754] SwitchToThread () returned 1
	[0282.754] SetEvent (hEvent=0x104) returned 1
	[0282.754] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0282.755] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0282.852] SetEvent (hEvent=0x14c) returned 1
	[0282.852] SetEvent (hEvent=0x174) returned 1
	[0282.852] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0282.856] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0282.873] SetEvent (hEvent=0x104) returned 1
	[0282.873] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0282.904] SetEvent (hEvent=0x104) returned 1
	[0282.904] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0282.906] SetEvent (hEvent=0x104) returned 1
	[0282.906] SwitchToThread () returned 1
	[0282.907] SetEvent (hEvent=0x104) returned 1
	[0282.908] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0282.908] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0282.993] SetEvent (hEvent=0x104) returned 1
	[0282.993] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0283.008] SetEvent (hEvent=0x14c) returned 1
	[0283.008] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0283.044] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0283.048] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0283.069] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0283.128] SetEvent (hEvent=0x14c) returned 1
	[0283.128] SetEvent (hEvent=0x12c) returned 1
	[0283.128] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0283.145] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0283.145] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0283.145] SetEvent (hEvent=0x14c) returned 1
	[0283.145] SetEvent (hEvent=0x12c) returned 1
	[0283.145] SetEvent (hEvent=0x174) returned 1
	[0283.145] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0283.146] SetEvent (hEvent=0x174) returned 1
	[0283.146] SetEvent (hEvent=0x104) returned 1
	[0283.146] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0283.147] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0283.158] SetEvent (hEvent=0x104) returned 1
	[0283.158] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0283.159] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0283.185] SetEvent (hEvent=0x104) returned 1
	[0283.185] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0283.186] SetEvent (hEvent=0x174) returned 1
	[0283.186] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0283.304] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0283.339] SetEvent (hEvent=0x174) returned 1
	[0283.339] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0283.340] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0283.462] SetEvent (hEvent=0x14c) returned 1
	[0283.462] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0283.462] SetEvent (hEvent=0x14c) returned 1
	[0283.462] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0283.482] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0283.511] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0283.562] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0283.582] SetEvent (hEvent=0x14c) returned 1
	[0283.582] SetEvent (hEvent=0x12c) returned 1
	[0283.582] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0283.601] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0283.601] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0283.602] SetEvent (hEvent=0x14c) returned 1
	[0283.602] SetEvent (hEvent=0x12c) returned 1
	[0283.602] SetEvent (hEvent=0x174) returned 1
	[0283.602] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0283.602] SetEvent (hEvent=0x174) returned 1
	[0283.602] SetEvent (hEvent=0x104) returned 1
	[0283.602] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0283.641] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0283.651] SetEvent (hEvent=0x104) returned 1
	[0283.651] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0283.652] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0283.677] SetEvent (hEvent=0x104) returned 1
	[0283.677] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0283.678] SetEvent (hEvent=0x174) returned 1
	[0283.678] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0283.775] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0283.777] SetEvent (hEvent=0x174) returned 1
	[0283.777] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0283.777] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0283.961] SetEvent (hEvent=0x14c) returned 1
	[0283.961] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0283.962] SetEvent (hEvent=0x14c) returned 1
	[0283.962] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0283.995] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0284.034] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0284.060] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0284.129] SetEvent (hEvent=0x14c) returned 1
	[0284.130] SetEvent (hEvent=0x12c) returned 1
	[0284.130] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0284.149] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0284.149] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0284.150] SetEvent (hEvent=0x14c) returned 1
	[0284.150] SetEvent (hEvent=0x12c) returned 1
	[0284.150] SetEvent (hEvent=0x174) returned 1
	[0284.150] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0284.150] SetEvent (hEvent=0x168) returned 1
	[0284.150] SetEvent (hEvent=0x174) returned 1
	[0284.150] SetEvent (hEvent=0x104) returned 1
	[0284.151] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0284.152] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0284.167] SetEvent (hEvent=0x104) returned 1
	[0284.167] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0284.167] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0284.210] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0284.376] SetEvent (hEvent=0x104) returned 1
	[0284.376] SetEvent (hEvent=0x14c) returned 1
	[0284.376] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0284.386] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0284.398] SetEvent (hEvent=0x12c) returned 1
	[0284.398] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0284.409] SwitchToThread () returned 1
	[0284.434] SetEvent (hEvent=0x12c) returned 1
	[0284.435] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0284.439] SetEvent (hEvent=0x12c) returned 1
	[0284.439] SetEvent (hEvent=0x174) returned 1
	[0284.439] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0284.440] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0284.495] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0284.516] SetEvent (hEvent=0x104) returned 1
	[0284.516] SetEvent (hEvent=0x174) returned 1
	[0284.516] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0284.534] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0284.535] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0284.535] SetEvent (hEvent=0x104) returned 1
	[0284.535] SetEvent (hEvent=0x174) returned 1
	[0284.535] SetEvent (hEvent=0x14c) returned 1
	[0284.535] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0284.536] SetEvent (hEvent=0x168) returned 1
	[0284.536] SetEvent (hEvent=0x14c) returned 1
	[0284.536] SetEvent (hEvent=0x12c) returned 1
	[0284.536] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0284.539] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0284.552] SetEvent (hEvent=0x12c) returned 1
	[0284.552] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0284.553] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0284.581] SetEvent (hEvent=0x12c) returned 1
	[0284.581] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0284.583] SetEvent (hEvent=0x14c) returned 1
	[0284.583] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0284.662] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0284.666] SetEvent (hEvent=0x14c) returned 1
	[0284.666] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0284.668] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0284.819] SetEvent (hEvent=0x104) returned 1
	[0284.819] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0284.820] SetEvent (hEvent=0x104) returned 1
	[0284.820] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0284.836] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0284.864] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0284.921] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0284.978] SetEvent (hEvent=0x104) returned 1
	[0284.979] SetEvent (hEvent=0x174) returned 1
	[0284.979] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0284.993] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0284.993] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0284.994] SetEvent (hEvent=0x104) returned 1
	[0284.994] SetEvent (hEvent=0x174) returned 1
	[0284.994] SetEvent (hEvent=0x14c) returned 1
	[0284.994] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0284.994] SetEvent (hEvent=0x14c) returned 1
	[0284.994] SetEvent (hEvent=0x12c) returned 1
	[0284.994] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0284.996] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0285.004] SetEvent (hEvent=0x12c) returned 1
	[0285.004] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0285.004] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0285.034] SetEvent (hEvent=0x12c) returned 1
	[0285.034] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0285.035] SetEvent (hEvent=0x14c) returned 1
	[0285.035] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0285.128] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0285.163] SetEvent (hEvent=0x14c) returned 1
	[0285.163] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0285.167] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0285.305] SetEvent (hEvent=0x104) returned 1
	[0285.305] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0285.306] SetEvent (hEvent=0x104) returned 1
	[0285.306] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0285.314] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0285.376] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0285.429] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0285.555] SetEvent (hEvent=0x104) returned 1
	[0285.555] SetEvent (hEvent=0x174) returned 1
	[0285.555] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0285.584] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0285.584] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0285.585] SetEvent (hEvent=0x104) returned 1
	[0285.585] SetEvent (hEvent=0x174) returned 1
	[0285.585] SetEvent (hEvent=0x14c) returned 1
	[0285.585] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0285.586] SetEvent (hEvent=0x168) returned 1
	[0285.586] SetEvent (hEvent=0x14c) returned 1
	[0285.586] SetEvent (hEvent=0x12c) returned 1
	[0285.586] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0285.588] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0285.603] SetEvent (hEvent=0x12c) returned 1
	[0285.603] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0285.603] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0285.644] SetEvent (hEvent=0x12c) returned 1
	[0285.644] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0285.646] SetEvent (hEvent=0x14c) returned 1
	[0285.646] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0285.747] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0285.748] SetEvent (hEvent=0x14c) returned 1
	[0285.749] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0285.749] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0285.876] SetEvent (hEvent=0x104) returned 1
	[0285.876] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0285.877] SetEvent (hEvent=0x104) returned 1
	[0285.877] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0285.886] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0285.912] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0285.960] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0285.980] SetEvent (hEvent=0x104) returned 1
	[0285.980] SetEvent (hEvent=0x174) returned 1
	[0285.980] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0285.993] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0285.993] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0285.994] SetEvent (hEvent=0x104) returned 1
	[0285.994] SetEvent (hEvent=0x174) returned 1
	[0285.994] SetEvent (hEvent=0x14c) returned 1
	[0285.994] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0285.995] SetEvent (hEvent=0x14c) returned 1
	[0285.995] SetEvent (hEvent=0x12c) returned 1
	[0285.995] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0285.996] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0286.005] SetEvent (hEvent=0x12c) returned 1
	[0286.005] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0286.008] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0286.034] SetEvent (hEvent=0x12c) returned 1
	[0286.034] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0286.037] SetEvent (hEvent=0x14c) returned 1
	[0286.037] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0286.150] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0286.152] SetEvent (hEvent=0x14c) returned 1
	[0286.152] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0286.153] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0286.421] SetEvent (hEvent=0x104) returned 1
	[0286.424] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0286.425] SetEvent (hEvent=0x104) returned 1
	[0286.425] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0286.451] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0286.524] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0286.589] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0286.614] SetEvent (hEvent=0x104) returned 1
	[0286.615] SetEvent (hEvent=0x174) returned 1
	[0286.615] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0286.637] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0286.637] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0286.638] SetEvent (hEvent=0x104) returned 1
	[0286.638] SetEvent (hEvent=0x174) returned 1
	[0286.638] SetEvent (hEvent=0x14c) returned 1
	[0286.638] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0286.639] SetEvent (hEvent=0x168) returned 1
	[0286.639] SetEvent (hEvent=0x14c) returned 1
	[0286.639] SetEvent (hEvent=0x12c) returned 1
	[0286.639] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0286.640] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0286.659] SetEvent (hEvent=0x12c) returned 1
	[0286.659] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0286.659] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0286.692] SetEvent (hEvent=0x12c) returned 1
	[0286.692] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0286.694] SetEvent (hEvent=0x14c) returned 1
	[0286.694] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0286.776] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0286.777] SetEvent (hEvent=0x14c) returned 1
	[0286.777] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0286.777] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0286.907] SetEvent (hEvent=0x104) returned 1
	[0286.907] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0286.907] SetEvent (hEvent=0x104) returned 1
	[0286.907] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0286.916] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0286.944] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0286.999] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0287.019] SetEvent (hEvent=0x104) returned 1
	[0287.019] SetEvent (hEvent=0x174) returned 1
	[0287.019] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0287.040] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0287.041] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0287.041] SetEvent (hEvent=0x104) returned 1
	[0287.041] SetEvent (hEvent=0x174) returned 1
	[0287.042] SetEvent (hEvent=0x14c) returned 1
	[0287.042] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0287.042] SetEvent (hEvent=0x168) returned 1
	[0287.042] SetEvent (hEvent=0x14c) returned 1
	[0287.042] SetEvent (hEvent=0x12c) returned 1
	[0287.042] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0287.048] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0287.059] SetEvent (hEvent=0x12c) returned 1
	[0287.059] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0287.060] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0287.085] SetEvent (hEvent=0x12c) returned 1
	[0287.085] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0287.087] SetEvent (hEvent=0x14c) returned 1
	[0287.087] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0287.168] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0287.169] SetEvent (hEvent=0x14c) returned 1
	[0287.169] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0287.169] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0287.307] SetEvent (hEvent=0x104) returned 1
	[0287.307] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0287.307] SetEvent (hEvent=0x104) returned 1
	[0287.307] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0287.353] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0287.378] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0287.430] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0287.451] SetEvent (hEvent=0x104) returned 1
	[0287.452] SetEvent (hEvent=0x174) returned 1
	[0287.452] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0287.469] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0287.469] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0287.470] SetEvent (hEvent=0x104) returned 1
	[0287.470] SetEvent (hEvent=0x174) returned 1
	[0287.470] SetEvent (hEvent=0x14c) returned 1
	[0287.470] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0287.470] SetEvent (hEvent=0x168) returned 1
	[0287.470] SetEvent (hEvent=0x14c) returned 1
	[0287.470] SetEvent (hEvent=0x12c) returned 1
	[0287.470] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0287.490] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0287.498] SetEvent (hEvent=0x12c) returned 1
	[0287.498] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0287.499] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0287.523] SetEvent (hEvent=0x12c) returned 1
	[0287.523] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0287.524] SetEvent (hEvent=0x14c) returned 1
	[0287.524] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0287.659] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0287.666] SetEvent (hEvent=0x14c) returned 1
	[0287.666] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0287.667] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0287.806] SetEvent (hEvent=0x104) returned 1
	[0287.806] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0287.806] SetEvent (hEvent=0x104) returned 1
	[0287.807] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0287.816] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0287.851] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0287.960] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0287.984] SetEvent (hEvent=0x104) returned 1
	[0287.984] SetEvent (hEvent=0x174) returned 1
	[0287.984] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0287.984] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0287.984] SetEvent (hEvent=0x104) returned 1
	[0287.984] SetEvent (hEvent=0x174) returned 1
	[0287.985] SetEvent (hEvent=0x14c) returned 1
	[0287.985] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0287.985] SetEvent (hEvent=0x14c) returned 1
	[0287.985] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0288.038] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0288.072] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0288.095] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0288.106] SetEvent (hEvent=0x14c) returned 1
	[0288.106] SetEvent (hEvent=0x174) returned 1
	[0288.106] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0288.121] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0288.121] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0288.123] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0288.123] SetEvent (hEvent=0x14c) returned 1
	[0288.123] SetEvent (hEvent=0x174) returned 1
	[0288.123] SetEvent (hEvent=0x104) returned 1
	[0288.123] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0288.124] SetEvent (hEvent=0x168) returned 1
	[0288.124] SetEvent (hEvent=0x104) returned 1
	[0288.124] SetEvent (hEvent=0x12c) returned 1
	[0288.124] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0288.126] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0288.140] SetEvent (hEvent=0x12c) returned 1
	[0288.140] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0288.141] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0288.179] SetEvent (hEvent=0x12c) returned 1
	[0288.179] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0288.181] SetEvent (hEvent=0x104) returned 1
	[0288.181] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0288.243] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0288.259] SetEvent (hEvent=0x104) returned 1
	[0288.259] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0288.260] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0288.380] SetEvent (hEvent=0x14c) returned 1
	[0288.380] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0288.400] SetEvent (hEvent=0x14c) returned 1
	[0288.401] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0288.457] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0288.487] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0288.511] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0288.523] SetEvent (hEvent=0x14c) returned 1
	[0288.523] SetEvent (hEvent=0x174) returned 1
	[0288.523] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0288.525] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0288.526] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0288.527] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0288.527] SetEvent (hEvent=0x14c) returned 1
	[0288.527] SetEvent (hEvent=0x174) returned 1
	[0288.527] SetEvent (hEvent=0x104) returned 1
	[0288.527] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0288.534] SetEvent (hEvent=0x168) returned 1
	[0288.534] SetEvent (hEvent=0x104) returned 1
	[0288.534] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0288.606] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0288.632] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0288.656] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0288.773] SetEvent (hEvent=0x104) returned 1
	[0288.773] SetEvent (hEvent=0x174) returned 1
	[0288.773] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0288.774] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0288.774] SetEvent (hEvent=0x104) returned 1
	[0288.774] SetEvent (hEvent=0x174) returned 1
	[0288.774] SetEvent (hEvent=0x14c) returned 1
	[0288.774] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0288.775] SetEvent (hEvent=0x14c) returned 1
	[0288.775] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0288.953] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0289.002] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0289.037] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0289.076] SetEvent (hEvent=0x14c) returned 1
	[0289.076] SetEvent (hEvent=0x174) returned 1
	[0289.076] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0289.112] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0289.112] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0289.116] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0289.116] SetEvent (hEvent=0x14c) returned 1
	[0289.116] SetEvent (hEvent=0x174) returned 1
	[0289.116] SetEvent (hEvent=0x104) returned 1
	[0289.116] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0289.117] SetEvent (hEvent=0x168) returned 1
	[0289.117] SetEvent (hEvent=0x104) returned 1
	[0289.117] SetEvent (hEvent=0x12c) returned 1
	[0289.117] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0289.120] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0289.135] SetEvent (hEvent=0x12c) returned 1
	[0289.135] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0289.135] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0289.176] SetEvent (hEvent=0x12c) returned 1
	[0289.176] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0289.179] SetEvent (hEvent=0x104) returned 1
	[0289.179] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0289.261] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0289.262] SetEvent (hEvent=0x104) returned 1
	[0289.262] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0289.263] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0289.340] SetEvent (hEvent=0x14c) returned 1
	[0289.340] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0289.340] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0289.383] SetEvent (hEvent=0x12c) returned 1
	[0289.384] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0289.384] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0289.447] SetEvent (hEvent=0x12c) returned 1
	[0289.447] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0289.449] SetEvent (hEvent=0x14c) returned 1
	[0289.449] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0289.499] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0289.499] SetEvent (hEvent=0x14c) returned 1
	[0289.499] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0289.499] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0289.712] SetEvent (hEvent=0x14c) returned 1
	[0289.712] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0289.712] SetEvent (hEvent=0x14c) returned 1
	[0289.712] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0289.726] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0289.755] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0289.780] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0289.808] SetEvent (hEvent=0x14c) returned 1
	[0289.808] SetEvent (hEvent=0x174) returned 1
	[0289.808] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0289.809] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0289.809] SetEvent (hEvent=0x14c) returned 1
	[0289.809] SetEvent (hEvent=0x174) returned 1
	[0289.809] SetEvent (hEvent=0x104) returned 1
	[0289.809] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0289.810] SetEvent (hEvent=0x168) returned 1
	[0289.810] SetEvent (hEvent=0x104) returned 1
	[0289.810] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0289.876] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0289.905] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0289.927] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0289.939] SetEvent (hEvent=0x104) returned 1
	[0289.939] SetEvent (hEvent=0x174) returned 1
	[0289.939] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0289.940] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0289.940] SetEvent (hEvent=0x104) returned 1
	[0289.940] SetEvent (hEvent=0x174) returned 1
	[0289.940] SetEvent (hEvent=0x14c) returned 1
	[0289.940] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0289.940] SetEvent (hEvent=0x168) returned 1
	[0289.940] SetEvent (hEvent=0x14c) returned 1
	[0289.941] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0290.155] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0290.183] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0290.208] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0290.229] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0290.277] SetEvent (hEvent=0x14c) returned 1
	[0290.278] SetEvent (hEvent=0x174) returned 1
	[0290.278] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0290.292] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0290.292] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0290.294] SetEvent (hEvent=0x14c) returned 1
	[0290.294] SetEvent (hEvent=0x174) returned 1
	[0290.294] SetEvent (hEvent=0x104) returned 1
	[0290.294] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0290.294] SetEvent (hEvent=0x168) returned 1
	[0290.294] SetEvent (hEvent=0x104) returned 1
	[0290.294] SetEvent (hEvent=0x12c) returned 1
	[0290.294] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0290.295] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0290.315] SetEvent (hEvent=0x12c) returned 1
	[0290.315] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0290.315] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0290.339] SetEvent (hEvent=0x12c) returned 1
	[0290.339] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0290.341] SetEvent (hEvent=0x104) returned 1
	[0290.341] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0290.388] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0290.388] SetEvent (hEvent=0x104) returned 1
	[0290.388] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0290.388] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0290.534] SetEvent (hEvent=0x104) returned 1
	[0290.534] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0290.534] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0290.670] SetEvent (hEvent=0x12c) returned 1
	[0290.670] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0290.671] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0290.697] SetEvent (hEvent=0x12c) returned 1
	[0290.697] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0290.699] SetEvent (hEvent=0x104) returned 1
	[0290.699] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0290.733] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0290.734] SetEvent (hEvent=0x104) returned 1
	[0290.734] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0290.734] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0290.885] SetEvent (hEvent=0x104) returned 1
	[0290.885] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0290.885] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0290.924] SetEvent (hEvent=0x12c) returned 1
	[0290.924] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0290.925] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0290.952] SetEvent (hEvent=0x12c) returned 1
	[0290.952] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0290.953] SetEvent (hEvent=0x104) returned 1
	[0290.953] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0290.987] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0290.988] SetEvent (hEvent=0x104) returned 1
	[0290.988] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0290.988] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0291.181] SetEvent (hEvent=0x104) returned 1
	[0291.182] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0291.182] SetEvent (hEvent=0x104) returned 1
	[0291.182] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0291.195] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0291.264] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0291.268] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0291.298] SetEvent (hEvent=0x104) returned 1
	[0291.298] SetEvent (hEvent=0x174) returned 1
	[0291.298] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0291.311] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0291.311] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0291.312] SetEvent (hEvent=0x104) returned 1
	[0291.312] SetEvent (hEvent=0x174) returned 1
	[0291.312] SetEvent (hEvent=0x14c) returned 1
	[0291.312] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0291.313] SetEvent (hEvent=0x168) returned 1
	[0291.313] SetEvent (hEvent=0x14c) returned 1
	[0291.313] SetEvent (hEvent=0x12c) returned 1
	[0291.313] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0291.315] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0291.324] SetEvent (hEvent=0x12c) returned 1
	[0291.324] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0291.325] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0291.352] SetEvent (hEvent=0x12c) returned 1
	[0291.352] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0291.353] SetEvent (hEvent=0x14c) returned 1
	[0291.353] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0291.396] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0291.397] SetEvent (hEvent=0x14c) returned 1
	[0291.397] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0291.397] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0291.552] SetEvent (hEvent=0x104) returned 1
	[0291.552] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0291.552] SetEvent (hEvent=0x104) returned 1
	[0291.552] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0291.560] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0291.589] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0291.610] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0291.621] SetEvent (hEvent=0x104) returned 1
	[0291.621] SetEvent (hEvent=0x174) returned 1
	[0291.621] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0291.633] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0291.633] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0291.634] SetEvent (hEvent=0x104) returned 1
	[0291.634] SetEvent (hEvent=0x174) returned 1
	[0291.634] SetEvent (hEvent=0x14c) returned 1
	[0291.634] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0291.634] SetEvent (hEvent=0x168) returned 1
	[0291.634] SetEvent (hEvent=0x14c) returned 1
	[0291.634] SetEvent (hEvent=0x12c) returned 1
	[0291.634] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0291.636] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0291.646] SetEvent (hEvent=0x12c) returned 1
	[0291.646] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0291.647] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0291.672] SetEvent (hEvent=0x12c) returned 1
	[0291.672] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0291.674] SetEvent (hEvent=0x14c) returned 1
	[0291.674] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0291.740] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0291.742] SetEvent (hEvent=0x14c) returned 1
	[0291.742] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0291.744] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0291.835] SetEvent (hEvent=0x104) returned 1
	[0291.835] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0291.835] SetEvent (hEvent=0x104) returned 1
	[0291.835] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0291.844] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0291.884] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0291.886] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0291.898] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0292.048] SetEvent (hEvent=0x104) returned 1
	[0292.049] SetEvent (hEvent=0x174) returned 1
	[0292.049] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0292.049] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0292.049] SetEvent (hEvent=0x104) returned 1
	[0292.049] SetEvent (hEvent=0x174) returned 1
	[0292.049] SetEvent (hEvent=0x14c) returned 1
	[0292.050] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0292.050] SetEvent (hEvent=0x14c) returned 1
	[0292.050] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0292.480] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0292.578] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0292.612] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0292.631] SetEvent (hEvent=0x14c) returned 1
	[0292.631] SetEvent (hEvent=0x174) returned 1
	[0292.631] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0292.650] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0292.650] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0292.651] SetEvent (hEvent=0x14c) returned 1
	[0292.651] SetEvent (hEvent=0x174) returned 1
	[0292.651] SetEvent (hEvent=0x104) returned 1
	[0292.651] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0292.651] SetEvent (hEvent=0x168) returned 1
	[0292.651] SetEvent (hEvent=0x104) returned 1
	[0292.651] SetEvent (hEvent=0x12c) returned 1
	[0292.651] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0292.653] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0292.663] SetEvent (hEvent=0x12c) returned 1
	[0292.663] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0292.664] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0292.710] SetEvent (hEvent=0x12c) returned 1
	[0292.710] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0292.713] SetEvent (hEvent=0x104) returned 1
	[0292.713] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0292.792] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0292.793] SetEvent (hEvent=0x104) returned 1
	[0292.793] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0292.793] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0292.887] SetEvent (hEvent=0x14c) returned 1
	[0292.887] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0292.888] SetEvent (hEvent=0x14c) returned 1
	[0292.888] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0292.896] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0292.940] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0292.963] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0292.992] SetEvent (hEvent=0x14c) returned 1
	[0292.992] SetEvent (hEvent=0x174) returned 1
	[0292.992] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0293.007] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0293.007] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0293.009] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0293.009] SetEvent (hEvent=0x14c) returned 1
	[0293.009] SetEvent (hEvent=0x174) returned 1
	[0293.009] SetEvent (hEvent=0x104) returned 1
	[0293.009] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0293.009] SetEvent (hEvent=0x168) returned 1
	[0293.009] SetEvent (hEvent=0x104) returned 1
	[0293.009] SetEvent (hEvent=0x12c) returned 1
	[0293.009] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0293.011] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0293.021] SetEvent (hEvent=0x12c) returned 1
	[0293.021] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0293.021] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0293.048] SetEvent (hEvent=0x12c) returned 1
	[0293.048] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0293.050] SetEvent (hEvent=0x104) returned 1
	[0293.050] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0293.092] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0293.094] SetEvent (hEvent=0x104) returned 1
	[0293.094] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0293.094] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0293.203] SetEvent (hEvent=0x14c) returned 1
	[0293.203] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0293.203] SetEvent (hEvent=0x14c) returned 1
	[0293.203] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0293.241] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0293.266] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0293.287] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0293.301] SetEvent (hEvent=0x14c) returned 1
	[0293.301] SetEvent (hEvent=0x174) returned 1
	[0293.301] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0293.314] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0293.314] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0293.314] SetEvent (hEvent=0x14c) returned 1
	[0293.314] SetEvent (hEvent=0x174) returned 1
	[0293.314] SetEvent (hEvent=0x104) returned 1
	[0293.314] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0293.315] SetEvent (hEvent=0x168) returned 1
	[0293.315] SetEvent (hEvent=0x104) returned 1
	[0293.315] SetEvent (hEvent=0x12c) returned 1
	[0293.315] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0293.316] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0293.349] SetEvent (hEvent=0x104) returned 1
	[0293.350] SwitchToThread () returned 1
	[0293.374] SetEvent (hEvent=0x104) returned 1
	[0293.375] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0293.377] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0293.377] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0293.378] SetEvent (hEvent=0x12c) returned 1
	[0293.378] SetEvent (hEvent=0x104) returned 1
	[0293.378] SetEvent (hEvent=0x174) returned 1
	[0293.378] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0293.378] SetEvent (hEvent=0x174) returned 1
	[0293.379] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\ZC2EzW b.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\zc2ezw b.png"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0293.380] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0293.380] WriteFile (in: hFile=0x178, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0293.402] CloseHandle (hObject=0x178) returned 1
	[0293.402] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\ZC2EzW b.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\zc2ezw b.png")) returned 1
	[0293.406] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\ees 2RjARK.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\ees 2rjark.jpg"), fInfoLevelId=0x0, lpFileInformation=0x124a60a8 | out: lpFileInformation=0x124a60a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40b823a0, ftCreationTime.dwHighDateTime=0x1d823d7, ftLastAccessTime.dwLowDateTime=0x87c49b40, ftLastAccessTime.dwHighDateTime=0x1d82614, ftLastWriteTime.dwLowDateTime=0x87c49b40, ftLastWriteTime.dwHighDateTime=0x1d82614, nFileSizeHigh=0x0, nFileSizeLow=0xae46)) returned 1
	[0293.406] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\ees 2RjARK.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\ees 2rjark.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0293.407] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0293.407] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\ees 2RjARK.jpg.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\ees 2rjark.jpg.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0293.407] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0293.407] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc300 | out: pbBuffer=0x123cc300) returned 1
	[0293.407] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124121d0 | out: pbBuffer=0x124121d0) returned 1
	[0293.407] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc181 | out: pbBuffer=0x123fc181) returned 1
	[0293.407] WriteFile (in: hFile=0x17c, lpBuffer=0x12537000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x12537000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0293.452] SetEvent (hEvent=0x104) returned 1
	[0293.452] ReadFile (in: hFile=0x178, lpBuffer=0x12d66000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12d66000*, lpNumberOfBytesRead=0x12422b78*=0xae46, lpOverlapped=0x0) returned 1
	[0293.455] WriteFile (in: hFile=0x17c, lpBuffer=0x12d66000*, nNumberOfBytesToWrite=0xae46, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12d66000*, lpNumberOfBytesWritten=0x12422b84*=0xae46, lpOverlapped=0x0) returned 1
	[0293.459] ReadFile (in: hFile=0x178, lpBuffer=0x12d66000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12d66000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0293.459] CloseHandle (hObject=0x17c) returned 1
	[0293.459] CloseHandle (hObject=0x178) returned 1
	[0293.459] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x125d2000*, nNumberOfCharsToWrite=0x46, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x125d2000*, lpNumberOfCharsWritten=0x1242283c*=0x46) returned 1
	[0293.475] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0293.477] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\ees 2RjARK.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\ees 2rjark.jpg")) returned 1
	[0293.489] SetEvent (hEvent=0x104) returned 1
	[0293.490] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0293.491] SetEvent (hEvent=0x104) returned 1
	[0293.491] SetEvent (hEvent=0x14c) returned 1
	[0293.491] SetEvent (hEvent=0x12c) returned 1
	[0293.491] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0293.495] SetEvent (hEvent=0x168) returned 1
	[0293.495] SetEvent (hEvent=0x12c) returned 1
	[0293.516] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0293.517] SetEvent (hEvent=0x12c) returned 1
	[0293.519] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0293.520] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0293.520] SetEvent (hEvent=0x12c) returned 1
	[0293.520] SetEvent (hEvent=0x14c) returned 1
	[0293.520] SetEvent (hEvent=0x104) returned 1
	[0293.520] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0293.521] SetEvent (hEvent=0x104) returned 1
	[0293.521] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\ees 2RjARK.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\ees 2rjark.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0293.522] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0293.522] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0293.544] CloseHandle (hObject=0x178) returned 1
	[0293.544] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\ees 2RjARK.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\ees 2rjark.jpg")) returned 1
	[0293.549] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\wjPJRAmkGskYdShvUdd" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\wjpjramkgskydshvudd"), fInfoLevelId=0x0, lpFileInformation=0x124a6058 | out: lpFileInformation=0x124a6058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc5507350, ftCreationTime.dwHighDateTime=0x1d828e7, ftLastAccessTime.dwLowDateTime=0x96405580, ftLastAccessTime.dwHighDateTime=0x1d8290a, ftLastWriteTime.dwLowDateTime=0x96405580, ftLastWriteTime.dwHighDateTime=0x1d8290a, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0293.549] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\wjPJRAmkGskYdShvUdd" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\wjpjramkgskydshvudd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0293.549] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\wjPJRAmkGskYdShvUdd\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc5507350, ftCreationTime.dwHighDateTime=0x1d828e7, ftLastAccessTime.dwLowDateTime=0x96405580, ftLastAccessTime.dwHighDateTime=0x1d8290a, ftLastWriteTime.dwLowDateTime=0x96405580, ftLastWriteTime.dwHighDateTime=0x1d8290a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fae8
	[0293.549] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc5507350, ftCreationTime.dwHighDateTime=0x1d828e7, ftLastAccessTime.dwLowDateTime=0x96405580, ftLastAccessTime.dwHighDateTime=0x1d8290a, ftLastWriteTime.dwLowDateTime=0x96405580, ftLastWriteTime.dwHighDateTime=0x1d8290a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0293.549] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdab4c320, ftCreationTime.dwHighDateTime=0x1d81c5f, ftLastAccessTime.dwLowDateTime=0xa2e70c30, ftLastAccessTime.dwHighDateTime=0x1d8271f, ftLastWriteTime.dwLowDateTime=0xa2e70c30, ftLastWriteTime.dwHighDateTime=0x1d8271f, nFileSizeHigh=0x0, nFileSizeLow=0x8fb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="7xEvnDWMGm0.jpg", cAlternateFileName="7XEVND~1.JPG")) returned 1
	[0293.549] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd7f7ee0, ftCreationTime.dwHighDateTime=0x1d825db, ftLastAccessTime.dwLowDateTime=0x3d10ef80, ftLastAccessTime.dwHighDateTime=0x1d82967, ftLastWriteTime.dwLowDateTime=0x3d10ef80, ftLastWriteTime.dwHighDateTime=0x1d82967, nFileSizeHigh=0x0, nFileSizeLow=0x1611f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ojAQjoesa0UU.jpg", cAlternateFileName="OJAQJO~1.JPG")) returned 1
	[0293.549] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31b73cf0, ftCreationTime.dwHighDateTime=0x1d82167, ftLastAccessTime.dwLowDateTime=0xfbfe2d30, ftLastAccessTime.dwHighDateTime=0x1d822ba, ftLastWriteTime.dwLowDateTime=0xfbfe2d30, ftLastWriteTime.dwHighDateTime=0x1d822ba, nFileSizeHigh=0x0, nFileSizeLow=0xde99, dwReserved0=0x0, dwReserved1=0x0, cFileName="vfsq.png", cAlternateFileName="")) returned 1
	[0293.549] FindNextFileW (in: hFindFile=0x79fae8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0293.549] FindClose (in: hFindFile=0x79fae8 | out: hFindFile=0x79fae8) returned 1
	[0293.550] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\wjPJRAmkGskYdShvUdd\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\wjpjramkgskydshvudd\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0293.550] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422ccc | out: lpMode=0x12422ccc) returned 0
	[0293.550] WriteFile (in: hFile=0x178, lpBuffer=0x12694000*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422cbc, lpOverlapped=0x0 | out: lpBuffer=0x12694000*, lpNumberOfBytesWritten=0x12422cbc*=0xc85, lpOverlapped=0x0) returned 1
	[0293.551] CloseHandle (hObject=0x178) returned 1
	[0293.551] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12538000*, nNumberOfCharsToWrite=0x61, lpNumberOfCharsWritten=0x1242284c, lpReserved=0x0 | out: lpBuffer=0x12538000*, lpNumberOfCharsWritten=0x1242284c*=0x61) returned 1
	[0293.565] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\wjPJRAmkGskYdShvUdd\\7xEvnDWMGm0.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\wjpjramkgskydshvudd\\7xevndwmgm0.jpg"), fInfoLevelId=0x0, lpFileInformation=0x124a61e8 | out: lpFileInformation=0x124a61e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdab4c320, ftCreationTime.dwHighDateTime=0x1d81c5f, ftLastAccessTime.dwLowDateTime=0xa2e70c30, ftLastAccessTime.dwHighDateTime=0x1d8271f, ftLastWriteTime.dwLowDateTime=0xa2e70c30, ftLastWriteTime.dwHighDateTime=0x1d8271f, nFileSizeHigh=0x0, nFileSizeLow=0x8fb6)) returned 1
	[0293.565] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\wjPJRAmkGskYdShvUdd\\7xEvnDWMGm0.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\wjpjramkgskydshvudd\\7xevndwmgm0.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0293.565] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b48 | out: lpMode=0x12422b48) returned 0
	[0293.565] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\wjPJRAmkGskYdShvUdd\\7xEvnDWMGm0.jpg.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\wjpjramkgskydshvudd\\7xevndwmgm0.jpg.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0293.566] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422b48 | out: lpMode=0x12422b48) returned 0
	[0293.566] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc3a0 | out: pbBuffer=0x123cc3a0) returned 1
	[0293.566] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c250 | out: pbBuffer=0x1251c250) returned 1
	[0293.566] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc081 | out: pbBuffer=0x123fc081) returned 1
	[0293.566] WriteFile (in: hFile=0x17c, lpBuffer=0x125d1000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b24, lpOverlapped=0x0 | out: lpBuffer=0x125d1000*, lpNumberOfBytesWritten=0x12422b24*=0x80, lpOverlapped=0x0) returned 1
	[0293.569] SetEvent (hEvent=0x14c) returned 1
	[0293.569] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b14, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b14*=0x8fb6, lpOverlapped=0x0) returned 1
	[0293.571] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x8fb6, lpNumberOfBytesWritten=0x12422b20, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b20*=0x8fb6, lpOverlapped=0x0) returned 1
	[0293.574] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b14, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b14*=0x0, lpOverlapped=0x0) returned 1
	[0293.574] CloseHandle (hObject=0x17c) returned 1
	[0293.575] CloseHandle (hObject=0x178) returned 1
	[0293.575] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1250c000*, nNumberOfCharsToWrite=0x5b, lpNumberOfCharsWritten=0x124227d8, lpReserved=0x0 | out: lpBuffer=0x1250c000*, lpNumberOfCharsWritten=0x124227d8*=0x5b) returned 1
	[0293.615] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0293.617] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\wjPJRAmkGskYdShvUdd\\7xEvnDWMGm0.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\wjpjramkgskydshvudd\\7xevndwmgm0.jpg")) returned 1
	[0293.626] SetEvent (hEvent=0x14c) returned 1
	[0293.629] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0293.631] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0293.631] SetEvent (hEvent=0x14c) returned 1
	[0293.631] SetEvent (hEvent=0x174) returned 1
	[0293.632] SetEvent (hEvent=0x12c) returned 1
	[0293.632] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0293.632] SetEvent (hEvent=0x168) returned 1
	[0293.632] SetEvent (hEvent=0x12c) returned 1
	[0293.658] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0293.659] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0293.659] SetEvent (hEvent=0x12c) returned 1
	[0293.662] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0293.663] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0293.663] SetEvent (hEvent=0x12c) returned 1
	[0293.663] SetEvent (hEvent=0x174) returned 1
	[0293.663] SetEvent (hEvent=0x14c) returned 1
	[0293.663] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0293.663] SetEvent (hEvent=0x14c) returned 1
	[0293.666] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\wjPJRAmkGskYdShvUdd\\7xEvnDWMGm0.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\wjpjramkgskydshvudd\\7xevndwmgm0.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0293.667] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c34 | out: lpMode=0x12422c34) returned 0
	[0293.667] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c24, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c24*=0xfa000, lpOverlapped=0x0) returned 1
	[0293.686] CloseHandle (hObject=0x178) returned 1
	[0293.686] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\wjPJRAmkGskYdShvUdd\\7xEvnDWMGm0.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\wjpjramkgskydshvudd\\7xevndwmgm0.jpg")) returned 1
	[0293.692] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\wjPJRAmkGskYdShvUdd\\ojAQjoesa0UU.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\wjpjramkgskydshvudd\\ojaqjoesa0uu.jpg"), fInfoLevelId=0x0, lpFileInformation=0x124a60a8 | out: lpFileInformation=0x124a60a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd7f7ee0, ftCreationTime.dwHighDateTime=0x1d825db, ftLastAccessTime.dwLowDateTime=0x3d10ef80, ftLastAccessTime.dwHighDateTime=0x1d82967, ftLastWriteTime.dwLowDateTime=0x3d10ef80, ftLastWriteTime.dwHighDateTime=0x1d82967, nFileSizeHigh=0x0, nFileSizeLow=0x1611f)) returned 1
	[0293.693] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\wjPJRAmkGskYdShvUdd\\ojAQjoesa0UU.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\wjpjramkgskydshvudd\\ojaqjoesa0uu.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0293.693] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b48 | out: lpMode=0x12422b48) returned 0
	[0293.693] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\wjPJRAmkGskYdShvUdd\\ojAQjoesa0UU.jpg.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\wjpjramkgskydshvudd\\ojaqjoesa0uu.jpg.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0293.693] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422b48 | out: lpMode=0x12422b48) returned 0
	[0293.694] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc340 | out: pbBuffer=0x123cc340) returned 1
	[0293.694] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124121c0 | out: pbBuffer=0x124121c0) returned 1
	[0293.694] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc081 | out: pbBuffer=0x123fc081) returned 1
	[0293.694] WriteFile (in: hFile=0x17c, lpBuffer=0x1253b000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b24, lpOverlapped=0x0 | out: lpBuffer=0x1253b000*, lpNumberOfBytesWritten=0x12422b24*=0x80, lpOverlapped=0x0) returned 1
	[0293.700] SetEvent (hEvent=0x174) returned 1
	[0293.700] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b14, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b14*=0x1611f, lpOverlapped=0x0) returned 1
	[0293.703] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x1611f, lpNumberOfBytesWritten=0x12422b20, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b20*=0x1611f, lpOverlapped=0x0) returned 1
	[0293.707] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b14, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b14*=0x0, lpOverlapped=0x0) returned 1
	[0293.707] CloseHandle (hObject=0x17c) returned 1
	[0293.707] CloseHandle (hObject=0x178) returned 1
	[0293.708] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1253e000*, nNumberOfCharsToWrite=0x5c, lpNumberOfCharsWritten=0x124227d8, lpReserved=0x0 | out: lpBuffer=0x1253e000*, lpNumberOfCharsWritten=0x124227d8*=0x5c) returned 1
	[0293.718] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0293.719] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\wjPJRAmkGskYdShvUdd\\ojAQjoesa0UU.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\wjpjramkgskydshvudd\\ojaqjoesa0uu.jpg")) returned 1
	[0293.743] SetEvent (hEvent=0x174) returned 1
	[0293.744] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0293.746] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0293.747] SetEvent (hEvent=0x174) returned 1
	[0293.747] SetEvent (hEvent=0x104) returned 1
	[0293.747] SetEvent (hEvent=0x12c) returned 1
	[0293.747] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0293.747] SetEvent (hEvent=0x168) returned 1
	[0293.747] SetEvent (hEvent=0x12c) returned 1
	[0293.769] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0293.769] SetEvent (hEvent=0x12c) returned 1
	[0293.771] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0293.773] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0293.773] SetEvent (hEvent=0x12c) returned 1
	[0293.773] SetEvent (hEvent=0x104) returned 1
	[0293.773] SetEvent (hEvent=0x174) returned 1
	[0293.774] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0293.774] SetEvent (hEvent=0x168) returned 1
	[0293.774] SetEvent (hEvent=0x174) returned 1
	[0293.775] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\wjPJRAmkGskYdShvUdd\\ojAQjoesa0UU.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\wjpjramkgskydshvudd\\ojaqjoesa0uu.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0293.776] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c34 | out: lpMode=0x12422c34) returned 0
	[0293.776] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c24, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c24*=0xfa000, lpOverlapped=0x0) returned 1
	[0293.794] CloseHandle (hObject=0x178) returned 1
	[0293.795] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\wjPJRAmkGskYdShvUdd\\ojAQjoesa0UU.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\wjpjramkgskydshvudd\\ojaqjoesa0uu.jpg")) returned 1
	[0293.799] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\wjPJRAmkGskYdShvUdd\\vfsq.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\wjpjramkgskydshvudd\\vfsq.png"), fInfoLevelId=0x0, lpFileInformation=0x124a60f8 | out: lpFileInformation=0x124a60f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31b73cf0, ftCreationTime.dwHighDateTime=0x1d82167, ftLastAccessTime.dwLowDateTime=0xfbfe2d30, ftLastAccessTime.dwHighDateTime=0x1d822ba, ftLastWriteTime.dwLowDateTime=0xfbfe2d30, ftLastWriteTime.dwHighDateTime=0x1d822ba, nFileSizeHigh=0x0, nFileSizeLow=0xde99)) returned 1
	[0293.799] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\wjPJRAmkGskYdShvUdd\\vfsq.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\wjpjramkgskydshvudd\\vfsq.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0293.800] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b48 | out: lpMode=0x12422b48) returned 0
	[0293.800] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\wjPJRAmkGskYdShvUdd\\vfsq.png.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\wjpjramkgskydshvudd\\vfsq.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0293.800] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422b48 | out: lpMode=0x12422b48) returned 0
	[0293.800] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc340 | out: pbBuffer=0x123cc340) returned 1
	[0293.800] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c120 | out: pbBuffer=0x1251c120) returned 1
	[0293.800] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc081 | out: pbBuffer=0x123fc081) returned 1
	[0293.800] WriteFile (in: hFile=0x17c, lpBuffer=0x12539000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b24, lpOverlapped=0x0 | out: lpBuffer=0x12539000*, lpNumberOfBytesWritten=0x12422b24*=0x80, lpOverlapped=0x0) returned 1
	[0293.803] SetEvent (hEvent=0x104) returned 1
	[0293.803] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b14, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b14*=0xde99, lpOverlapped=0x0) returned 1
	[0293.805] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0xde99, lpNumberOfBytesWritten=0x12422b20, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b20*=0xde99, lpOverlapped=0x0) returned 1
	[0293.808] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b14, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b14*=0x0, lpOverlapped=0x0) returned 1
	[0293.808] CloseHandle (hObject=0x17c) returned 1
	[0293.809] CloseHandle (hObject=0x178) returned 1
	[0293.809] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1253c000*, nNumberOfCharsToWrite=0x54, lpNumberOfCharsWritten=0x124227d8, lpReserved=0x0 | out: lpBuffer=0x1253c000*, lpNumberOfCharsWritten=0x124227d8*=0x54) returned 1
	[0293.821] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0293.823] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\wjPJRAmkGskYdShvUdd\\vfsq.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\wjpjramkgskydshvudd\\vfsq.png")) returned 1
	[0293.829] SetEvent (hEvent=0x104) returned 1
	[0293.830] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0293.831] SetEvent (hEvent=0x104) returned 1
	[0293.831] SetEvent (hEvent=0x14c) returned 1
	[0293.831] SetEvent (hEvent=0x12c) returned 1
	[0293.831] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0293.836] SetEvent (hEvent=0x12c) returned 1
	[0293.857] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0293.861] SetEvent (hEvent=0x168) returned 1
	[0293.861] SetEvent (hEvent=0x12c) returned 1
	[0293.863] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0293.864] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0293.864] SetEvent (hEvent=0x12c) returned 1
	[0293.864] SetEvent (hEvent=0x14c) returned 1
	[0293.864] SetEvent (hEvent=0x104) returned 1
	[0293.864] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0293.864] SetEvent (hEvent=0x104) returned 1
	[0293.865] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\wjPJRAmkGskYdShvUdd\\vfsq.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\wjpjramkgskydshvudd\\vfsq.png"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0293.866] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c34 | out: lpMode=0x12422c34) returned 0
	[0293.866] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c24, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c24*=0xfa000, lpOverlapped=0x0) returned 1
	[0293.886] CloseHandle (hObject=0x178) returned 1
	[0293.886] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\wjPJRAmkGskYdShvUdd\\vfsq.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\wjpjramkgskydshvudd\\vfsq.png")) returned 1
	[0293.890] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\PrintHood" (normalized: "c:\\users\\rdhj0cnfevzx\\printhood"), fInfoLevelId=0x0, lpFileInformation=0x124a60a8 | out: lpFileInformation=0x124a60a8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0293.891] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Recent" (normalized: "c:\\users\\rdhj0cnfevzx\\recent"), fInfoLevelId=0x0, lpFileInformation=0x124a6148 | out: lpFileInformation=0x124a6148*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0293.891] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Saved Games" (normalized: "c:\\users\\rdhj0cnfevzx\\saved games"), fInfoLevelId=0x0, lpFileInformation=0x124a6198 | out: lpFileInformation=0x124a6198*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43754b80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43754b80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0293.891] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Saved Games" (normalized: "c:\\users\\rdhj0cnfevzx\\saved games"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0293.891] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Saved Games\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43754b80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43754b80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fca8
	[0293.891] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43754b80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43754b80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0293.892] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43754b80, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43754b80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43754b80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0293.892] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0293.892] FindClose (in: hFindFile=0x79fca8 | out: hFindFile=0x79fca8) returned 1
	[0293.892] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Saved Games\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\saved games\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0293.892] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d94 | out: lpMode=0x12422d94) returned 0
	[0293.892] WriteFile (in: hFile=0x178, lpBuffer=0x12694000*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d84, lpOverlapped=0x0 | out: lpBuffer=0x12694000*, lpNumberOfBytesWritten=0x12422d84*=0xc85, lpOverlapped=0x0) returned 1
	[0293.894] CloseHandle (hObject=0x178) returned 1
	[0293.894] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123fc080*, nNumberOfCharsToWrite=0x3c, lpNumberOfCharsWritten=0x12422914, lpReserved=0x0 | out: lpBuffer=0x123fc080*, lpNumberOfCharsWritten=0x12422914*=0x3c) returned 1
	[0293.904] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Saved Games\\desktop.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\saved games\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x124a6238 | out: lpFileInformation=0x124a6238*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43754b80, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43754b80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43754b80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a)) returned 1
	[0293.904] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Searches" (normalized: "c:\\users\\rdhj0cnfevzx\\searches"), fInfoLevelId=0x0, lpFileInformation=0x124a6288 | out: lpFileInformation=0x124a6288*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43695fb2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437a1142, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437a1142, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0293.904] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Searches" (normalized: "c:\\users\\rdhj0cnfevzx\\searches"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0293.904] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Searches\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43695fb2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437a1142, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437a1142, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fc68
	[0293.904] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43695fb2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437a1142, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437a1142, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0293.905] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x436bc315, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437a1142, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0293.905] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x437a1142, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437a1142, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437a1142, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1
	[0293.905] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x4377acca, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4377acca, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x4377acca, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1
	[0293.905] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0293.905] FindClose (in: hFindFile=0x79fc68 | out: hFindFile=0x79fc68) returned 1
	[0293.905] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Searches\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\searches\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0293.907] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d94 | out: lpMode=0x12422d94) returned 0
	[0293.907] WriteFile (in: hFile=0x178, lpBuffer=0x12694d80*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d84, lpOverlapped=0x0 | out: lpBuffer=0x12694d80*, lpNumberOfBytesWritten=0x12422d84*=0xc85, lpOverlapped=0x0) returned 1
	[0293.908] CloseHandle (hObject=0x178) returned 1
	[0293.908] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123fc100*, nNumberOfCharsToWrite=0x39, lpNumberOfCharsWritten=0x12422914, lpReserved=0x0 | out: lpBuffer=0x123fc100*, lpNumberOfCharsWritten=0x12422914*=0x39) returned 1
	[0293.922] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\rdhj0cnfevzx\\searches\\everywhere.search-ms"), fInfoLevelId=0x0, lpFileInformation=0x124a63c8 | out: lpFileInformation=0x124a63c8*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x437a1142, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437a1142, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437a1142, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0xf8)) returned 1
	[0293.922] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\rdhj0cnfevzx\\searches\\indexed locations.search-ms"), fInfoLevelId=0x0, lpFileInformation=0x124a6468 | out: lpFileInformation=0x124a6468*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x4377acca, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4377acca, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x4377acca, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0xf8)) returned 1
	[0293.923] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Searches\\desktop.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\searches\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x124a64b8 | out: lpFileInformation=0x124a64b8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x436bc315, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437a1142, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x20c)) returned 1
	[0293.923] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\SendTo" (normalized: "c:\\users\\rdhj0cnfevzx\\sendto"), fInfoLevelId=0x0, lpFileInformation=0x124a6508 | out: lpFileInformation=0x124a6508*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0293.923] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Start Menu" (normalized: "c:\\users\\rdhj0cnfevzx\\start menu"), fInfoLevelId=0x0, lpFileInformation=0x124a6558 | out: lpFileInformation=0x124a6558*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0293.923] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Templates" (normalized: "c:\\users\\rdhj0cnfevzx\\templates"), fInfoLevelId=0x0, lpFileInformation=0x124a65a8 | out: lpFileInformation=0x124a65a8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0293.923] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos" (normalized: "c:\\users\\rdhj0cnfevzx\\videos"), fInfoLevelId=0x0, lpFileInformation=0x124a65f8 | out: lpFileInformation=0x124a65f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf4be58e0, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf4be58e0, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0293.923] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos" (normalized: "c:\\users\\rdhj0cnfevzx\\videos"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0293.924] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf4be58e0, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf4be58e0, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffe8
	[0293.924] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf4be58e0, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf4be58e0, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0293.924] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61d88440, ftCreationTime.dwHighDateTime=0x1d82313, ftLastAccessTime.dwLowDateTime=0xa57cc70, ftLastAccessTime.dwHighDateTime=0x1d82751, ftLastWriteTime.dwLowDateTime=0xa57cc70, ftLastWriteTime.dwHighDateTime=0x1d82751, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7rpqDn1 v3", cAlternateFileName="7RPQDN~1")) returned 1
	[0293.924] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x974e0d10, ftCreationTime.dwHighDateTime=0x1d81f27, ftLastAccessTime.dwLowDateTime=0x92991640, ftLastAccessTime.dwHighDateTime=0x1d81f84, ftLastWriteTime.dwLowDateTime=0x92991640, ftLastWriteTime.dwHighDateTime=0x1d81f84, nFileSizeHigh=0x0, nFileSizeLow=0x135f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="a5Xvi1981.flv", cAlternateFileName="A5XVI1~1.FLV")) returned 1
	[0293.924] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4347fe61, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4347fe61, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0293.924] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x298a830, ftCreationTime.dwHighDateTime=0x1d81c50, ftLastAccessTime.dwLowDateTime=0xac10dc10, ftLastAccessTime.dwHighDateTime=0x1d8257f, ftLastWriteTime.dwLowDateTime=0xac10dc10, ftLastWriteTime.dwHighDateTime=0x1d8257f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dR7bCt_DEjsDVvvsD4", cAlternateFileName="DR7BCT~1")) returned 1
	[0293.924] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9491c60, ftCreationTime.dwHighDateTime=0x1d81f58, ftLastAccessTime.dwLowDateTime=0x1f43af80, ftLastAccessTime.dwHighDateTime=0x1d8207d, ftLastWriteTime.dwLowDateTime=0x1f43af80, ftLastWriteTime.dwHighDateTime=0x1d8207d, nFileSizeHigh=0x0, nFileSizeLow=0xe3f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlVsAU0AVXL.swf", cAlternateFileName="FLVSAU~1.SWF")) returned 1
	[0293.924] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8728e100, ftCreationTime.dwHighDateTime=0x1d81c0f, ftLastAccessTime.dwLowDateTime=0xf7435fc0, ftLastAccessTime.dwHighDateTime=0x1d81f42, ftLastWriteTime.dwLowDateTime=0xf7435fc0, ftLastWriteTime.dwHighDateTime=0x1d81f42, nFileSizeHigh=0x0, nFileSizeLow=0x12fb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="mf6GaSZm.swf", cAlternateFileName="")) returned 1
	[0293.924] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5f8d3b0, ftCreationTime.dwHighDateTime=0x1d81be7, ftLastAccessTime.dwLowDateTime=0x9556bb40, ftLastAccessTime.dwHighDateTime=0x1d82398, ftLastWriteTime.dwLowDateTime=0x9556bb40, ftLastWriteTime.dwHighDateTime=0x1d82398, nFileSizeHigh=0x0, nFileSizeLow=0x9936, dwReserved0=0x0, dwReserved1=0x0, cFileName="mMJ8LgwTwoK5YdLT9n.swf", cAlternateFileName="MMJ8LG~1.SWF")) returned 1
	[0293.924] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a097310, ftCreationTime.dwHighDateTime=0x1d82534, ftLastAccessTime.dwLowDateTime=0x550da120, ftLastAccessTime.dwHighDateTime=0x1d82569, ftLastWriteTime.dwLowDateTime=0x550da120, ftLastWriteTime.dwHighDateTime=0x1d82569, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MZCNgHXG62XR4mDH3uUV", cAlternateFileName="MZCNGH~1")) returned 1
	[0293.924] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe13acbd0, ftCreationTime.dwHighDateTime=0x1d81a12, ftLastAccessTime.dwLowDateTime=0x3c4e7e40, ftLastAccessTime.dwHighDateTime=0x1d827c4, ftLastWriteTime.dwLowDateTime=0x3c4e7e40, ftLastWriteTime.dwHighDateTime=0x1d827c4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TyEVRaUhmI", cAlternateFileName="TYEVRA~1")) returned 1
	[0293.924] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22362050, ftCreationTime.dwHighDateTime=0x1d81af2, ftLastAccessTime.dwLowDateTime=0xb7999f50, ftLastAccessTime.dwHighDateTime=0x1d82015, ftLastWriteTime.dwLowDateTime=0xb7999f50, ftLastWriteTime.dwHighDateTime=0x1d82015, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XwBoItD2EDdRnLbEsBcT", cAlternateFileName="XWBOIT~1")) returned 1
	[0293.924] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0293.924] FindClose (in: hFindFile=0x79ffe8 | out: hFindFile=0x79ffe8) returned 1
	[0293.925] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0293.925] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d94 | out: lpMode=0x12422d94) returned 0
	[0293.925] WriteFile (in: hFile=0x178, lpBuffer=0x12696880*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d84, lpOverlapped=0x0 | out: lpBuffer=0x12696880*, lpNumberOfBytesWritten=0x12422d84*=0xc85, lpOverlapped=0x0) returned 1
	[0293.926] CloseHandle (hObject=0x178) returned 1
	[0293.927] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123d01c0*, nNumberOfCharsToWrite=0x37, lpNumberOfCharsWritten=0x12422914, lpReserved=0x0 | out: lpBuffer=0x123d01c0*, lpNumberOfCharsWritten=0x12422914*=0x37) returned 1
	[0293.949] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\7rpqDn1 v3" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\7rpqdn1 v3"), fInfoLevelId=0x0, lpFileInformation=0x124a69b8 | out: lpFileInformation=0x124a69b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61d88440, ftCreationTime.dwHighDateTime=0x1d82313, ftLastAccessTime.dwLowDateTime=0xa57cc70, ftLastAccessTime.dwHighDateTime=0x1d82751, ftLastWriteTime.dwLowDateTime=0xa57cc70, ftLastWriteTime.dwHighDateTime=0x1d82751, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0293.949] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\7rpqDn1 v3" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\7rpqdn1 v3"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0293.949] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\7rpqDn1 v3\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61d88440, ftCreationTime.dwHighDateTime=0x1d82313, ftLastAccessTime.dwLowDateTime=0xa57cc70, ftLastAccessTime.dwHighDateTime=0x1d82751, ftLastWriteTime.dwLowDateTime=0xa57cc70, ftLastWriteTime.dwHighDateTime=0x1d82751, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fea8
	[0293.950] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61d88440, ftCreationTime.dwHighDateTime=0x1d82313, ftLastAccessTime.dwLowDateTime=0xa57cc70, ftLastAccessTime.dwHighDateTime=0x1d82751, ftLastWriteTime.dwLowDateTime=0xa57cc70, ftLastWriteTime.dwHighDateTime=0x1d82751, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0293.950] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5804c0, ftCreationTime.dwHighDateTime=0x1d824e8, ftLastAccessTime.dwLowDateTime=0xc9602290, ftLastAccessTime.dwHighDateTime=0x1d8274f, ftLastWriteTime.dwLowDateTime=0xc9602290, ftLastWriteTime.dwHighDateTime=0x1d8274f, nFileSizeHigh=0x0, nFileSizeLow=0xc049, dwReserved0=0x0, dwReserved1=0x0, cFileName="-kKw4wrYSg0z3JkwWd.mp4", cAlternateFileName="-KKW4W~1.MP4")) returned 1
	[0293.950] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7711240, ftCreationTime.dwHighDateTime=0x1d81dfe, ftLastAccessTime.dwLowDateTime=0x279ebdc0, ftLastAccessTime.dwHighDateTime=0x1d8256c, ftLastWriteTime.dwLowDateTime=0x279ebdc0, ftLastWriteTime.dwHighDateTime=0x1d8256c, nFileSizeHigh=0x0, nFileSizeLow=0xc781, dwReserved0=0x0, dwReserved1=0x0, cFileName="1fwtW.mp4", cAlternateFileName="")) returned 1
	[0293.950] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a49d90, ftCreationTime.dwHighDateTime=0x1d8203f, ftLastAccessTime.dwLowDateTime=0x663eb740, ftLastAccessTime.dwHighDateTime=0x1d829e7, ftLastWriteTime.dwLowDateTime=0x663eb740, ftLastWriteTime.dwHighDateTime=0x1d829e7, nFileSizeHigh=0x0, nFileSizeLow=0x6dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="dhOhNDgLcNhpw4.flv", cAlternateFileName="DHOHND~1.FLV")) returned 1
	[0293.950] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0293.950] FindClose (in: hFindFile=0x79fea8 | out: hFindFile=0x79fea8) returned 1
	[0293.950] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\7rpqDn1 v3\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\7rpqdn1 v3\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0293.951] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d30 | out: lpMode=0x12422d30) returned 0
	[0293.951] WriteFile (in: hFile=0x178, lpBuffer=0x12697600*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d20, lpOverlapped=0x0 | out: lpBuffer=0x12697600*, lpNumberOfBytesWritten=0x12422d20*=0xc85, lpOverlapped=0x0) returned 1
	[0293.953] CloseHandle (hObject=0x178) returned 1
	[0293.953] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x126422d0*, nNumberOfCharsToWrite=0x42, lpNumberOfCharsWritten=0x124228b0, lpReserved=0x0 | out: lpBuffer=0x126422d0*, lpNumberOfCharsWritten=0x124228b0*=0x42) returned 1
	[0293.971] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\7rpqDn1 v3\\-kKw4wrYSg0z3JkwWd.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\7rpqdn1 v3\\-kkw4wrysg0z3jkwwd.mp4"), fInfoLevelId=0x0, lpFileInformation=0x124a6af8 | out: lpFileInformation=0x124a6af8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5804c0, ftCreationTime.dwHighDateTime=0x1d824e8, ftLastAccessTime.dwLowDateTime=0xc9602290, ftLastAccessTime.dwHighDateTime=0x1d8274f, ftLastWriteTime.dwLowDateTime=0xc9602290, ftLastWriteTime.dwHighDateTime=0x1d8274f, nFileSizeHigh=0x0, nFileSizeLow=0xc049)) returned 1
	[0293.971] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\7rpqDn1 v3\\-kKw4wrYSg0z3JkwWd.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\7rpqdn1 v3\\-kkw4wrysg0z3jkwwd.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0293.972] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0293.972] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\7rpqDn1 v3\\-kKw4wrYSg0z3JkwWd.mp4.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\7rpqdn1 v3\\-kkw4wrysg0z3jkwwd.mp4.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0293.972] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0293.972] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x126c4840 | out: pbBuffer=0x126c4840) returned 1
	[0293.972] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x12412fa0 | out: pbBuffer=0x12412fa0) returned 1
	[0293.972] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc301 | out: pbBuffer=0x123fc301) returned 1
	[0293.972] WriteFile (in: hFile=0x17c, lpBuffer=0x12507000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x12507000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0293.979] SetEvent (hEvent=0x14c) returned 1
	[0293.979] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0xc049, lpOverlapped=0x0) returned 1
	[0293.982] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0xc049, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b84*=0xc049, lpOverlapped=0x0) returned 1
	[0293.985] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0293.985] CloseHandle (hObject=0x17c) returned 1
	[0293.986] CloseHandle (hObject=0x178) returned 1
	[0293.986] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x125d0000*, nNumberOfCharsToWrite=0x43, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x125d0000*, lpNumberOfCharsWritten=0x1242283c*=0x43) returned 1
	[0294.002] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0294.007] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\7rpqDn1 v3\\-kKw4wrYSg0z3JkwWd.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\7rpqdn1 v3\\-kkw4wrysg0z3jkwwd.mp4")) returned 1
	[0294.020] SetEvent (hEvent=0x14c) returned 1
	[0294.022] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0294.023] SetEvent (hEvent=0x14c) returned 1
	[0294.023] SetEvent (hEvent=0x174) returned 1
	[0294.023] SetEvent (hEvent=0x12c) returned 1
	[0294.023] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0294.024] SetEvent (hEvent=0x168) returned 1
	[0294.024] SetEvent (hEvent=0x12c) returned 1
	[0294.077] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0294.080] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0294.080] SetEvent (hEvent=0x12c) returned 1
	[0294.085] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0294.085] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0294.086] SetEvent (hEvent=0x12c) returned 1
	[0294.086] SetEvent (hEvent=0x174) returned 1
	[0294.086] SetEvent (hEvent=0x14c) returned 1
	[0294.086] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0294.086] SetEvent (hEvent=0x14c) returned 1
	[0294.088] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\7rpqDn1 v3\\-kKw4wrYSg0z3JkwWd.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\7rpqdn1 v3\\-kkw4wrysg0z3jkwwd.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0294.091] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0294.091] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0294.116] CloseHandle (hObject=0x178) returned 1
	[0294.117] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\7rpqDn1 v3\\-kKw4wrYSg0z3JkwWd.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\7rpqdn1 v3\\-kkw4wrysg0z3jkwwd.mp4")) returned 1
	[0294.122] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\7rpqDn1 v3\\1fwtW.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\7rpqdn1 v3\\1fwtw.mp4"), fInfoLevelId=0x0, lpFileInformation=0x124a6008 | out: lpFileInformation=0x124a6008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7711240, ftCreationTime.dwHighDateTime=0x1d81dfe, ftLastAccessTime.dwLowDateTime=0x279ebdc0, ftLastAccessTime.dwHighDateTime=0x1d8256c, ftLastWriteTime.dwLowDateTime=0x279ebdc0, ftLastWriteTime.dwHighDateTime=0x1d8256c, nFileSizeHigh=0x0, nFileSizeLow=0xc781)) returned 1
	[0294.122] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\7rpqDn1 v3\\1fwtW.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\7rpqdn1 v3\\1fwtw.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0294.123] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0294.123] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\7rpqDn1 v3\\1fwtW.mp4.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\7rpqdn1 v3\\1fwtw.mp4.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0294.123] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0294.123] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc240 | out: pbBuffer=0x123cc240) returned 1
	[0294.124] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c110 | out: pbBuffer=0x1251c110) returned 1
	[0294.124] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc201 | out: pbBuffer=0x123fc201) returned 1
	[0294.125] WriteFile (in: hFile=0x17c, lpBuffer=0x12537000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x12537000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0294.134] SetEvent (hEvent=0x174) returned 1
	[0294.134] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0xc781, lpOverlapped=0x0) returned 1
	[0294.137] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0xc781, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b84*=0xc781, lpOverlapped=0x0) returned 1
	[0294.142] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0294.142] CloseHandle (hObject=0x17c) returned 1
	[0294.143] CloseHandle (hObject=0x178) returned 1
	[0294.143] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12428000*, nNumberOfCharsToWrite=0x36, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x12428000*, lpNumberOfCharsWritten=0x1242283c*=0x36) returned 1
	[0294.161] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0294.163] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\7rpqDn1 v3\\1fwtW.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\7rpqdn1 v3\\1fwtw.mp4")) returned 1
	[0294.173] SetEvent (hEvent=0x174) returned 1
	[0294.181] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0294.182] SetEvent (hEvent=0x174) returned 1
	[0294.182] SetEvent (hEvent=0x104) returned 1
	[0294.182] SetEvent (hEvent=0x12c) returned 1
	[0294.182] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0294.184] SetEvent (hEvent=0x12c) returned 1
	[0294.228] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0294.229] SetEvent (hEvent=0x168) returned 1
	[0294.229] SetEvent (hEvent=0x12c) returned 1
	[0294.231] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0294.231] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0294.231] SetEvent (hEvent=0x12c) returned 1
	[0294.231] SetEvent (hEvent=0x104) returned 1
	[0294.232] SetEvent (hEvent=0x174) returned 1
	[0294.232] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0294.232] SetEvent (hEvent=0x174) returned 1
	[0294.233] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\7rpqDn1 v3\\1fwtW.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\7rpqdn1 v3\\1fwtw.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0294.234] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0294.234] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0294.252] CloseHandle (hObject=0x178) returned 1
	[0294.252] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\7rpqDn1 v3\\1fwtW.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\7rpqdn1 v3\\1fwtw.mp4")) returned 1
	[0294.258] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\7rpqDn1 v3\\dhOhNDgLcNhpw4.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\7rpqdn1 v3\\dhohndglcnhpw4.flv"), fInfoLevelId=0x0, lpFileInformation=0x124a6058 | out: lpFileInformation=0x124a6058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a49d90, ftCreationTime.dwHighDateTime=0x1d8203f, ftLastAccessTime.dwLowDateTime=0x663eb740, ftLastAccessTime.dwHighDateTime=0x1d829e7, ftLastWriteTime.dwLowDateTime=0x663eb740, ftLastWriteTime.dwHighDateTime=0x1d829e7, nFileSizeHigh=0x0, nFileSizeLow=0x6dc)) returned 1
	[0294.258] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\7rpqDn1 v3\\dhOhNDgLcNhpw4.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\7rpqdn1 v3\\dhohndglcnhpw4.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0294.258] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0294.258] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\7rpqDn1 v3\\dhOhNDgLcNhpw4.flv.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\7rpqdn1 v3\\dhohndglcnhpw4.flv.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0294.259] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0294.259] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc240 | out: pbBuffer=0x123cc240) returned 1
	[0294.259] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124121a0 | out: pbBuffer=0x124121a0) returned 1
	[0294.259] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc181 | out: pbBuffer=0x123fc181) returned 1
	[0294.259] WriteFile (in: hFile=0x17c, lpBuffer=0x12537000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x12537000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0294.262] SetEvent (hEvent=0x104) returned 1
	[0294.262] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x6dc, lpOverlapped=0x0) returned 1
	[0294.263] WriteFile (in: hFile=0x17c, lpBuffer=0x12537000*, nNumberOfBytesToWrite=0x6dc, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x12537000*, lpNumberOfBytesWritten=0x12422b88*=0x6dc, lpOverlapped=0x0) returned 1
	[0294.265] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0294.265] CloseHandle (hObject=0x17c) returned 1
	[0294.265] CloseHandle (hObject=0x178) returned 1
	[0294.265] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123c0200*, nNumberOfCharsToWrite=0x3f, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x123c0200*, lpNumberOfCharsWritten=0x1242283c*=0x3f) returned 1
	[0294.276] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\7rpqDn1 v3\\dhOhNDgLcNhpw4.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\7rpqdn1 v3\\dhohndglcnhpw4.flv")) returned 1
	[0294.278] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0294.283] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0294.283] SetEvent (hEvent=0x168) returned 1
	[0294.283] SetEvent (hEvent=0x104) returned 1
	[0294.285] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0294.285] SetEvent (hEvent=0x104) returned 1
	[0294.285] SetEvent (hEvent=0x14c) returned 1
	[0294.285] SetEvent (hEvent=0x12c) returned 1
	[0294.285] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0294.294] SetEvent (hEvent=0x168) returned 1
	[0294.294] SetEvent (hEvent=0x12c) returned 1
	[0294.325] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0294.330] SetEvent (hEvent=0x168) returned 1
	[0294.330] SetEvent (hEvent=0x12c) returned 1
	[0294.332] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0294.333] SetEvent (hEvent=0x12c) returned 1
	[0294.333] SetEvent (hEvent=0x14c) returned 1
	[0294.333] SetEvent (hEvent=0x104) returned 1
	[0294.333] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0294.333] SetEvent (hEvent=0x104) returned 1
	[0294.334] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\7rpqDn1 v3\\dhOhNDgLcNhpw4.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\7rpqdn1 v3\\dhohndglcnhpw4.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0294.335] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0294.335] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0294.354] CloseHandle (hObject=0x178) returned 1
	[0294.355] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\7rpqDn1 v3\\dhOhNDgLcNhpw4.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\7rpqdn1 v3\\dhohndglcnhpw4.flv")) returned 1
	[0294.359] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\FlVsAU0AVXL.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\flvsau0avxl.swf"), fInfoLevelId=0x0, lpFileInformation=0x124a6008 | out: lpFileInformation=0x124a6008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9491c60, ftCreationTime.dwHighDateTime=0x1d81f58, ftLastAccessTime.dwLowDateTime=0x1f43af80, ftLastAccessTime.dwHighDateTime=0x1d8207d, ftLastWriteTime.dwLowDateTime=0x1f43af80, ftLastWriteTime.dwHighDateTime=0x1d8207d, nFileSizeHigh=0x0, nFileSizeLow=0xe3f3)) returned 1
	[0294.359] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\FlVsAU0AVXL.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\flvsau0avxl.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0294.359] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0294.359] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\FlVsAU0AVXL.swf.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\flvsau0avxl.swf.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0294.360] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0294.360] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc240 | out: pbBuffer=0x123cc240) returned 1
	[0294.360] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c110 | out: pbBuffer=0x1251c110) returned 1
	[0294.360] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0301 | out: pbBuffer=0x123c0301) returned 1
	[0294.360] WriteFile (in: hFile=0x17c, lpBuffer=0x12537000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12537000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0294.363] SetEvent (hEvent=0x14c) returned 1
	[0294.363] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0xe3f3, lpOverlapped=0x0) returned 1
	[0294.365] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0xe3f3, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0xe3f3, lpOverlapped=0x0) returned 1
	[0294.372] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0294.373] CloseHandle (hObject=0x17c) returned 1
	[0294.373] CloseHandle (hObject=0x178) returned 1
	[0294.373] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123d00e0*, nNumberOfCharsToWrite=0x31, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x123d00e0*, lpNumberOfCharsWritten=0x124228a0*=0x31) returned 1
	[0294.384] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0294.385] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\FlVsAU0AVXL.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\flvsau0avxl.swf")) returned 1
	[0294.392] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0294.393] SetEvent (hEvent=0x168) returned 1
	[0294.393] SetEvent (hEvent=0x14c) returned 1
	[0294.394] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0294.395] SetEvent (hEvent=0x14c) returned 1
	[0294.395] SetEvent (hEvent=0x174) returned 1
	[0294.395] SetEvent (hEvent=0x12c) returned 1
	[0294.395] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0294.395] SetEvent (hEvent=0x12c) returned 1
	[0294.459] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0294.460] SetEvent (hEvent=0x168) returned 1
	[0294.460] SetEvent (hEvent=0x12c) returned 1
	[0294.462] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0294.463] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0294.463] SetEvent (hEvent=0x12c) returned 1
	[0294.463] SetEvent (hEvent=0x174) returned 1
	[0294.463] SetEvent (hEvent=0x14c) returned 1
	[0294.463] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0294.463] SetEvent (hEvent=0x14c) returned 1
	[0294.464] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\FlVsAU0AVXL.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\flvsau0avxl.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0294.465] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0294.465] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0294.479] CloseHandle (hObject=0x178) returned 1
	[0294.479] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\FlVsAU0AVXL.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\flvsau0avxl.swf")) returned 1
	[0294.482] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv"), fInfoLevelId=0x0, lpFileInformation=0x124a6058 | out: lpFileInformation=0x124a6058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a097310, ftCreationTime.dwHighDateTime=0x1d82534, ftLastAccessTime.dwLowDateTime=0x550da120, ftLastAccessTime.dwHighDateTime=0x1d82569, ftLastWriteTime.dwLowDateTime=0x550da120, ftLastWriteTime.dwHighDateTime=0x1d82569, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0294.483] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0294.483] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a097310, ftCreationTime.dwHighDateTime=0x1d82534, ftLastAccessTime.dwLowDateTime=0x550da120, ftLastAccessTime.dwHighDateTime=0x1d82569, ftLastWriteTime.dwLowDateTime=0x550da120, ftLastWriteTime.dwHighDateTime=0x1d82569, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffe8
	[0294.483] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a097310, ftCreationTime.dwHighDateTime=0x1d82534, ftLastAccessTime.dwLowDateTime=0x550da120, ftLastAccessTime.dwHighDateTime=0x1d82569, ftLastWriteTime.dwLowDateTime=0x550da120, ftLastWriteTime.dwHighDateTime=0x1d82569, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0294.483] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81c1d930, ftCreationTime.dwHighDateTime=0x1d81ab4, ftLastAccessTime.dwLowDateTime=0xd8e14690, ftLastAccessTime.dwHighDateTime=0x1d81caa, ftLastWriteTime.dwLowDateTime=0xd8e14690, ftLastWriteTime.dwHighDateTime=0x1d81caa, nFileSizeHigh=0x0, nFileSizeLow=0x145ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="8W7I4VBFHq.mp4", cAlternateFileName="8W7I4V~1.MP4")) returned 1
	[0294.483] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe533150, ftCreationTime.dwHighDateTime=0x1d8233d, ftLastAccessTime.dwLowDateTime=0x51d005c0, ftLastAccessTime.dwHighDateTime=0x1d824ce, ftLastWriteTime.dwLowDateTime=0x51d005c0, ftLastWriteTime.dwHighDateTime=0x1d824ce, nFileSizeHigh=0x0, nFileSizeLow=0xc430, dwReserved0=0x0, dwReserved1=0x0, cFileName="doqvPCQ.mkv", cAlternateFileName="")) returned 1
	[0294.483] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96cbea30, ftCreationTime.dwHighDateTime=0x1d8283a, ftLastAccessTime.dwLowDateTime=0x1082e1f0, ftLastAccessTime.dwHighDateTime=0x1d82938, ftLastWriteTime.dwLowDateTime=0x1082e1f0, ftLastWriteTime.dwHighDateTime=0x1d82938, nFileSizeHigh=0x0, nFileSizeLow=0x6fa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="JGWzEoQTy.mp4", cAlternateFileName="JGWZEO~1.MP4")) returned 1
	[0294.483] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92d45900, ftCreationTime.dwHighDateTime=0x1d8201d, ftLastAccessTime.dwLowDateTime=0xedd759a0, ftLastAccessTime.dwHighDateTime=0x1d8272b, ftLastWriteTime.dwLowDateTime=0xedd759a0, ftLastWriteTime.dwHighDateTime=0x1d8272b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nJZ_b-j2WnTGh", cAlternateFileName="NJZ_B-~1")) returned 1
	[0294.483] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb59acc0, ftCreationTime.dwHighDateTime=0x1d823c7, ftLastAccessTime.dwLowDateTime=0x68941870, ftLastAccessTime.dwHighDateTime=0x1d823d2, ftLastWriteTime.dwLowDateTime=0x68941870, ftLastWriteTime.dwHighDateTime=0x1d823d2, nFileSizeHigh=0x0, nFileSizeLow=0x361d, dwReserved0=0x0, dwReserved1=0x0, cFileName="rpDi7Fin-GyPcypy2aKr.swf", cAlternateFileName="RPDI7F~1.SWF")) returned 1
	[0294.483] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3e6c0, ftCreationTime.dwHighDateTime=0x1d8281d, ftLastAccessTime.dwLowDateTime=0xdebf3020, ftLastAccessTime.dwHighDateTime=0x1d8294a, ftLastWriteTime.dwLowDateTime=0xdebf3020, ftLastWriteTime.dwHighDateTime=0x1d8294a, nFileSizeHigh=0x0, nFileSizeLow=0xfd09, dwReserved0=0x0, dwReserved1=0x0, cFileName="v31yOA9wn2z.flv", cAlternateFileName="V31YOA~1.FLV")) returned 1
	[0294.484] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x474870e0, ftCreationTime.dwHighDateTime=0x1d823cc, ftLastAccessTime.dwLowDateTime=0x27cfefc0, ftLastAccessTime.dwHighDateTime=0x1d82644, ftLastWriteTime.dwLowDateTime=0x27cfefc0, ftLastWriteTime.dwHighDateTime=0x1d82644, nFileSizeHigh=0x0, nFileSizeLow=0x18733, dwReserved0=0x0, dwReserved1=0x0, cFileName="W98zQbFT99EQ3e6Yzu5.avi", cAlternateFileName="W98ZQB~1.AVI")) returned 1
	[0294.484] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0294.484] FindClose (in: hFindFile=0x79ffe8 | out: hFindFile=0x79ffe8) returned 1
	[0294.484] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0294.484] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d30 | out: lpMode=0x12422d30) returned 0
	[0294.484] WriteFile (in: hFile=0x178, lpBuffer=0x12694000*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d20, lpOverlapped=0x0 | out: lpBuffer=0x12694000*, lpNumberOfBytesWritten=0x12422d20*=0xc85, lpOverlapped=0x0) returned 1
	[0294.486] CloseHandle (hObject=0x178) returned 1
	[0294.486] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12644000*, nNumberOfCharsToWrite=0x4c, lpNumberOfCharsWritten=0x124228b0, lpReserved=0x0 | out: lpBuffer=0x12644000*, lpNumberOfCharsWritten=0x124228b0*=0x4c) returned 1
	[0294.498] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\8W7I4VBFHq.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\8w7i4vbfhq.mp4"), fInfoLevelId=0x0, lpFileInformation=0x124a62d8 | out: lpFileInformation=0x124a62d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81c1d930, ftCreationTime.dwHighDateTime=0x1d81ab4, ftLastAccessTime.dwLowDateTime=0xd8e14690, ftLastAccessTime.dwHighDateTime=0x1d81caa, ftLastWriteTime.dwLowDateTime=0xd8e14690, ftLastWriteTime.dwHighDateTime=0x1d81caa, nFileSizeHigh=0x0, nFileSizeLow=0x145ee)) returned 1
	[0294.499] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\8W7I4VBFHq.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\8w7i4vbfhq.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0294.499] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0294.499] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\8W7I4VBFHq.mp4.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\8w7i4vbfhq.mp4.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0294.500] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0294.500] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc300 | out: pbBuffer=0x123cc300) returned 1
	[0294.500] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x12412300 | out: pbBuffer=0x12412300) returned 1
	[0294.500] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0301 | out: pbBuffer=0x123c0301) returned 1
	[0294.500] WriteFile (in: hFile=0x17c, lpBuffer=0x1253d000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x1253d000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0294.525] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0294.527] SetEvent (hEvent=0x168) returned 1
	[0294.527] SetEvent (hEvent=0x174) returned 1
	[0294.527] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x145ee, lpOverlapped=0x0) returned 1
	[0294.530] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x145ee, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b84*=0x145ee, lpOverlapped=0x0) returned 1
	[0294.533] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0294.535] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0294.535] CloseHandle (hObject=0x17c) returned 1
	[0294.536] CloseHandle (hObject=0x178) returned 1
	[0294.536] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12642000*, nNumberOfCharsToWrite=0x45, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x12642000*, lpNumberOfCharsWritten=0x1242283c*=0x45) returned 1
	[0294.549] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\8W7I4VBFHq.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\8w7i4vbfhq.mp4")) returned 1
	[0294.561] SetEvent (hEvent=0x174) returned 1
	[0294.562] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0294.562] SetEvent (hEvent=0x174) returned 1
	[0294.562] SetEvent (hEvent=0x104) returned 1
	[0294.562] SetEvent (hEvent=0x12c) returned 1
	[0294.562] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0294.563] SetEvent (hEvent=0x12c) returned 1
	[0294.590] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0294.592] SetEvent (hEvent=0x168) returned 1
	[0294.592] SetEvent (hEvent=0x12c) returned 1
	[0294.593] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0294.594] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0294.594] SetEvent (hEvent=0x12c) returned 1
	[0294.594] SetEvent (hEvent=0x104) returned 1
	[0294.594] SetEvent (hEvent=0x174) returned 1
	[0294.594] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0294.595] SetEvent (hEvent=0x174) returned 1
	[0294.595] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\8W7I4VBFHq.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\8w7i4vbfhq.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0294.596] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0294.597] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0294.611] CloseHandle (hObject=0x178) returned 1
	[0294.612] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\8W7I4VBFHq.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\8w7i4vbfhq.mp4")) returned 1
	[0294.631] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\JGWzEoQTy.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\jgwzeoqty.mp4"), fInfoLevelId=0x0, lpFileInformation=0x124a6008 | out: lpFileInformation=0x124a6008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96cbea30, ftCreationTime.dwHighDateTime=0x1d8283a, ftLastAccessTime.dwLowDateTime=0x1082e1f0, ftLastAccessTime.dwHighDateTime=0x1d82938, ftLastWriteTime.dwLowDateTime=0x1082e1f0, ftLastWriteTime.dwHighDateTime=0x1d82938, nFileSizeHigh=0x0, nFileSizeLow=0x6fa5)) returned 1
	[0294.632] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\JGWzEoQTy.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\jgwzeoqty.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0294.632] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0294.632] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\JGWzEoQTy.mp4.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\jgwzeoqty.mp4.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0294.633] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0294.633] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc2c0 | out: pbBuffer=0x123cc2c0) returned 1
	[0294.633] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124121d0 | out: pbBuffer=0x124121d0) returned 1
	[0294.633] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0301 | out: pbBuffer=0x123c0301) returned 1
	[0294.633] WriteFile (in: hFile=0x17c, lpBuffer=0x12517000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x12517000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0294.638] SetEvent (hEvent=0x104) returned 1
	[0294.639] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x6fa5, lpOverlapped=0x0) returned 1
	[0294.640] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x6fa5, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b84*=0x6fa5, lpOverlapped=0x0) returned 1
	[0294.649] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0294.649] CloseHandle (hObject=0x17c) returned 1
	[0294.649] CloseHandle (hObject=0x178) returned 1
	[0294.650] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x125d0000*, nNumberOfCharsToWrite=0x44, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x125d0000*, lpNumberOfCharsWritten=0x1242283c*=0x44) returned 1
	[0294.670] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0294.672] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\JGWzEoQTy.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\jgwzeoqty.mp4")) returned 1
	[0294.696] SetEvent (hEvent=0x104) returned 1
	[0294.698] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0294.737] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0294.738] SetEvent (hEvent=0x104) returned 1
	[0294.738] SetEvent (hEvent=0x14c) returned 1
	[0294.738] SetEvent (hEvent=0x12c) returned 1
	[0294.738] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0294.739] SetEvent (hEvent=0x12c) returned 1
	[0294.779] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0294.783] SetEvent (hEvent=0x168) returned 1
	[0294.783] SetEvent (hEvent=0x12c) returned 1
	[0294.788] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0294.790] SetEvent (hEvent=0x12c) returned 1
	[0294.790] SetEvent (hEvent=0x14c) returned 1
	[0294.790] SetEvent (hEvent=0x104) returned 1
	[0294.790] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0294.791] SetEvent (hEvent=0x168) returned 1
	[0294.791] SetEvent (hEvent=0x104) returned 1
	[0294.793] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\JGWzEoQTy.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\jgwzeoqty.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0294.796] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0294.796] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0294.824] CloseHandle (hObject=0x178) returned 1
	[0294.824] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\JGWzEoQTy.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\jgwzeoqty.mp4")) returned 1
	[0294.830] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\W98zQbFT99EQ3e6Yzu5.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\w98zqbft99eq3e6yzu5.avi"), fInfoLevelId=0x0, lpFileInformation=0x124a60a8 | out: lpFileInformation=0x124a60a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x474870e0, ftCreationTime.dwHighDateTime=0x1d823cc, ftLastAccessTime.dwLowDateTime=0x27cfefc0, ftLastAccessTime.dwHighDateTime=0x1d82644, ftLastWriteTime.dwLowDateTime=0x27cfefc0, ftLastWriteTime.dwHighDateTime=0x1d82644, nFileSizeHigh=0x0, nFileSizeLow=0x18733)) returned 1
	[0294.830] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\W98zQbFT99EQ3e6Yzu5.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\w98zqbft99eq3e6yzu5.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0294.830] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0294.830] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\W98zQbFT99EQ3e6Yzu5.avi.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\w98zqbft99eq3e6yzu5.avi.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0294.831] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0294.831] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc2c0 | out: pbBuffer=0x123cc2c0) returned 1
	[0294.831] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c110 | out: pbBuffer=0x1251c110) returned 1
	[0294.831] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0301 | out: pbBuffer=0x123c0301) returned 1
	[0294.831] WriteFile (in: hFile=0x17c, lpBuffer=0x12537000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x12537000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0294.834] SetEvent (hEvent=0x14c) returned 1
	[0294.835] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x18733, lpOverlapped=0x0) returned 1
	[0294.839] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x18733, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b84*=0x18733, lpOverlapped=0x0) returned 1
	[0294.845] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0294.846] CloseHandle (hObject=0x17c) returned 1
	[0294.846] CloseHandle (hObject=0x178) returned 1
	[0294.846] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12538000*, nNumberOfCharsToWrite=0x4e, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x12538000*, lpNumberOfCharsWritten=0x1242283c*=0x4e) returned 1
	[0294.866] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0294.872] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\W98zQbFT99EQ3e6Yzu5.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\w98zqbft99eq3e6yzu5.avi")) returned 1
	[0294.885] SetEvent (hEvent=0x14c) returned 1
	[0294.887] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0294.889] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0294.889] SetEvent (hEvent=0x14c) returned 1
	[0294.889] SetEvent (hEvent=0x174) returned 1
	[0294.889] SetEvent (hEvent=0x12c) returned 1
	[0294.889] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0294.890] SetEvent (hEvent=0x168) returned 1
	[0294.890] SetEvent (hEvent=0x12c) returned 1
	[0294.925] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0294.926] SetEvent (hEvent=0x168) returned 1
	[0294.926] SetEvent (hEvent=0x12c) returned 1
	[0294.929] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0294.929] SetEvent (hEvent=0x12c) returned 1
	[0294.929] SetEvent (hEvent=0x174) returned 1
	[0294.930] SetEvent (hEvent=0x14c) returned 1
	[0294.930] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0294.930] SetEvent (hEvent=0x14c) returned 1
	[0294.931] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\W98zQbFT99EQ3e6Yzu5.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\w98zqbft99eq3e6yzu5.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0294.932] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0294.932] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0294.957] CloseHandle (hObject=0x178) returned 1
	[0294.958] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\W98zQbFT99EQ3e6Yzu5.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\w98zqbft99eq3e6yzu5.avi")) returned 1
	[0294.965] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\doqvPCQ.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\doqvpcq.mkv"), fInfoLevelId=0x0, lpFileInformation=0x124a6008 | out: lpFileInformation=0x124a6008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe533150, ftCreationTime.dwHighDateTime=0x1d8233d, ftLastAccessTime.dwLowDateTime=0x51d005c0, ftLastAccessTime.dwHighDateTime=0x1d824ce, ftLastWriteTime.dwLowDateTime=0x51d005c0, ftLastWriteTime.dwHighDateTime=0x1d824ce, nFileSizeHigh=0x0, nFileSizeLow=0xc430)) returned 1
	[0294.965] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\doqvPCQ.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\doqvpcq.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0294.966] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0294.966] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\doqvPCQ.mkv.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\doqvpcq.mkv.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0294.966] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0294.966] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc2c0 | out: pbBuffer=0x123cc2c0) returned 1
	[0294.966] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124121d0 | out: pbBuffer=0x124121d0) returned 1
	[0294.966] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0301 | out: pbBuffer=0x123c0301) returned 1
	[0294.966] WriteFile (in: hFile=0x17c, lpBuffer=0x12517000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x12517000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0294.971] SetEvent (hEvent=0x174) returned 1
	[0294.972] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0xc430, lpOverlapped=0x0) returned 1
	[0294.977] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0xc430, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b84*=0xc430, lpOverlapped=0x0) returned 1
	[0294.983] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0294.983] CloseHandle (hObject=0x17c) returned 1
	[0294.984] CloseHandle (hObject=0x178) returned 1
	[0294.984] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1250a000*, nNumberOfCharsToWrite=0x42, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x1250a000*, lpNumberOfCharsWritten=0x1242283c*=0x42) returned 1
	[0294.997] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0294.998] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\doqvPCQ.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\doqvpcq.mkv")) returned 1
	[0295.004] SetEvent (hEvent=0x174) returned 1
	[0295.005] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0295.006] SetEvent (hEvent=0x174) returned 1
	[0295.006] SetEvent (hEvent=0x104) returned 1
	[0295.006] SetEvent (hEvent=0x12c) returned 1
	[0295.006] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0295.006] SetEvent (hEvent=0x12c) returned 1
	[0295.029] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0295.031] SetEvent (hEvent=0x168) returned 1
	[0295.032] SetEvent (hEvent=0x12c) returned 1
	[0295.034] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0295.036] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0295.037] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0295.037] SetEvent (hEvent=0x12c) returned 1
	[0295.037] SetEvent (hEvent=0x104) returned 1
	[0295.037] SetEvent (hEvent=0x174) returned 1
	[0295.037] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0295.037] SetEvent (hEvent=0x174) returned 1
	[0295.038] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\doqvPCQ.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\doqvpcq.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0295.039] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0295.039] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0295.058] CloseHandle (hObject=0x178) returned 1
	[0295.058] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\doqvPCQ.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\doqvpcq.mkv")) returned 1
	[0295.063] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\nJZ_b-j2WnTGh" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\njz_b-j2wntgh"), fInfoLevelId=0x0, lpFileInformation=0x124a60a8 | out: lpFileInformation=0x124a60a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92d45900, ftCreationTime.dwHighDateTime=0x1d8201d, ftLastAccessTime.dwLowDateTime=0xedd759a0, ftLastAccessTime.dwHighDateTime=0x1d8272b, ftLastWriteTime.dwLowDateTime=0xedd759a0, ftLastWriteTime.dwHighDateTime=0x1d8272b, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0295.063] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\nJZ_b-j2WnTGh" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\njz_b-j2wntgh"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0295.063] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\nJZ_b-j2WnTGh\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92d45900, ftCreationTime.dwHighDateTime=0x1d8201d, ftLastAccessTime.dwLowDateTime=0xedd759a0, ftLastAccessTime.dwHighDateTime=0x1d8272b, ftLastWriteTime.dwLowDateTime=0xedd759a0, ftLastWriteTime.dwHighDateTime=0x1d8272b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fce8
	[0295.063] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92d45900, ftCreationTime.dwHighDateTime=0x1d8201d, ftLastAccessTime.dwLowDateTime=0xedd759a0, ftLastAccessTime.dwHighDateTime=0x1d8272b, ftLastWriteTime.dwLowDateTime=0xedd759a0, ftLastWriteTime.dwHighDateTime=0x1d8272b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0295.063] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6531ef30, ftCreationTime.dwHighDateTime=0x1d81e83, ftLastAccessTime.dwLowDateTime=0x165ff5e0, ftLastAccessTime.dwHighDateTime=0x1d826ea, ftLastWriteTime.dwLowDateTime=0x165ff5e0, ftLastWriteTime.dwHighDateTime=0x1d826ea, nFileSizeHigh=0x0, nFileSizeLow=0xf98f, dwReserved0=0x0, dwReserved1=0x0, cFileName="2Y11OcDSxOvEx.flv", cAlternateFileName="2Y11OC~1.FLV")) returned 1
	[0295.063] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e6bb60, ftCreationTime.dwHighDateTime=0x1d81dd8, ftLastAccessTime.dwLowDateTime=0x3996e9f0, ftLastAccessTime.dwHighDateTime=0x1d826b4, ftLastWriteTime.dwLowDateTime=0x3996e9f0, ftLastWriteTime.dwHighDateTime=0x1d826b4, nFileSizeHigh=0x0, nFileSizeLow=0x719e, dwReserved0=0x0, dwReserved1=0x0, cFileName="scxJpUxb7lA1Eq_AX8.swf", cAlternateFileName="SCXJPU~1.SWF")) returned 1
	[0295.063] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c180eb0, ftCreationTime.dwHighDateTime=0x1d820f0, ftLastAccessTime.dwLowDateTime=0xeb199e40, ftLastAccessTime.dwHighDateTime=0x1d82630, ftLastWriteTime.dwLowDateTime=0xeb199e40, ftLastWriteTime.dwHighDateTime=0x1d82630, nFileSizeHigh=0x0, nFileSizeLow=0x6024, dwReserved0=0x0, dwReserved1=0x0, cFileName="ufdV.mkv", cAlternateFileName="")) returned 1
	[0295.063] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156c14f0, ftCreationTime.dwHighDateTime=0x1d82345, ftLastAccessTime.dwLowDateTime=0x658d9970, ftLastAccessTime.dwHighDateTime=0x1d82a18, ftLastWriteTime.dwLowDateTime=0x658d9970, ftLastWriteTime.dwHighDateTime=0x1d82a18, nFileSizeHigh=0x0, nFileSizeLow=0x15ee9, dwReserved0=0x0, dwReserved1=0x0, cFileName="uGLkyQPuqtMoYKl4w3i.mp4", cAlternateFileName="UGLKYQ~1.MP4")) returned 1
	[0295.063] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10e58140, ftCreationTime.dwHighDateTime=0x1d826fc, ftLastAccessTime.dwLowDateTime=0xe0a62b00, ftLastAccessTime.dwHighDateTime=0x1d8280a, ftLastWriteTime.dwLowDateTime=0xe0a62b00, ftLastWriteTime.dwHighDateTime=0x1d8280a, nFileSizeHigh=0x0, nFileSizeLow=0x6f82, dwReserved0=0x0, dwReserved1=0x0, cFileName="wHqu.avi", cAlternateFileName="")) returned 1
	[0295.063] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5f490a0, ftCreationTime.dwHighDateTime=0x1d821e4, ftLastAccessTime.dwLowDateTime=0xfe0f5a00, ftLastAccessTime.dwHighDateTime=0x1d821f6, ftLastWriteTime.dwLowDateTime=0xfe0f5a00, ftLastWriteTime.dwHighDateTime=0x1d821f6, nFileSizeHigh=0x0, nFileSizeLow=0x1503d, dwReserved0=0x0, dwReserved1=0x0, cFileName="X98RUL0mi0_FGkW4-.swf", cAlternateFileName="X98RUL~1.SWF")) returned 1
	[0295.063] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0295.063] FindClose (in: hFindFile=0x79fce8 | out: hFindFile=0x79fce8) returned 1
	[0295.064] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\nJZ_b-j2WnTGh\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\njz_b-j2wntgh\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0295.064] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422ccc | out: lpMode=0x12422ccc) returned 0
	[0295.064] WriteFile (in: hFile=0x178, lpBuffer=0x12694000*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422cbc, lpOverlapped=0x0 | out: lpBuffer=0x12694000*, lpNumberOfBytesWritten=0x12422cbc*=0xc85, lpOverlapped=0x0) returned 1
	[0295.065] CloseHandle (hObject=0x178) returned 1
	[0295.066] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12536000*, nNumberOfCharsToWrite=0x5a, lpNumberOfCharsWritten=0x1242284c, lpReserved=0x0 | out: lpBuffer=0x12536000*, lpNumberOfCharsWritten=0x1242284c*=0x5a) returned 1
	[0295.077] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\nJZ_b-j2WnTGh\\2Y11OcDSxOvEx.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\njz_b-j2wntgh\\2y11ocdsxovex.flv"), fInfoLevelId=0x0, lpFileInformation=0x124a62d8 | out: lpFileInformation=0x124a62d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6531ef30, ftCreationTime.dwHighDateTime=0x1d81e83, ftLastAccessTime.dwLowDateTime=0x165ff5e0, ftLastAccessTime.dwHighDateTime=0x1d826ea, ftLastWriteTime.dwLowDateTime=0x165ff5e0, ftLastWriteTime.dwHighDateTime=0x1d826ea, nFileSizeHigh=0x0, nFileSizeLow=0xf98f)) returned 1
	[0295.077] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\nJZ_b-j2WnTGh\\2Y11OcDSxOvEx.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\njz_b-j2wntgh\\2y11ocdsxovex.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0295.078] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b48 | out: lpMode=0x12422b48) returned 0
	[0295.078] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\nJZ_b-j2WnTGh\\2Y11OcDSxOvEx.flv.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\njz_b-j2wntgh\\2y11ocdsxovex.flv.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0295.078] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422b48 | out: lpMode=0x12422b48) returned 0
	[0295.078] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc3c0 | out: pbBuffer=0x123cc3c0) returned 1
	[0295.078] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c260 | out: pbBuffer=0x1251c260) returned 1
	[0295.078] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0401 | out: pbBuffer=0x123c0401) returned 1
	[0295.078] WriteFile (in: hFile=0x17c, lpBuffer=0x125cf000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b24, lpOverlapped=0x0 | out: lpBuffer=0x125cf000*, lpNumberOfBytesWritten=0x12422b24*=0x80, lpOverlapped=0x0) returned 1
	[0295.081] SetEvent (hEvent=0x104) returned 1
	[0295.081] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b14, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b14*=0xf98f, lpOverlapped=0x0) returned 1
	[0295.083] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0xf98f, lpNumberOfBytesWritten=0x12422b20, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b20*=0xf98f, lpOverlapped=0x0) returned 1
	[0295.086] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b14, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b14*=0x0, lpOverlapped=0x0) returned 1
	[0295.086] CloseHandle (hObject=0x17c) returned 1
	[0295.087] CloseHandle (hObject=0x178) returned 1
	[0295.087] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1250a000*, nNumberOfCharsToWrite=0x56, lpNumberOfCharsWritten=0x124227d8, lpReserved=0x0 | out: lpBuffer=0x1250a000*, lpNumberOfCharsWritten=0x124227d8*=0x56) returned 1
	[0295.103] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0295.105] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\nJZ_b-j2WnTGh\\2Y11OcDSxOvEx.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\njz_b-j2wntgh\\2y11ocdsxovex.flv")) returned 1
	[0295.115] SetEvent (hEvent=0x104) returned 1
	[0295.116] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0295.116] SetEvent (hEvent=0x104) returned 1
	[0295.116] SetEvent (hEvent=0x14c) returned 1
	[0295.116] SetEvent (hEvent=0x12c) returned 1
	[0295.116] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0295.117] SetEvent (hEvent=0x12c) returned 1
	[0295.139] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0295.140] SetEvent (hEvent=0x168) returned 1
	[0295.140] SetEvent (hEvent=0x12c) returned 1
	[0295.142] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0295.142] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0295.142] SetEvent (hEvent=0x12c) returned 1
	[0295.142] SetEvent (hEvent=0x14c) returned 1
	[0295.142] SetEvent (hEvent=0x104) returned 1
	[0295.143] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0295.143] SetEvent (hEvent=0x104) returned 1
	[0295.143] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\nJZ_b-j2WnTGh\\2Y11OcDSxOvEx.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\njz_b-j2wntgh\\2y11ocdsxovex.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0295.145] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c34 | out: lpMode=0x12422c34) returned 0
	[0295.145] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c24, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c24*=0xfa000, lpOverlapped=0x0) returned 1
	[0295.163] CloseHandle (hObject=0x178) returned 1
	[0295.164] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\nJZ_b-j2WnTGh\\2Y11OcDSxOvEx.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\njz_b-j2wntgh\\2y11ocdsxovex.flv")) returned 1
	[0295.170] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\nJZ_b-j2WnTGh\\X98RUL0mi0_FGkW4-.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\njz_b-j2wntgh\\x98rul0mi0_fgkw4-.swf"), fInfoLevelId=0x0, lpFileInformation=0x124a6008 | out: lpFileInformation=0x124a6008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5f490a0, ftCreationTime.dwHighDateTime=0x1d821e4, ftLastAccessTime.dwLowDateTime=0xfe0f5a00, ftLastAccessTime.dwHighDateTime=0x1d821f6, ftLastWriteTime.dwLowDateTime=0xfe0f5a00, ftLastWriteTime.dwHighDateTime=0x1d821f6, nFileSizeHigh=0x0, nFileSizeLow=0x1503d)) returned 1
	[0295.170] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\nJZ_b-j2WnTGh\\X98RUL0mi0_FGkW4-.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\njz_b-j2wntgh\\x98rul0mi0_fgkw4-.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0295.170] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b48 | out: lpMode=0x12422b48) returned 0
	[0295.170] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\nJZ_b-j2WnTGh\\X98RUL0mi0_FGkW4-.swf.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\njz_b-j2wntgh\\x98rul0mi0_fgkw4-.swf.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0295.170] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422b48 | out: lpMode=0x12422b48) returned 0
	[0295.171] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc340 | out: pbBuffer=0x123cc340) returned 1
	[0295.171] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124121d0 | out: pbBuffer=0x124121d0) returned 1
	[0295.171] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0295.171] WriteFile (in: hFile=0x17c, lpBuffer=0x1253b000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b24, lpOverlapped=0x0 | out: lpBuffer=0x1253b000*, lpNumberOfBytesWritten=0x12422b24*=0x80, lpOverlapped=0x0) returned 1
	[0295.173] SetEvent (hEvent=0x14c) returned 1
	[0295.173] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b14, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b14*=0x1503d, lpOverlapped=0x0) returned 1
	[0295.177] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x1503d, lpNumberOfBytesWritten=0x12422b20, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b20*=0x1503d, lpOverlapped=0x0) returned 1
	[0295.180] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b14, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b14*=0x0, lpOverlapped=0x0) returned 1
	[0295.180] CloseHandle (hObject=0x17c) returned 1
	[0295.181] CloseHandle (hObject=0x178) returned 1
	[0295.181] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1253e000*, nNumberOfCharsToWrite=0x5a, lpNumberOfCharsWritten=0x124227d8, lpReserved=0x0 | out: lpBuffer=0x1253e000*, lpNumberOfCharsWritten=0x124227d8*=0x5a) returned 1
	[0295.257] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0295.266] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\nJZ_b-j2WnTGh\\X98RUL0mi0_FGkW4-.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\njz_b-j2wntgh\\x98rul0mi0_fgkw4-.swf")) returned 1
	[0295.275] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0295.278] SetEvent (hEvent=0x168) returned 1
	[0295.278] SetEvent (hEvent=0x14c) returned 1
	[0295.280] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0295.280] SetEvent (hEvent=0x14c) returned 1
	[0295.280] SetEvent (hEvent=0x174) returned 1
	[0295.280] SetEvent (hEvent=0x12c) returned 1
	[0295.280] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0295.281] SetEvent (hEvent=0x12c) returned 1
	[0295.306] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0295.307] SetEvent (hEvent=0x168) returned 1
	[0295.307] SetEvent (hEvent=0x12c) returned 1
	[0295.309] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0295.310] SetEvent (hEvent=0x12c) returned 1
	[0295.310] SetEvent (hEvent=0x174) returned 1
	[0295.310] SetEvent (hEvent=0x14c) returned 1
	[0295.310] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0295.310] SetEvent (hEvent=0x14c) returned 1
	[0295.311] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\nJZ_b-j2WnTGh\\X98RUL0mi0_FGkW4-.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\njz_b-j2wntgh\\x98rul0mi0_fgkw4-.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0295.312] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c34 | out: lpMode=0x12422c34) returned 0
	[0295.312] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c24, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c24*=0xfa000, lpOverlapped=0x0) returned 1
	[0295.332] CloseHandle (hObject=0x178) returned 1
	[0295.333] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\nJZ_b-j2WnTGh\\X98RUL0mi0_FGkW4-.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\njz_b-j2wntgh\\x98rul0mi0_fgkw4-.swf")) returned 1
	[0295.338] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\nJZ_b-j2WnTGh\\scxJpUxb7lA1Eq_AX8.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\njz_b-j2wntgh\\scxjpuxb7la1eq_ax8.swf"), fInfoLevelId=0x0, lpFileInformation=0x124a60f8 | out: lpFileInformation=0x124a60f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e6bb60, ftCreationTime.dwHighDateTime=0x1d81dd8, ftLastAccessTime.dwLowDateTime=0x3996e9f0, ftLastAccessTime.dwHighDateTime=0x1d826b4, ftLastWriteTime.dwLowDateTime=0x3996e9f0, ftLastWriteTime.dwHighDateTime=0x1d826b4, nFileSizeHigh=0x0, nFileSizeLow=0x719e)) returned 1
	[0295.339] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\nJZ_b-j2WnTGh\\scxJpUxb7lA1Eq_AX8.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\njz_b-j2wntgh\\scxjpuxb7la1eq_ax8.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0295.339] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b48 | out: lpMode=0x12422b48) returned 0
	[0295.339] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\nJZ_b-j2WnTGh\\scxJpUxb7lA1Eq_AX8.swf.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\njz_b-j2wntgh\\scxjpuxb7la1eq_ax8.swf.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0295.340] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422b48 | out: lpMode=0x12422b48) returned 0
	[0295.340] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc340 | out: pbBuffer=0x123cc340) returned 1
	[0295.340] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c130 | out: pbBuffer=0x1251c130) returned 1
	[0295.340] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0295.340] WriteFile (in: hFile=0x17c, lpBuffer=0x12509000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b24, lpOverlapped=0x0 | out: lpBuffer=0x12509000*, lpNumberOfBytesWritten=0x12422b24*=0x80, lpOverlapped=0x0) returned 1
	[0295.344] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0295.345] SetEvent (hEvent=0x168) returned 1
	[0295.345] SetEvent (hEvent=0x14c) returned 1
	[0295.345] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b14, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b14*=0x719e, lpOverlapped=0x0) returned 1
	[0295.347] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x719e, lpNumberOfBytesWritten=0x12422b20, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b20*=0x719e, lpOverlapped=0x0) returned 1
	[0295.351] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b14, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b14*=0x0, lpOverlapped=0x0) returned 1
	[0295.351] CloseHandle (hObject=0x17c) returned 1
	[0295.352] CloseHandle (hObject=0x178) returned 1
	[0295.352] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12510000*, nNumberOfCharsToWrite=0x5b, lpNumberOfCharsWritten=0x124227d8, lpReserved=0x0 | out: lpBuffer=0x12510000*, lpNumberOfCharsWritten=0x124227d8*=0x5b) returned 1
	[0295.368] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0295.370] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\nJZ_b-j2WnTGh\\scxJpUxb7lA1Eq_AX8.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\njz_b-j2wntgh\\scxjpuxb7la1eq_ax8.swf")) returned 1
	[0295.380] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0295.401] SetEvent (hEvent=0x168) returned 1
	[0295.401] SetEvent (hEvent=0x14c) returned 1
	[0295.402] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0295.404] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0295.404] SetEvent (hEvent=0x14c) returned 1
	[0295.404] SetEvent (hEvent=0x104) returned 1
	[0295.404] SetEvent (hEvent=0x12c) returned 1
	[0295.404] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0295.405] SetEvent (hEvent=0x12c) returned 1
	[0295.509] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0295.511] SetEvent (hEvent=0x168) returned 1
	[0295.511] SetEvent (hEvent=0x12c) returned 1
	[0295.513] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0295.513] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0295.514] SetEvent (hEvent=0x12c) returned 1
	[0295.514] SetEvent (hEvent=0x104) returned 1
	[0295.514] SetEvent (hEvent=0x14c) returned 1
	[0295.514] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0295.514] SetEvent (hEvent=0x14c) returned 1
	[0295.515] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\nJZ_b-j2WnTGh\\scxJpUxb7lA1Eq_AX8.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\njz_b-j2wntgh\\scxjpuxb7la1eq_ax8.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0295.515] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c34 | out: lpMode=0x12422c34) returned 0
	[0295.515] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c24, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c24*=0xfa000, lpOverlapped=0x0) returned 1
	[0295.535] CloseHandle (hObject=0x178) returned 1
	[0295.536] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\nJZ_b-j2WnTGh\\scxJpUxb7lA1Eq_AX8.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\njz_b-j2wntgh\\scxjpuxb7la1eq_ax8.swf")) returned 1
	[0295.539] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\nJZ_b-j2WnTGh\\uGLkyQPuqtMoYKl4w3i.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\njz_b-j2wntgh\\uglkyqpuqtmoykl4w3i.mp4"), fInfoLevelId=0x0, lpFileInformation=0x124a6008 | out: lpFileInformation=0x124a6008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156c14f0, ftCreationTime.dwHighDateTime=0x1d82345, ftLastAccessTime.dwLowDateTime=0x658d9970, ftLastAccessTime.dwHighDateTime=0x1d82a18, ftLastWriteTime.dwLowDateTime=0x658d9970, ftLastWriteTime.dwHighDateTime=0x1d82a18, nFileSizeHigh=0x0, nFileSizeLow=0x15ee9)) returned 1
	[0295.539] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\nJZ_b-j2WnTGh\\uGLkyQPuqtMoYKl4w3i.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\njz_b-j2wntgh\\uglkyqpuqtmoykl4w3i.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0295.539] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b48 | out: lpMode=0x12422b48) returned 0
	[0295.540] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\nJZ_b-j2WnTGh\\uGLkyQPuqtMoYKl4w3i.mp4.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\njz_b-j2wntgh\\uglkyqpuqtmoykl4w3i.mp4.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0295.540] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422b48 | out: lpMode=0x12422b48) returned 0
	[0295.540] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc340 | out: pbBuffer=0x123cc340) returned 1
	[0295.540] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124121d0 | out: pbBuffer=0x124121d0) returned 1
	[0295.540] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0295.540] WriteFile (in: hFile=0x17c, lpBuffer=0x12537000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b24, lpOverlapped=0x0 | out: lpBuffer=0x12537000*, lpNumberOfBytesWritten=0x12422b24*=0x80, lpOverlapped=0x0) returned 1
	[0295.544] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0295.546] SetEvent (hEvent=0x168) returned 1
	[0295.546] SetEvent (hEvent=0x14c) returned 1
	[0295.546] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b14, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b14*=0x15ee9, lpOverlapped=0x0) returned 1
	[0295.549] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x15ee9, lpNumberOfBytesWritten=0x12422b20, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b20*=0x15ee9, lpOverlapped=0x0) returned 1
	[0295.552] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b14, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b14*=0x0, lpOverlapped=0x0) returned 1
	[0295.553] CloseHandle (hObject=0x17c) returned 1
	[0295.553] CloseHandle (hObject=0x178) returned 1
	[0295.553] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1253e000*, nNumberOfCharsToWrite=0x5c, lpNumberOfCharsWritten=0x124227d8, lpReserved=0x0 | out: lpBuffer=0x1253e000*, lpNumberOfCharsWritten=0x124227d8*=0x5c) returned 1
	[0295.567] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0295.575] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\nJZ_b-j2WnTGh\\uGLkyQPuqtMoYKl4w3i.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\njz_b-j2wntgh\\uglkyqpuqtmoykl4w3i.mp4")) returned 1
	[0295.583] SetEvent (hEvent=0x14c) returned 1
	[0295.584] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0295.585] SetEvent (hEvent=0x14c) returned 1
	[0295.585] SetEvent (hEvent=0x174) returned 1
	[0295.585] SetEvent (hEvent=0x12c) returned 1
	[0295.585] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0295.586] SetEvent (hEvent=0x168) returned 1
	[0295.586] SetEvent (hEvent=0x12c) returned 1
	[0295.608] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0295.608] SetEvent (hEvent=0x12c) returned 1
	[0295.611] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0295.612] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0295.612] SetEvent (hEvent=0x12c) returned 1
	[0295.612] SetEvent (hEvent=0x174) returned 1
	[0295.612] SetEvent (hEvent=0x14c) returned 1
	[0295.612] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0295.612] SetEvent (hEvent=0x14c) returned 1
	[0295.613] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\nJZ_b-j2WnTGh\\uGLkyQPuqtMoYKl4w3i.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\njz_b-j2wntgh\\uglkyqpuqtmoykl4w3i.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0295.614] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c34 | out: lpMode=0x12422c34) returned 0
	[0295.614] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c24, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c24*=0xfa000, lpOverlapped=0x0) returned 1
	[0295.634] CloseHandle (hObject=0x178) returned 1
	[0295.634] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\nJZ_b-j2WnTGh\\uGLkyQPuqtMoYKl4w3i.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\njz_b-j2wntgh\\uglkyqpuqtmoykl4w3i.mp4")) returned 1
	[0295.640] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\nJZ_b-j2WnTGh\\ufdV.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\njz_b-j2wntgh\\ufdv.mkv"), fInfoLevelId=0x0, lpFileInformation=0x124a60f8 | out: lpFileInformation=0x124a60f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c180eb0, ftCreationTime.dwHighDateTime=0x1d820f0, ftLastAccessTime.dwLowDateTime=0xeb199e40, ftLastAccessTime.dwHighDateTime=0x1d82630, ftLastWriteTime.dwLowDateTime=0xeb199e40, ftLastWriteTime.dwHighDateTime=0x1d82630, nFileSizeHigh=0x0, nFileSizeLow=0x6024)) returned 1
	[0295.640] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\nJZ_b-j2WnTGh\\ufdV.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\njz_b-j2wntgh\\ufdv.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0295.640] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b48 | out: lpMode=0x12422b48) returned 0
	[0295.640] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\nJZ_b-j2WnTGh\\ufdV.mkv.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\njz_b-j2wntgh\\ufdv.mkv.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0295.641] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422b48 | out: lpMode=0x12422b48) returned 0
	[0295.641] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc340 | out: pbBuffer=0x123cc340) returned 1
	[0295.641] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c130 | out: pbBuffer=0x1251c130) returned 1
	[0295.641] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0295.641] WriteFile (in: hFile=0x17c, lpBuffer=0x12539000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b24, lpOverlapped=0x0 | out: lpBuffer=0x12539000*, lpNumberOfBytesWritten=0x12422b24*=0x80, lpOverlapped=0x0) returned 1
	[0295.644] SetEvent (hEvent=0x174) returned 1
	[0295.644] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b14, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b14*=0x6024, lpOverlapped=0x0) returned 1
	[0295.646] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x6024, lpNumberOfBytesWritten=0x12422b20, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b20*=0x6024, lpOverlapped=0x0) returned 1
	[0295.648] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b14, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b14*=0x0, lpOverlapped=0x0) returned 1
	[0295.648] CloseHandle (hObject=0x17c) returned 1
	[0295.649] CloseHandle (hObject=0x178) returned 1
	[0295.649] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1253a000*, nNumberOfCharsToWrite=0x4d, lpNumberOfCharsWritten=0x124227d8, lpReserved=0x0 | out: lpBuffer=0x1253a000*, lpNumberOfCharsWritten=0x124227d8*=0x4d) returned 1
	[0295.662] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0295.664] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\nJZ_b-j2WnTGh\\ufdV.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\njz_b-j2wntgh\\ufdv.mkv")) returned 1
	[0295.676] SetEvent (hEvent=0x174) returned 1
	[0295.678] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0295.678] SetEvent (hEvent=0x174) returned 1
	[0295.678] SetEvent (hEvent=0x104) returned 1
	[0295.678] SetEvent (hEvent=0x12c) returned 1
	[0295.678] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0295.679] SetEvent (hEvent=0x12c) returned 1
	[0295.701] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0295.703] SetEvent (hEvent=0x168) returned 1
	[0295.703] SetEvent (hEvent=0x12c) returned 1
	[0295.705] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0295.705] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0295.706] SetEvent (hEvent=0x12c) returned 1
	[0295.706] SetEvent (hEvent=0x104) returned 1
	[0295.706] SetEvent (hEvent=0x174) returned 1
	[0295.706] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0295.706] SetEvent (hEvent=0x174) returned 1
	[0295.707] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\nJZ_b-j2WnTGh\\ufdV.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\njz_b-j2wntgh\\ufdv.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0295.708] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c34 | out: lpMode=0x12422c34) returned 0
	[0295.708] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c24, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c24*=0xfa000, lpOverlapped=0x0) returned 1
	[0295.727] CloseHandle (hObject=0x178) returned 1
	[0295.728] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\nJZ_b-j2WnTGh\\ufdV.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\njz_b-j2wntgh\\ufdv.mkv")) returned 1
	[0295.732] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\nJZ_b-j2WnTGh\\wHqu.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\njz_b-j2wntgh\\whqu.avi"), fInfoLevelId=0x0, lpFileInformation=0x124a6008 | out: lpFileInformation=0x124a6008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10e58140, ftCreationTime.dwHighDateTime=0x1d826fc, ftLastAccessTime.dwLowDateTime=0xe0a62b00, ftLastAccessTime.dwHighDateTime=0x1d8280a, ftLastWriteTime.dwLowDateTime=0xe0a62b00, ftLastWriteTime.dwHighDateTime=0x1d8280a, nFileSizeHigh=0x0, nFileSizeLow=0x6f82)) returned 1
	[0295.733] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\nJZ_b-j2WnTGh\\wHqu.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\njz_b-j2wntgh\\whqu.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0295.733] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b48 | out: lpMode=0x12422b48) returned 0
	[0295.733] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\nJZ_b-j2WnTGh\\wHqu.avi.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\njz_b-j2wntgh\\whqu.avi.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0295.733] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422b48 | out: lpMode=0x12422b48) returned 0
	[0295.733] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc340 | out: pbBuffer=0x123cc340) returned 1
	[0295.733] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124121d0 | out: pbBuffer=0x124121d0) returned 1
	[0295.734] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0295.734] WriteFile (in: hFile=0x17c, lpBuffer=0x12537000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b24, lpOverlapped=0x0 | out: lpBuffer=0x12537000*, lpNumberOfBytesWritten=0x12422b24*=0x80, lpOverlapped=0x0) returned 1
	[0295.736] SetEvent (hEvent=0x104) returned 1
	[0295.736] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b14, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b14*=0x6f82, lpOverlapped=0x0) returned 1
	[0295.738] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x6f82, lpNumberOfBytesWritten=0x12422b20, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b20*=0x6f82, lpOverlapped=0x0) returned 1
	[0295.740] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b14, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b14*=0x0, lpOverlapped=0x0) returned 1
	[0295.740] CloseHandle (hObject=0x17c) returned 1
	[0295.741] CloseHandle (hObject=0x178) returned 1
	[0295.741] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1250a000*, nNumberOfCharsToWrite=0x4d, lpNumberOfCharsWritten=0x124227d8, lpReserved=0x0 | out: lpBuffer=0x1250a000*, lpNumberOfCharsWritten=0x124227d8*=0x4d) returned 1
	[0295.752] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0295.757] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\nJZ_b-j2WnTGh\\wHqu.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\njz_b-j2wntgh\\whqu.avi")) returned 1
	[0295.765] SetEvent (hEvent=0x104) returned 1
	[0295.767] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0295.768] SetEvent (hEvent=0x104) returned 1
	[0295.768] SetEvent (hEvent=0x14c) returned 1
	[0295.768] SetEvent (hEvent=0x12c) returned 1
	[0295.768] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0295.768] SetEvent (hEvent=0x12c) returned 1
	[0295.797] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0295.801] SetEvent (hEvent=0x168) returned 1
	[0295.801] SetEvent (hEvent=0x12c) returned 1
	[0295.803] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0295.803] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0295.803] SetEvent (hEvent=0x12c) returned 1
	[0295.803] SetEvent (hEvent=0x14c) returned 1
	[0295.803] SetEvent (hEvent=0x104) returned 1
	[0295.803] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0295.804] SetEvent (hEvent=0x104) returned 1
	[0295.804] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\nJZ_b-j2WnTGh\\wHqu.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\njz_b-j2wntgh\\whqu.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0295.805] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c34 | out: lpMode=0x12422c34) returned 0
	[0295.806] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c24, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c24*=0xfa000, lpOverlapped=0x0) returned 1
	[0295.824] CloseHandle (hObject=0x178) returned 1
	[0295.824] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\nJZ_b-j2WnTGh\\wHqu.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\njz_b-j2wntgh\\whqu.avi")) returned 1
	[0295.830] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\rpDi7Fin-GyPcypy2aKr.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\rpdi7fin-gypcypy2akr.swf"), fInfoLevelId=0x0, lpFileInformation=0x124a60f8 | out: lpFileInformation=0x124a60f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb59acc0, ftCreationTime.dwHighDateTime=0x1d823c7, ftLastAccessTime.dwLowDateTime=0x68941870, ftLastAccessTime.dwHighDateTime=0x1d823d2, ftLastWriteTime.dwLowDateTime=0x68941870, ftLastWriteTime.dwHighDateTime=0x1d823d2, nFileSizeHigh=0x0, nFileSizeLow=0x361d)) returned 1
	[0295.830] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\rpDi7Fin-GyPcypy2aKr.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\rpdi7fin-gypcypy2akr.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0295.830] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0295.831] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\rpDi7Fin-GyPcypy2aKr.swf.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\rpdi7fin-gypcypy2akr.swf.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0295.831] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0295.831] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc340 | out: pbBuffer=0x123cc340) returned 1
	[0295.831] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c130 | out: pbBuffer=0x1251c130) returned 1
	[0295.831] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0295.832] WriteFile (in: hFile=0x17c, lpBuffer=0x12539000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x12539000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0295.834] SetEvent (hEvent=0x14c) returned 1
	[0295.834] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x361d, lpOverlapped=0x0) returned 1
	[0295.836] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x361d, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b84*=0x361d, lpOverlapped=0x0) returned 1
	[0295.837] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0295.838] CloseHandle (hObject=0x17c) returned 1
	[0295.838] CloseHandle (hObject=0x178) returned 1
	[0295.838] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1253a000*, nNumberOfCharsToWrite=0x4f, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x1253a000*, lpNumberOfCharsWritten=0x1242283c*=0x4f) returned 1
	[0295.851] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0295.852] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\rpDi7Fin-GyPcypy2aKr.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\rpdi7fin-gypcypy2akr.swf")) returned 1
	[0295.858] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0295.861] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0295.861] SetEvent (hEvent=0x168) returned 1
	[0295.861] SetEvent (hEvent=0x14c) returned 1
	[0295.862] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0295.863] SetEvent (hEvent=0x14c) returned 1
	[0295.863] SetEvent (hEvent=0x174) returned 1
	[0295.863] SetEvent (hEvent=0x12c) returned 1
	[0295.863] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0295.863] SetEvent (hEvent=0x12c) returned 1
	[0295.883] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0295.885] SetEvent (hEvent=0x168) returned 1
	[0295.885] SetEvent (hEvent=0x12c) returned 1
	[0295.887] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0295.887] SetEvent (hEvent=0x12c) returned 1
	[0295.887] SetEvent (hEvent=0x174) returned 1
	[0295.887] SetEvent (hEvent=0x14c) returned 1
	[0295.888] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0295.888] SetEvent (hEvent=0x14c) returned 1
	[0295.889] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\rpDi7Fin-GyPcypy2aKr.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\rpdi7fin-gypcypy2akr.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0295.889] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0295.889] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0295.910] CloseHandle (hObject=0x178) returned 1
	[0295.911] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\rpDi7Fin-GyPcypy2aKr.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\rpdi7fin-gypcypy2akr.swf")) returned 1
	[0295.915] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\v31yOA9wn2z.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\v31yoa9wn2z.flv"), fInfoLevelId=0x0, lpFileInformation=0x124a6008 | out: lpFileInformation=0x124a6008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3e6c0, ftCreationTime.dwHighDateTime=0x1d8281d, ftLastAccessTime.dwLowDateTime=0xdebf3020, ftLastAccessTime.dwHighDateTime=0x1d8294a, ftLastWriteTime.dwLowDateTime=0xdebf3020, ftLastWriteTime.dwHighDateTime=0x1d8294a, nFileSizeHigh=0x0, nFileSizeLow=0xfd09)) returned 1
	[0295.916] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\v31yOA9wn2z.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\v31yoa9wn2z.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0295.916] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0295.916] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\v31yOA9wn2z.flv.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\v31yoa9wn2z.flv.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0295.916] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0295.916] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc2c0 | out: pbBuffer=0x123cc2c0) returned 1
	[0295.916] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124121d0 | out: pbBuffer=0x124121d0) returned 1
	[0295.916] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0295.917] WriteFile (in: hFile=0x17c, lpBuffer=0x12517000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x12517000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0295.919] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0295.920] SetEvent (hEvent=0x168) returned 1
	[0295.920] SetEvent (hEvent=0x14c) returned 1
	[0295.920] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0xfd09, lpOverlapped=0x0) returned 1
	[0295.922] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0xfd09, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b84*=0xfd09, lpOverlapped=0x0) returned 1
	[0295.927] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0295.927] CloseHandle (hObject=0x17c) returned 1
	[0295.928] CloseHandle (hObject=0x178) returned 1
	[0295.928] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1250a000*, nNumberOfCharsToWrite=0x46, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x1250a000*, lpNumberOfCharsWritten=0x1242283c*=0x46) returned 1
	[0295.942] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0295.946] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\v31yOA9wn2z.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\v31yoa9wn2z.flv")) returned 1
	[0295.955] SetEvent (hEvent=0x14c) returned 1
	[0295.958] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0295.959] SetEvent (hEvent=0x14c) returned 1
	[0295.959] SetEvent (hEvent=0x104) returned 1
	[0295.959] SetEvent (hEvent=0x12c) returned 1
	[0295.959] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0295.960] SetEvent (hEvent=0x12c) returned 1
	[0295.983] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0295.984] SetEvent (hEvent=0x168) returned 1
	[0295.984] SetEvent (hEvent=0x12c) returned 1
	[0295.986] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0295.986] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0295.986] SetEvent (hEvent=0x12c) returned 1
	[0295.986] SetEvent (hEvent=0x104) returned 1
	[0295.986] SetEvent (hEvent=0x14c) returned 1
	[0295.986] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0295.987] SetEvent (hEvent=0x14c) returned 1
	[0295.988] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\v31yOA9wn2z.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\v31yoa9wn2z.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0295.990] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0295.990] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0296.015] CloseHandle (hObject=0x178) returned 1
	[0296.016] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\MZCNgHXG62XR4mDH3uUV\\v31yOA9wn2z.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mzcnghxg62xr4mdh3uuv\\v31yoa9wn2z.flv")) returned 1
	[0296.020] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\TyEVRaUhmI" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\tyevrauhmi"), fInfoLevelId=0x0, lpFileInformation=0x124a60a8 | out: lpFileInformation=0x124a60a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe13acbd0, ftCreationTime.dwHighDateTime=0x1d81a12, ftLastAccessTime.dwLowDateTime=0x3c4e7e40, ftLastAccessTime.dwHighDateTime=0x1d827c4, ftLastWriteTime.dwLowDateTime=0x3c4e7e40, ftLastWriteTime.dwHighDateTime=0x1d827c4, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0296.020] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\TyEVRaUhmI" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\tyevrauhmi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0296.020] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\TyEVRaUhmI\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe13acbd0, ftCreationTime.dwHighDateTime=0x1d81a12, ftLastAccessTime.dwLowDateTime=0x3c4e7e40, ftLastAccessTime.dwHighDateTime=0x1d827c4, ftLastWriteTime.dwLowDateTime=0x3c4e7e40, ftLastWriteTime.dwHighDateTime=0x1d827c4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9e8
	[0296.021] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe13acbd0, ftCreationTime.dwHighDateTime=0x1d81a12, ftLastAccessTime.dwLowDateTime=0x3c4e7e40, ftLastAccessTime.dwHighDateTime=0x1d827c4, ftLastWriteTime.dwLowDateTime=0x3c4e7e40, ftLastWriteTime.dwHighDateTime=0x1d827c4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0296.021] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b5f18e0, ftCreationTime.dwHighDateTime=0x1d824b5, ftLastAccessTime.dwLowDateTime=0xe83f6e70, ftLastAccessTime.dwHighDateTime=0x1d8262b, ftLastWriteTime.dwLowDateTime=0xe83f6e70, ftLastWriteTime.dwHighDateTime=0x1d8262b, nFileSizeHigh=0x0, nFileSizeLow=0x9aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="79RSJrO6CpYSG-.swf", cAlternateFileName="79RSJR~1.SWF")) returned 1
	[0296.021] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2452d40, ftCreationTime.dwHighDateTime=0x1d82579, ftLastAccessTime.dwLowDateTime=0x23382530, ftLastAccessTime.dwHighDateTime=0x1d82762, ftLastWriteTime.dwLowDateTime=0x23382530, ftLastWriteTime.dwHighDateTime=0x1d82762, nFileSizeHigh=0x0, nFileSizeLow=0x1039c, dwReserved0=0x0, dwReserved1=0x0, cFileName="EzmlDq1nzs5udWAE.mkv", cAlternateFileName="EZMLDQ~1.MKV")) returned 1
	[0296.021] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc53a19b0, ftCreationTime.dwHighDateTime=0x1d82127, ftLastAccessTime.dwLowDateTime=0x290a4820, ftLastAccessTime.dwHighDateTime=0x1d8283f, ftLastWriteTime.dwLowDateTime=0x290a4820, ftLastWriteTime.dwHighDateTime=0x1d8283f, nFileSizeHigh=0x0, nFileSizeLow=0x107fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="IlHZ4uk.swf", cAlternateFileName="")) returned 1
	[0296.021] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad476db0, ftCreationTime.dwHighDateTime=0x1d81f94, ftLastAccessTime.dwLowDateTime=0x9c85a8f0, ftLastAccessTime.dwHighDateTime=0x1d8263f, ftLastWriteTime.dwLowDateTime=0x9c85a8f0, ftLastWriteTime.dwHighDateTime=0x1d8263f, nFileSizeHigh=0x0, nFileSizeLow=0xee15, dwReserved0=0x0, dwReserved1=0x0, cFileName="lUMEsvsCIpxHPlcYVQ.avi", cAlternateFileName="LUMESV~1.AVI")) returned 1
	[0296.021] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0296.021] FindClose (in: hFindFile=0x79f9e8 | out: hFindFile=0x79f9e8) returned 1
	[0296.021] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\TyEVRaUhmI\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\tyevrauhmi\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0296.022] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d30 | out: lpMode=0x12422d30) returned 0
	[0296.022] WriteFile (in: hFile=0x178, lpBuffer=0x12694000*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d20, lpOverlapped=0x0 | out: lpBuffer=0x12694000*, lpNumberOfBytesWritten=0x12422d20*=0xc85, lpOverlapped=0x0) returned 1
	[0296.023] CloseHandle (hObject=0x178) returned 1
	[0296.024] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12642120*, nNumberOfCharsToWrite=0x42, lpNumberOfCharsWritten=0x124228b0, lpReserved=0x0 | out: lpBuffer=0x12642120*, lpNumberOfCharsWritten=0x124228b0*=0x42) returned 1
	[0296.034] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\TyEVRaUhmI\\79RSJrO6CpYSG-.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\tyevrauhmi\\79rsjro6cpysg-.swf"), fInfoLevelId=0x0, lpFileInformation=0x124a6238 | out: lpFileInformation=0x124a6238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b5f18e0, ftCreationTime.dwHighDateTime=0x1d824b5, ftLastAccessTime.dwLowDateTime=0xe83f6e70, ftLastAccessTime.dwHighDateTime=0x1d8262b, ftLastWriteTime.dwLowDateTime=0xe83f6e70, ftLastWriteTime.dwHighDateTime=0x1d8262b, nFileSizeHigh=0x0, nFileSizeLow=0x9aea)) returned 1
	[0296.035] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\TyEVRaUhmI\\79RSJrO6CpYSG-.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\tyevrauhmi\\79rsjro6cpysg-.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0296.035] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0296.036] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\TyEVRaUhmI\\79RSJrO6CpYSG-.swf.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\tyevrauhmi\\79rsjro6cpysg-.swf.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0296.036] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0296.036] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc360 | out: pbBuffer=0x123cc360) returned 1
	[0296.036] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c250 | out: pbBuffer=0x1251c250) returned 1
	[0296.036] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0381 | out: pbBuffer=0x123c0381) returned 1
	[0296.037] WriteFile (in: hFile=0x17c, lpBuffer=0x1253d000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x1253d000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0296.039] SetEvent (hEvent=0x104) returned 1
	[0296.039] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x9aea, lpOverlapped=0x0) returned 1
	[0296.041] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x9aea, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b84*=0x9aea, lpOverlapped=0x0) returned 1
	[0296.045] SetEvent (hEvent=0x168) returned 1
	[0296.045] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0296.045] CloseHandle (hObject=0x17c) returned 1
	[0296.045] CloseHandle (hObject=0x178) returned 1
	[0296.045] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123c0200*, nNumberOfCharsToWrite=0x3f, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x123c0200*, lpNumberOfCharsWritten=0x1242283c*=0x3f) returned 1
	[0296.058] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\TyEVRaUhmI\\79RSJrO6CpYSG-.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\tyevrauhmi\\79rsjro6cpysg-.swf")) returned 1
	[0296.064] SetEvent (hEvent=0x174) returned 1
	[0296.065] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0296.082] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0296.082] SetEvent (hEvent=0x174) returned 1
	[0296.082] SetEvent (hEvent=0x104) returned 1
	[0296.083] SetEvent (hEvent=0x12c) returned 1
	[0296.083] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0296.087] SetEvent (hEvent=0x168) returned 1
	[0296.087] SetEvent (hEvent=0x12c) returned 1
	[0296.109] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0296.111] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0296.111] SetEvent (hEvent=0x12c) returned 1
	[0296.114] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0296.114] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0296.115] SetEvent (hEvent=0x12c) returned 1
	[0296.115] SetEvent (hEvent=0x104) returned 1
	[0296.115] SetEvent (hEvent=0x174) returned 1
	[0296.115] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0296.116] SetEvent (hEvent=0x168) returned 1
	[0296.116] SetEvent (hEvent=0x174) returned 1
	[0296.117] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\TyEVRaUhmI\\79RSJrO6CpYSG-.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\tyevrauhmi\\79rsjro6cpysg-.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0296.117] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0296.117] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0296.137] CloseHandle (hObject=0x178) returned 1
	[0296.137] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\TyEVRaUhmI\\79RSJrO6CpYSG-.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\tyevrauhmi\\79rsjro6cpysg-.swf")) returned 1
	[0296.140] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\TyEVRaUhmI\\EzmlDq1nzs5udWAE.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\tyevrauhmi\\ezmldq1nzs5udwae.mkv"), fInfoLevelId=0x0, lpFileInformation=0x124a6008 | out: lpFileInformation=0x124a6008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2452d40, ftCreationTime.dwHighDateTime=0x1d82579, ftLastAccessTime.dwLowDateTime=0x23382530, ftLastAccessTime.dwHighDateTime=0x1d82762, ftLastWriteTime.dwLowDateTime=0x23382530, ftLastWriteTime.dwHighDateTime=0x1d82762, nFileSizeHigh=0x0, nFileSizeLow=0x1039c)) returned 1
	[0296.141] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\TyEVRaUhmI\\EzmlDq1nzs5udWAE.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\tyevrauhmi\\ezmldq1nzs5udwae.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0296.141] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0296.141] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\TyEVRaUhmI\\EzmlDq1nzs5udWAE.mkv.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\tyevrauhmi\\ezmldq1nzs5udwae.mkv.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0296.141] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0296.141] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc240 | out: pbBuffer=0x123cc240) returned 1
	[0296.141] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c120 | out: pbBuffer=0x1251c120) returned 1
	[0296.142] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0401 | out: pbBuffer=0x123c0401) returned 1
	[0296.142] WriteFile (in: hFile=0x17c, lpBuffer=0x12517000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x12517000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0296.144] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0296.148] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0296.148] SetEvent (hEvent=0x174) returned 1
	[0296.148] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x1039c, lpOverlapped=0x0) returned 1
	[0296.152] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x1039c, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b84*=0x1039c, lpOverlapped=0x0) returned 1
	[0296.156] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0296.156] CloseHandle (hObject=0x17c) returned 1
	[0296.157] CloseHandle (hObject=0x178) returned 1
	[0296.157] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12536000*, nNumberOfCharsToWrite=0x41, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x12536000*, lpNumberOfCharsWritten=0x1242283c*=0x41) returned 1
	[0296.173] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0296.175] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\TyEVRaUhmI\\EzmlDq1nzs5udWAE.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\tyevrauhmi\\ezmldq1nzs5udwae.mkv")) returned 1
	[0296.191] SetEvent (hEvent=0x174) returned 1
	[0296.193] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0296.194] SetEvent (hEvent=0x174) returned 1
	[0296.194] SetEvent (hEvent=0x14c) returned 1
	[0296.194] SetEvent (hEvent=0x12c) returned 1
	[0296.194] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0296.198] SetEvent (hEvent=0x168) returned 1
	[0296.198] SetEvent (hEvent=0x12c) returned 1
	[0296.252] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0296.253] SetEvent (hEvent=0x168) returned 1
	[0296.253] SetEvent (hEvent=0x12c) returned 1
	[0296.256] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0296.257] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0296.257] SetEvent (hEvent=0x12c) returned 1
	[0296.257] SetEvent (hEvent=0x14c) returned 1
	[0296.257] SetEvent (hEvent=0x174) returned 1
	[0296.257] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0296.259] SetEvent (hEvent=0x168) returned 1
	[0296.259] SetEvent (hEvent=0x174) returned 1
	[0296.260] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\TyEVRaUhmI\\EzmlDq1nzs5udWAE.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\tyevrauhmi\\ezmldq1nzs5udwae.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0296.262] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0296.262] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0296.298] CloseHandle (hObject=0x178) returned 1
	[0296.298] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\TyEVRaUhmI\\EzmlDq1nzs5udWAE.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\tyevrauhmi\\ezmldq1nzs5udwae.mkv")) returned 1
	[0296.304] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\TyEVRaUhmI\\IlHZ4uk.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\tyevrauhmi\\ilhz4uk.swf"), fInfoLevelId=0x0, lpFileInformation=0x124a6058 | out: lpFileInformation=0x124a6058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc53a19b0, ftCreationTime.dwHighDateTime=0x1d82127, ftLastAccessTime.dwLowDateTime=0x290a4820, ftLastAccessTime.dwHighDateTime=0x1d8283f, ftLastWriteTime.dwLowDateTime=0x290a4820, ftLastWriteTime.dwHighDateTime=0x1d8283f, nFileSizeHigh=0x0, nFileSizeLow=0x107fe)) returned 1
	[0296.304] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\TyEVRaUhmI\\IlHZ4uk.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\tyevrauhmi\\ilhz4uk.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0296.305] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0296.305] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\TyEVRaUhmI\\IlHZ4uk.swf.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\tyevrauhmi\\ilhz4uk.swf.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0296.305] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0296.305] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc240 | out: pbBuffer=0x123cc240) returned 1
	[0296.305] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124121a0 | out: pbBuffer=0x124121a0) returned 1
	[0296.305] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc201 | out: pbBuffer=0x123fc201) returned 1
	[0296.306] WriteFile (in: hFile=0x17c, lpBuffer=0x12517000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x12517000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0296.309] SetEvent (hEvent=0x14c) returned 1
	[0296.309] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x107fe, lpOverlapped=0x0) returned 1
	[0296.313] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x107fe, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b84*=0x107fe, lpOverlapped=0x0) returned 1
	[0296.322] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0296.322] CloseHandle (hObject=0x17c) returned 1
	[0296.322] CloseHandle (hObject=0x178) returned 1
	[0296.322] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12428000*, nNumberOfCharsToWrite=0x38, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x12428000*, lpNumberOfCharsWritten=0x1242283c*=0x38) returned 1
	[0296.339] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0296.341] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\TyEVRaUhmI\\IlHZ4uk.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\tyevrauhmi\\ilhz4uk.swf")) returned 1
	[0296.353] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0296.354] SetEvent (hEvent=0x168) returned 1
	[0296.354] SetEvent (hEvent=0x14c) returned 1
	[0296.357] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0296.357] SetEvent (hEvent=0x14c) returned 1
	[0296.357] SetEvent (hEvent=0x104) returned 1
	[0296.357] SetEvent (hEvent=0x12c) returned 1
	[0296.357] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0296.358] SetEvent (hEvent=0x12c) returned 1
	[0296.466] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0296.468] SetEvent (hEvent=0x168) returned 1
	[0296.468] SetEvent (hEvent=0x12c) returned 1
	[0296.470] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0296.471] SetEvent (hEvent=0x12c) returned 1
	[0296.471] SetEvent (hEvent=0x104) returned 1
	[0296.471] SetEvent (hEvent=0x14c) returned 1
	[0296.471] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0296.471] SetEvent (hEvent=0x14c) returned 1
	[0296.472] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\TyEVRaUhmI\\IlHZ4uk.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\tyevrauhmi\\ilhz4uk.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0296.490] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0296.490] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0296.520] CloseHandle (hObject=0x178) returned 1
	[0296.521] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\TyEVRaUhmI\\IlHZ4uk.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\tyevrauhmi\\ilhz4uk.swf")) returned 1
	[0296.524] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\TyEVRaUhmI\\lUMEsvsCIpxHPlcYVQ.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\tyevrauhmi\\lumesvscipxhplcyvq.avi"), fInfoLevelId=0x0, lpFileInformation=0x124a6008 | out: lpFileInformation=0x124a6008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad476db0, ftCreationTime.dwHighDateTime=0x1d81f94, ftLastAccessTime.dwLowDateTime=0x9c85a8f0, ftLastAccessTime.dwHighDateTime=0x1d8263f, ftLastWriteTime.dwLowDateTime=0x9c85a8f0, ftLastWriteTime.dwHighDateTime=0x1d8263f, nFileSizeHigh=0x0, nFileSizeLow=0xee15)) returned 1
	[0296.524] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\TyEVRaUhmI\\lUMEsvsCIpxHPlcYVQ.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\tyevrauhmi\\lumesvscipxhplcyvq.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0296.525] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0296.525] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\TyEVRaUhmI\\lUMEsvsCIpxHPlcYVQ.avi.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\tyevrauhmi\\lumesvscipxhplcyvq.avi.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0296.525] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0296.525] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc240 | out: pbBuffer=0x123cc240) returned 1
	[0296.525] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c120 | out: pbBuffer=0x1251c120) returned 1
	[0296.525] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc181 | out: pbBuffer=0x123fc181) returned 1
	[0296.525] WriteFile (in: hFile=0x17c, lpBuffer=0x12517000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x12517000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0296.529] SetEvent (hEvent=0x104) returned 1
	[0296.529] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0xee15, lpOverlapped=0x0) returned 1
	[0296.532] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0xee15, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b84*=0xee15, lpOverlapped=0x0) returned 1
	[0296.536] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0296.536] CloseHandle (hObject=0x17c) returned 1
	[0296.536] CloseHandle (hObject=0x178) returned 1
	[0296.537] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x125d2000*, nNumberOfCharsToWrite=0x43, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x125d2000*, lpNumberOfCharsWritten=0x1242283c*=0x43) returned 1
	[0296.565] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0296.568] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\TyEVRaUhmI\\lUMEsvsCIpxHPlcYVQ.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\tyevrauhmi\\lumesvscipxhplcyvq.avi")) returned 1
	[0296.583] SetEvent (hEvent=0x104) returned 1
	[0296.585] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0296.588] SetEvent (hEvent=0x104) returned 1
	[0296.588] SetEvent (hEvent=0x174) returned 1
	[0296.588] SetEvent (hEvent=0x12c) returned 1
	[0296.588] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0296.589] SetEvent (hEvent=0x168) returned 1
	[0296.590] SetEvent (hEvent=0x12c) returned 1
	[0296.625] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0296.626] SetEvent (hEvent=0x12c) returned 1
	[0296.629] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0296.630] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0296.630] SetEvent (hEvent=0x12c) returned 1
	[0296.630] SetEvent (hEvent=0x174) returned 1
	[0296.630] SetEvent (hEvent=0x104) returned 1
	[0296.630] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0296.631] SetEvent (hEvent=0x104) returned 1
	[0296.632] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\TyEVRaUhmI\\lUMEsvsCIpxHPlcYVQ.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\tyevrauhmi\\lumesvscipxhplcyvq.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0296.633] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0296.633] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0296.664] CloseHandle (hObject=0x178) returned 1
	[0296.664] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\TyEVRaUhmI\\lUMEsvsCIpxHPlcYVQ.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\tyevrauhmi\\lumesvscipxhplcyvq.avi")) returned 1
	[0296.671] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct"), fInfoLevelId=0x0, lpFileInformation=0x124a6058 | out: lpFileInformation=0x124a6058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22362050, ftCreationTime.dwHighDateTime=0x1d81af2, ftLastAccessTime.dwLowDateTime=0xb7999f50, ftLastAccessTime.dwHighDateTime=0x1d82015, ftLastWriteTime.dwLowDateTime=0xb7999f50, ftLastWriteTime.dwHighDateTime=0x1d82015, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0296.671] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0296.671] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22362050, ftCreationTime.dwHighDateTime=0x1d81af2, ftLastAccessTime.dwLowDateTime=0xb7999f50, ftLastAccessTime.dwHighDateTime=0x1d82015, ftLastWriteTime.dwLowDateTime=0xb7999f50, ftLastWriteTime.dwHighDateTime=0x1d82015, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fe68
	[0296.671] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22362050, ftCreationTime.dwHighDateTime=0x1d81af2, ftLastAccessTime.dwLowDateTime=0xb7999f50, ftLastAccessTime.dwHighDateTime=0x1d82015, ftLastWriteTime.dwLowDateTime=0xb7999f50, ftLastWriteTime.dwHighDateTime=0x1d82015, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0296.671] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe7ca390, ftCreationTime.dwHighDateTime=0x1d823df, ftLastAccessTime.dwLowDateTime=0xab428d40, ftLastAccessTime.dwHighDateTime=0x1d82487, ftLastWriteTime.dwLowDateTime=0xab428d40, ftLastWriteTime.dwHighDateTime=0x1d82487, nFileSizeHigh=0x0, nFileSizeLow=0x74aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="5xP_a.mp4", cAlternateFileName="")) returned 1
	[0296.671] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2f24410, ftCreationTime.dwHighDateTime=0x1d82a10, ftLastAccessTime.dwLowDateTime=0x335ad650, ftLastAccessTime.dwHighDateTime=0x1d82a24, ftLastWriteTime.dwLowDateTime=0x335ad650, ftLastWriteTime.dwHighDateTime=0x1d82a24, nFileSizeHigh=0x0, nFileSizeLow=0x13c33, dwReserved0=0x0, dwReserved1=0x0, cFileName="a5kLr.mp4", cAlternateFileName="")) returned 1
	[0296.672] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0555030, ftCreationTime.dwHighDateTime=0x1d81c42, ftLastAccessTime.dwLowDateTime=0xb8a64160, ftLastAccessTime.dwHighDateTime=0x1d82839, ftLastWriteTime.dwLowDateTime=0xb8a64160, ftLastWriteTime.dwHighDateTime=0x1d82839, nFileSizeHigh=0x0, nFileSizeLow=0x1482b, dwReserved0=0x0, dwReserved1=0x0, cFileName="C4mOlJ-ynuC_AkIiKr.flv", cAlternateFileName="C4MOLJ~1.FLV")) returned 1
	[0296.672] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d614520, ftCreationTime.dwHighDateTime=0x1d821e2, ftLastAccessTime.dwLowDateTime=0x93469330, ftLastAccessTime.dwHighDateTime=0x1d825f9, ftLastWriteTime.dwLowDateTime=0x93469330, ftLastWriteTime.dwHighDateTime=0x1d825f9, nFileSizeHigh=0x0, nFileSizeLow=0x178c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J41bzFC8KYCZDE.mkv", cAlternateFileName="J41BZF~1.MKV")) returned 1
	[0296.672] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdb088b0, ftCreationTime.dwHighDateTime=0x1d8233d, ftLastAccessTime.dwLowDateTime=0xee4a3050, ftLastAccessTime.dwHighDateTime=0x1d829f7, ftLastWriteTime.dwLowDateTime=0xee4a3050, ftLastWriteTime.dwHighDateTime=0x1d829f7, nFileSizeHigh=0x0, nFileSizeLow=0x163d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Jr8KcH_VEoJb70 68e5Z.mp4", cAlternateFileName="JR8KCH~1.MP4")) returned 1
	[0296.672] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cde0a40, ftCreationTime.dwHighDateTime=0x1d82682, ftLastAccessTime.dwLowDateTime=0xa313a5c0, ftLastAccessTime.dwHighDateTime=0x1d827b4, ftLastWriteTime.dwLowDateTime=0xa313a5c0, ftLastWriteTime.dwHighDateTime=0x1d827b4, nFileSizeHigh=0x0, nFileSizeLow=0xbaf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NcqZF7vC.mp4", cAlternateFileName="")) returned 1
	[0296.672] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd74d6d0, ftCreationTime.dwHighDateTime=0x1d8245d, ftLastAccessTime.dwLowDateTime=0x13123520, ftLastAccessTime.dwHighDateTime=0x1d82563, ftLastWriteTime.dwLowDateTime=0x13123520, ftLastWriteTime.dwHighDateTime=0x1d82563, nFileSizeHigh=0x0, nFileSizeLow=0x161cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="qd5zjdg7pn.avi", cAlternateFileName="QD5ZJD~1.AVI")) returned 1
	[0296.672] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c08bb60, ftCreationTime.dwHighDateTime=0x1d8226f, ftLastAccessTime.dwLowDateTime=0x8fef1d30, ftLastAccessTime.dwHighDateTime=0x1d826dd, ftLastWriteTime.dwLowDateTime=0x8fef1d30, ftLastWriteTime.dwHighDateTime=0x1d826dd, nFileSizeHigh=0x0, nFileSizeLow=0x152b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qz5exDr.flv", cAlternateFileName="")) returned 1
	[0296.672] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb89d85c0, ftCreationTime.dwHighDateTime=0x1d81f9c, ftLastAccessTime.dwLowDateTime=0x9fe4bc40, ftLastAccessTime.dwHighDateTime=0x1d825ac, ftLastWriteTime.dwLowDateTime=0x9fe4bc40, ftLastWriteTime.dwHighDateTime=0x1d825ac, nFileSizeHigh=0x0, nFileSizeLow=0xf7c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="R9c6Yf4Ux.flv", cAlternateFileName="R9C6YF~1.FLV")) returned 1
	[0296.672] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x230930a0, ftCreationTime.dwHighDateTime=0x1d81c17, ftLastAccessTime.dwLowDateTime=0x579fe080, ftLastAccessTime.dwHighDateTime=0x1d81ee1, ftLastWriteTime.dwLowDateTime=0x579fe080, ftLastWriteTime.dwHighDateTime=0x1d81ee1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sMtmQH ol44 -c", cAlternateFileName="SMTMQH~1")) returned 1
	[0296.672] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0296.672] FindClose (in: hFindFile=0x79fe68 | out: hFindFile=0x79fe68) returned 1
	[0296.673] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0296.673] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d30 | out: lpMode=0x12422d30) returned 0
	[0296.674] WriteFile (in: hFile=0x178, lpBuffer=0x12694000*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d20, lpOverlapped=0x0 | out: lpBuffer=0x12694000*, lpNumberOfBytesWritten=0x12422d20*=0xc85, lpOverlapped=0x0) returned 1
	[0296.675] CloseHandle (hObject=0x178) returned 1
	[0296.676] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12644000*, nNumberOfCharsToWrite=0x4c, lpNumberOfCharsWritten=0x124228b0, lpReserved=0x0 | out: lpBuffer=0x12644000*, lpNumberOfCharsWritten=0x124228b0*=0x4c) returned 1
	[0296.690] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\5xP_a.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\5xp_a.mp4"), fInfoLevelId=0x0, lpFileInformation=0x124a6468 | out: lpFileInformation=0x124a6468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe7ca390, ftCreationTime.dwHighDateTime=0x1d823df, ftLastAccessTime.dwLowDateTime=0xab428d40, ftLastAccessTime.dwHighDateTime=0x1d82487, ftLastWriteTime.dwLowDateTime=0xab428d40, ftLastWriteTime.dwHighDateTime=0x1d82487, nFileSizeHigh=0x0, nFileSizeLow=0x74aa)) returned 1
	[0296.691] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\5xP_a.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\5xp_a.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0296.691] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0296.691] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\5xP_a.mp4.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\5xp_a.mp4.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0296.692] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0296.693] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc380 | out: pbBuffer=0x123cc380) returned 1
	[0296.693] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x12412320 | out: pbBuffer=0x12412320) returned 1
	[0296.693] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc381 | out: pbBuffer=0x123fc381) returned 1
	[0296.693] WriteFile (in: hFile=0x17c, lpBuffer=0x1253b000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x1253b000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0296.696] SetEvent (hEvent=0x174) returned 1
	[0296.696] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x74aa, lpOverlapped=0x0) returned 1
	[0296.699] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x74aa, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b84*=0x74aa, lpOverlapped=0x0) returned 1
	[0296.725] SetEvent (hEvent=0x168) returned 1
	[0296.725] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0296.726] CloseHandle (hObject=0x17c) returned 1
	[0296.726] CloseHandle (hObject=0x178) returned 1
	[0296.726] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123fc080*, nNumberOfCharsToWrite=0x40, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x123fc080*, lpNumberOfCharsWritten=0x1242283c*=0x40) returned 1
	[0296.736] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\5xP_a.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\5xp_a.mp4")) returned 1
	[0296.742] SetEvent (hEvent=0x14c) returned 1
	[0296.743] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0296.744] SetEvent (hEvent=0x14c) returned 1
	[0296.744] SetEvent (hEvent=0x174) returned 1
	[0296.744] SetEvent (hEvent=0x12c) returned 1
	[0296.744] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0296.744] SetEvent (hEvent=0x12c) returned 1
	[0296.768] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0296.769] SetEvent (hEvent=0x168) returned 1
	[0296.769] SetEvent (hEvent=0x12c) returned 1
	[0296.771] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0296.771] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0296.772] SetEvent (hEvent=0x12c) returned 1
	[0296.772] SetEvent (hEvent=0x174) returned 1
	[0296.772] SetEvent (hEvent=0x14c) returned 1
	[0296.772] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0296.772] SetEvent (hEvent=0x14c) returned 1
	[0296.773] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\5xP_a.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\5xp_a.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0296.775] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0296.775] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0296.794] CloseHandle (hObject=0x178) returned 1
	[0296.795] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\5xP_a.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\5xp_a.mp4")) returned 1
	[0296.799] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\C4mOlJ-ynuC_AkIiKr.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\c4molj-ynuc_akiikr.flv"), fInfoLevelId=0x0, lpFileInformation=0x124a6008 | out: lpFileInformation=0x124a6008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0555030, ftCreationTime.dwHighDateTime=0x1d81c42, ftLastAccessTime.dwLowDateTime=0xb8a64160, ftLastAccessTime.dwHighDateTime=0x1d82839, ftLastWriteTime.dwLowDateTime=0xb8a64160, ftLastWriteTime.dwHighDateTime=0x1d82839, nFileSizeHigh=0x0, nFileSizeLow=0x1482b)) returned 1
	[0296.799] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\C4mOlJ-ynuC_AkIiKr.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\c4molj-ynuc_akiikr.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0296.800] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0296.800] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\C4mOlJ-ynuC_AkIiKr.flv.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\c4molj-ynuc_akiikr.flv.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0296.800] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0296.800] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc2c0 | out: pbBuffer=0x123cc2c0) returned 1
	[0296.800] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124121f0 | out: pbBuffer=0x124121f0) returned 1
	[0296.800] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc181 | out: pbBuffer=0x123fc181) returned 1
	[0296.800] WriteFile (in: hFile=0x17c, lpBuffer=0x12537000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x12537000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0296.803] SetEvent (hEvent=0x174) returned 1
	[0296.803] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x1482b, lpOverlapped=0x0) returned 1
	[0296.806] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x1482b, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b84*=0x1482b, lpOverlapped=0x0) returned 1
	[0296.810] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0296.810] CloseHandle (hObject=0x17c) returned 1
	[0296.810] CloseHandle (hObject=0x178) returned 1
	[0296.810] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x125d2000*, nNumberOfCharsToWrite=0x4d, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x125d2000*, lpNumberOfCharsWritten=0x1242283c*=0x4d) returned 1
	[0296.822] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0296.829] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\C4mOlJ-ynuC_AkIiKr.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\c4molj-ynuc_akiikr.flv")) returned 1
	[0296.836] SetEvent (hEvent=0x174) returned 1
	[0296.837] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0296.838] SetEvent (hEvent=0x174) returned 1
	[0296.838] SetEvent (hEvent=0x104) returned 1
	[0296.838] SetEvent (hEvent=0x12c) returned 1
	[0296.838] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0296.838] SetEvent (hEvent=0x12c) returned 1
	[0296.861] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0296.861] SetEvent (hEvent=0x168) returned 1
	[0296.862] SetEvent (hEvent=0x12c) returned 1
	[0296.864] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0296.864] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0296.864] SetEvent (hEvent=0x12c) returned 1
	[0296.864] SetEvent (hEvent=0x104) returned 1
	[0296.864] SetEvent (hEvent=0x174) returned 1
	[0296.864] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0296.865] SetEvent (hEvent=0x174) returned 1
	[0296.865] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\C4mOlJ-ynuC_AkIiKr.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\c4molj-ynuc_akiikr.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0296.866] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0296.866] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0296.886] CloseHandle (hObject=0x178) returned 1
	[0296.887] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\C4mOlJ-ynuC_AkIiKr.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\c4molj-ynuc_akiikr.flv")) returned 1
	[0296.891] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\J41bzFC8KYCZDE.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\j41bzfc8kyczde.mkv"), fInfoLevelId=0x0, lpFileInformation=0x124a60a8 | out: lpFileInformation=0x124a60a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d614520, ftCreationTime.dwHighDateTime=0x1d821e2, ftLastAccessTime.dwLowDateTime=0x93469330, ftLastAccessTime.dwHighDateTime=0x1d825f9, ftLastWriteTime.dwLowDateTime=0x93469330, ftLastWriteTime.dwHighDateTime=0x1d825f9, nFileSizeHigh=0x0, nFileSizeLow=0x178c0)) returned 1
	[0296.891] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\J41bzFC8KYCZDE.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\j41bzfc8kyczde.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0296.891] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0296.892] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\J41bzFC8KYCZDE.mkv.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\j41bzfc8kyczde.mkv.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0296.892] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0296.892] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc2c0 | out: pbBuffer=0x123cc2c0) returned 1
	[0296.892] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c110 | out: pbBuffer=0x1251c110) returned 1
	[0296.892] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc081 | out: pbBuffer=0x123fc081) returned 1
	[0296.892] WriteFile (in: hFile=0x17c, lpBuffer=0x12537000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x12537000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0296.894] SetEvent (hEvent=0x104) returned 1
	[0296.894] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x178c0, lpOverlapped=0x0) returned 1
	[0296.898] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x178c0, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b84*=0x178c0, lpOverlapped=0x0) returned 1
	[0296.995] SetEvent (hEvent=0x168) returned 1
	[0296.995] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0296.996] CloseHandle (hObject=0x17c) returned 1
	[0296.996] CloseHandle (hObject=0x178) returned 1
	[0296.996] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12644000*, nNumberOfCharsToWrite=0x49, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x12644000*, lpNumberOfCharsWritten=0x1242283c*=0x49) returned 1
	[0297.009] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\J41bzFC8KYCZDE.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\j41bzfc8kyczde.mkv")) returned 1
	[0297.015] SetEvent (hEvent=0x14c) returned 1
	[0297.016] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0297.017] SetEvent (hEvent=0x14c) returned 1
	[0297.017] SetEvent (hEvent=0x104) returned 1
	[0297.017] SetEvent (hEvent=0x12c) returned 1
	[0297.017] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0297.017] SetEvent (hEvent=0x12c) returned 1
	[0297.044] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0297.046] SetEvent (hEvent=0x168) returned 1
	[0297.046] SetEvent (hEvent=0x12c) returned 1
	[0297.049] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0297.049] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0297.050] SetEvent (hEvent=0x12c) returned 1
	[0297.050] SetEvent (hEvent=0x104) returned 1
	[0297.050] SetEvent (hEvent=0x14c) returned 1
	[0297.050] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0297.050] SetEvent (hEvent=0x14c) returned 1
	[0297.051] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\J41bzFC8KYCZDE.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\j41bzfc8kyczde.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0297.052] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0297.052] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0297.077] CloseHandle (hObject=0x178) returned 1
	[0297.078] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\J41bzFC8KYCZDE.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\j41bzfc8kyczde.mkv")) returned 1
	[0297.085] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\Jr8KcH_VEoJb70 68e5Z.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\jr8kch_veojb70 68e5z.mp4"), fInfoLevelId=0x0, lpFileInformation=0x124a6008 | out: lpFileInformation=0x124a6008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdb088b0, ftCreationTime.dwHighDateTime=0x1d8233d, ftLastAccessTime.dwLowDateTime=0xee4a3050, ftLastAccessTime.dwHighDateTime=0x1d829f7, ftLastWriteTime.dwLowDateTime=0xee4a3050, ftLastWriteTime.dwHighDateTime=0x1d829f7, nFileSizeHigh=0x0, nFileSizeLow=0x163d)) returned 1
	[0297.085] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\Jr8KcH_VEoJb70 68e5Z.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\jr8kch_veojb70 68e5z.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0297.085] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0297.086] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\Jr8KcH_VEoJb70 68e5Z.mp4.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\jr8kch_veojb70 68e5z.mp4.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0297.086] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0297.086] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc2c0 | out: pbBuffer=0x123cc2c0) returned 1
	[0297.086] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c110 | out: pbBuffer=0x1251c110) returned 1
	[0297.086] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc081 | out: pbBuffer=0x123fc081) returned 1
	[0297.087] WriteFile (in: hFile=0x17c, lpBuffer=0x12539000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x12539000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0297.090] SetEvent (hEvent=0x104) returned 1
	[0297.090] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x163d, lpOverlapped=0x0) returned 1
	[0297.091] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x163d, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b84*=0x163d, lpOverlapped=0x0) returned 1
	[0297.094] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0297.094] CloseHandle (hObject=0x17c) returned 1
	[0297.095] CloseHandle (hObject=0x178) returned 1
	[0297.095] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1253a000*, nNumberOfCharsToWrite=0x4f, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x1253a000*, lpNumberOfCharsWritten=0x1242283c*=0x4f) returned 1
	[0297.111] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0297.113] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\Jr8KcH_VEoJb70 68e5Z.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\jr8kch_veojb70 68e5z.mp4")) returned 1
	[0297.126] SetEvent (hEvent=0x104) returned 1
	[0297.128] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0297.129] SetEvent (hEvent=0x104) returned 1
	[0297.129] SetEvent (hEvent=0x174) returned 1
	[0297.129] SetEvent (hEvent=0x12c) returned 1
	[0297.129] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0297.129] SetEvent (hEvent=0x12c) returned 1
	[0297.162] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0297.163] SetEvent (hEvent=0x168) returned 1
	[0297.163] SetEvent (hEvent=0x12c) returned 1
	[0297.165] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0297.165] SetEvent (hEvent=0x12c) returned 1
	[0297.165] SetEvent (hEvent=0x174) returned 1
	[0297.165] SetEvent (hEvent=0x104) returned 1
	[0297.165] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0297.166] SetEvent (hEvent=0x104) returned 1
	[0297.167] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\Jr8KcH_VEoJb70 68e5Z.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\jr8kch_veojb70 68e5z.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0297.168] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0297.168] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0297.187] CloseHandle (hObject=0x178) returned 1
	[0297.187] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\Jr8KcH_VEoJb70 68e5Z.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\jr8kch_veojb70 68e5z.mp4")) returned 1
	[0297.192] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\NcqZF7vC.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\ncqzf7vc.mp4"), fInfoLevelId=0x0, lpFileInformation=0x124a60a8 | out: lpFileInformation=0x124a60a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cde0a40, ftCreationTime.dwHighDateTime=0x1d82682, ftLastAccessTime.dwLowDateTime=0xa313a5c0, ftLastAccessTime.dwHighDateTime=0x1d827b4, ftLastWriteTime.dwLowDateTime=0xa313a5c0, ftLastWriteTime.dwHighDateTime=0x1d827b4, nFileSizeHigh=0x0, nFileSizeLow=0xbaf8)) returned 1
	[0297.192] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\NcqZF7vC.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\ncqzf7vc.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0297.192] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0297.193] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\NcqZF7vC.mp4.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\ncqzf7vc.mp4.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0297.193] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0297.193] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc2c0 | out: pbBuffer=0x123cc2c0) returned 1
	[0297.193] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124121f0 | out: pbBuffer=0x124121f0) returned 1
	[0297.193] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc181 | out: pbBuffer=0x123fc181) returned 1
	[0297.194] WriteFile (in: hFile=0x17c, lpBuffer=0x12517000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x12517000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0297.196] SetEvent (hEvent=0x174) returned 1
	[0297.196] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0xbaf8, lpOverlapped=0x0) returned 1
	[0297.200] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0xbaf8, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b84*=0xbaf8, lpOverlapped=0x0) returned 1
	[0297.203] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0297.203] CloseHandle (hObject=0x17c) returned 1
	[0297.204] CloseHandle (hObject=0x178) returned 1
	[0297.204] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1250a000*, nNumberOfCharsToWrite=0x43, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x1250a000*, lpNumberOfCharsWritten=0x1242283c*=0x43) returned 1
	[0297.228] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0297.231] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\NcqZF7vC.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\ncqzf7vc.mp4")) returned 1
	[0297.242] SetEvent (hEvent=0x174) returned 1
	[0297.243] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0297.246] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0297.246] SetEvent (hEvent=0x174) returned 1
	[0297.246] SetEvent (hEvent=0x14c) returned 1
	[0297.246] SetEvent (hEvent=0x12c) returned 1
	[0297.246] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0297.247] SetEvent (hEvent=0x168) returned 1
	[0297.247] SetEvent (hEvent=0x12c) returned 1
	[0297.288] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0297.290] SetEvent (hEvent=0x12c) returned 1
	[0297.293] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0297.293] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0297.294] SetEvent (hEvent=0x12c) returned 1
	[0297.294] SetEvent (hEvent=0x14c) returned 1
	[0297.294] SetEvent (hEvent=0x174) returned 1
	[0297.294] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0297.294] SetEvent (hEvent=0x174) returned 1
	[0297.295] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\NcqZF7vC.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\ncqzf7vc.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0297.302] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0297.302] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0297.332] CloseHandle (hObject=0x178) returned 1
	[0297.332] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\NcqZF7vC.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\ncqzf7vc.mp4")) returned 1
	[0297.338] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\R9c6Yf4Ux.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\r9c6yf4ux.flv"), fInfoLevelId=0x0, lpFileInformation=0x124a6008 | out: lpFileInformation=0x124a6008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb89d85c0, ftCreationTime.dwHighDateTime=0x1d81f9c, ftLastAccessTime.dwLowDateTime=0x9fe4bc40, ftLastAccessTime.dwHighDateTime=0x1d825ac, ftLastWriteTime.dwLowDateTime=0x9fe4bc40, ftLastWriteTime.dwHighDateTime=0x1d825ac, nFileSizeHigh=0x0, nFileSizeLow=0xf7c0)) returned 1
	[0297.338] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\R9c6Yf4Ux.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\r9c6yf4ux.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0297.339] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0297.339] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\R9c6Yf4Ux.flv.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\r9c6yf4ux.flv.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0297.339] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0297.339] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc2c0 | out: pbBuffer=0x123cc2c0) returned 1
	[0297.339] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c110 | out: pbBuffer=0x1251c110) returned 1
	[0297.340] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc281 | out: pbBuffer=0x123fc281) returned 1
	[0297.340] WriteFile (in: hFile=0x17c, lpBuffer=0x12517000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x12517000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0297.343] SetEvent (hEvent=0x14c) returned 1
	[0297.343] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0xf7c0, lpOverlapped=0x0) returned 1
	[0297.347] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0xf7c0, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b84*=0xf7c0, lpOverlapped=0x0) returned 1
	[0297.351] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0297.352] CloseHandle (hObject=0x17c) returned 1
	[0297.352] CloseHandle (hObject=0x178) returned 1
	[0297.352] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x125d0000*, nNumberOfCharsToWrite=0x44, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x125d0000*, lpNumberOfCharsWritten=0x1242283c*=0x44) returned 1
	[0297.370] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0297.372] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\R9c6Yf4Ux.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\r9c6yf4ux.flv")) returned 1
	[0297.385] SetEvent (hEvent=0x14c) returned 1
	[0297.387] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0297.388] SetEvent (hEvent=0x14c) returned 1
	[0297.388] SetEvent (hEvent=0x104) returned 1
	[0297.388] SetEvent (hEvent=0x12c) returned 1
	[0297.388] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0297.389] SetEvent (hEvent=0x168) returned 1
	[0297.389] SetEvent (hEvent=0x12c) returned 1
	[0297.461] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0297.483] SetEvent (hEvent=0x12c) returned 1
	[0297.484] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0297.485] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0297.485] SetEvent (hEvent=0x12c) returned 1
	[0297.485] SetEvent (hEvent=0x104) returned 1
	[0297.485] SetEvent (hEvent=0x14c) returned 1
	[0297.485] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0297.486] SetEvent (hEvent=0x14c) returned 1
	[0297.486] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\R9c6Yf4Ux.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\r9c6yf4ux.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0297.487] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0297.487] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0297.508] CloseHandle (hObject=0x178) returned 1
	[0297.508] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\R9c6Yf4Ux.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\r9c6yf4ux.flv")) returned 1
	[0297.513] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\a5kLr.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\a5klr.mp4"), fInfoLevelId=0x0, lpFileInformation=0x124a60a8 | out: lpFileInformation=0x124a60a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2f24410, ftCreationTime.dwHighDateTime=0x1d82a10, ftLastAccessTime.dwLowDateTime=0x335ad650, ftLastAccessTime.dwHighDateTime=0x1d82a24, ftLastWriteTime.dwLowDateTime=0x335ad650, ftLastWriteTime.dwHighDateTime=0x1d82a24, nFileSizeHigh=0x0, nFileSizeLow=0x13c33)) returned 1
	[0297.513] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\a5kLr.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\a5klr.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0297.513] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0297.513] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\a5kLr.mp4.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\a5klr.mp4.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0297.513] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0297.513] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc2c0 | out: pbBuffer=0x123cc2c0) returned 1
	[0297.514] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124121f0 | out: pbBuffer=0x124121f0) returned 1
	[0297.514] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc281 | out: pbBuffer=0x123fc281) returned 1
	[0297.514] WriteFile (in: hFile=0x17c, lpBuffer=0x12517000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x12517000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0297.518] SetEvent (hEvent=0x104) returned 1
	[0297.518] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x13c33, lpOverlapped=0x0) returned 1
	[0297.521] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x13c33, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b84*=0x13c33, lpOverlapped=0x0) returned 1
	[0297.525] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0297.525] CloseHandle (hObject=0x17c) returned 1
	[0297.526] CloseHandle (hObject=0x178) returned 1
	[0297.526] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123c0200*, nNumberOfCharsToWrite=0x40, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x123c0200*, lpNumberOfCharsWritten=0x1242283c*=0x40) returned 1
	[0297.539] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0297.621] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\a5kLr.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\a5klr.mp4")) returned 1
	[0297.671] SetEvent (hEvent=0x104) returned 1
	[0297.673] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0297.674] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0297.674] SetEvent (hEvent=0x104) returned 1
	[0297.674] SetEvent (hEvent=0x174) returned 1
	[0297.674] SetEvent (hEvent=0x12c) returned 1
	[0297.674] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0297.675] SetEvent (hEvent=0x12c) returned 1
	[0297.725] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0297.727] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0297.727] SetEvent (hEvent=0x168) returned 1
	[0297.727] SetEvent (hEvent=0x12c) returned 1
	[0297.730] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0297.731] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0297.731] SetEvent (hEvent=0x12c) returned 1
	[0297.731] SetEvent (hEvent=0x174) returned 1
	[0297.731] SetEvent (hEvent=0x104) returned 1
	[0297.731] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0297.731] SetEvent (hEvent=0x104) returned 1
	[0297.732] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\a5kLr.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\a5klr.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0297.734] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0297.734] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0297.764] CloseHandle (hObject=0x178) returned 1
	[0297.765] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\a5kLr.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\a5klr.mp4")) returned 1
	[0297.771] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\qd5zjdg7pn.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\qd5zjdg7pn.avi"), fInfoLevelId=0x0, lpFileInformation=0x124a6008 | out: lpFileInformation=0x124a6008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd74d6d0, ftCreationTime.dwHighDateTime=0x1d8245d, ftLastAccessTime.dwLowDateTime=0x13123520, ftLastAccessTime.dwHighDateTime=0x1d82563, ftLastWriteTime.dwLowDateTime=0x13123520, ftLastWriteTime.dwHighDateTime=0x1d82563, nFileSizeHigh=0x0, nFileSizeLow=0x161cd)) returned 1
	[0297.771] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\qd5zjdg7pn.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\qd5zjdg7pn.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0297.772] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0297.772] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\qd5zjdg7pn.avi.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\qd5zjdg7pn.avi.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0297.772] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0297.773] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc2c0 | out: pbBuffer=0x123cc2c0) returned 1
	[0297.773] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c110 | out: pbBuffer=0x1251c110) returned 1
	[0297.773] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0301 | out: pbBuffer=0x123c0301) returned 1
	[0297.773] WriteFile (in: hFile=0x17c, lpBuffer=0x12517000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x12517000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0297.776] SetEvent (hEvent=0x174) returned 1
	[0297.776] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x161cd, lpOverlapped=0x0) returned 1
	[0297.780] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x161cd, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b84*=0x161cd, lpOverlapped=0x0) returned 1
	[0297.784] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0297.784] CloseHandle (hObject=0x17c) returned 1
	[0297.786] CloseHandle (hObject=0x178) returned 1
	[0297.787] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0297.789] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0297.789] SetEvent (hEvent=0x174) returned 1
	[0297.789] SetEvent (hEvent=0x104) returned 1
	[0297.789] SetEvent (hEvent=0x12c) returned 1
	[0297.789] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0297.790] SetEvent (hEvent=0x168) returned 1
	[0297.790] SetEvent (hEvent=0x12c) returned 1
	[0297.790] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12642000*, nNumberOfCharsToWrite=0x45, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x12642000*, lpNumberOfCharsWritten=0x1242283c*=0x45) returned 1
	[0297.807] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\qd5zjdg7pn.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\qd5zjdg7pn.avi")) returned 1
	[0297.855] SetEvent (hEvent=0x104) returned 1
	[0297.864] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0297.866] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0297.866] SetEvent (hEvent=0x104) returned 1
	[0297.866] SetEvent (hEvent=0x12c) returned 1
	[0297.866] SetEvent (hEvent=0x174) returned 1
	[0297.867] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0297.867] SetEvent (hEvent=0x168) returned 1
	[0297.868] SetEvent (hEvent=0x174) returned 1
	[0297.870] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0297.873] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0297.873] SetEvent (hEvent=0x174) returned 1
	[0297.873] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0297.874] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0297.874] SetEvent (hEvent=0x174) returned 1
	[0297.874] SetEvent (hEvent=0x12c) returned 1
	[0297.874] SetEvent (hEvent=0x104) returned 1
	[0297.874] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0297.875] SetEvent (hEvent=0x104) returned 1
	[0297.875] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\qd5zjdg7pn.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\qd5zjdg7pn.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0297.876] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0297.876] WriteFile (in: hFile=0x178, lpBuffer=0x12bd6000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x12bd6000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0297.903] CloseHandle (hObject=0x178) returned 1
	[0297.904] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\qd5zjdg7pn.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\qd5zjdg7pn.avi")) returned 1
	[0297.911] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\qz5exDr.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\qz5exdr.flv"), fInfoLevelId=0x0, lpFileInformation=0x124a60a8 | out: lpFileInformation=0x124a60a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c08bb60, ftCreationTime.dwHighDateTime=0x1d8226f, ftLastAccessTime.dwLowDateTime=0x8fef1d30, ftLastAccessTime.dwHighDateTime=0x1d826dd, ftLastWriteTime.dwLowDateTime=0x8fef1d30, ftLastWriteTime.dwHighDateTime=0x1d826dd, nFileSizeHigh=0x0, nFileSizeLow=0x152b0)) returned 1
	[0297.911] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\qz5exDr.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\qz5exdr.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0297.912] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0297.912] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\qz5exDr.flv.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\qz5exdr.flv.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0297.912] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0297.912] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc2c0 | out: pbBuffer=0x123cc2c0) returned 1
	[0297.912] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c110 | out: pbBuffer=0x1251c110) returned 1
	[0297.912] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0301 | out: pbBuffer=0x123c0301) returned 1
	[0297.913] WriteFile (in: hFile=0x17c, lpBuffer=0x12517000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x12517000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0297.917] SetEvent (hEvent=0x12c) returned 1
	[0297.917] ReadFile (in: hFile=0x178, lpBuffer=0x12cd0000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12cd0000*, lpNumberOfBytesRead=0x12422b78*=0x152b0, lpOverlapped=0x0) returned 1
	[0297.921] WriteFile (in: hFile=0x17c, lpBuffer=0x12cd0000*, nNumberOfBytesToWrite=0x152b0, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12cd0000*, lpNumberOfBytesWritten=0x12422b84*=0x152b0, lpOverlapped=0x0) returned 1
	[0297.927] ReadFile (in: hFile=0x178, lpBuffer=0x12cd0000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12cd0000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0297.927] CloseHandle (hObject=0x17c) returned 1
	[0297.927] CloseHandle (hObject=0x178) returned 1
	[0297.928] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x125d0000*, nNumberOfCharsToWrite=0x42, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x125d0000*, lpNumberOfCharsWritten=0x1242283c*=0x42) returned 1
	[0297.942] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0297.945] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\qz5exDr.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\qz5exdr.flv")) returned 1
	[0297.954] SetEvent (hEvent=0x12c) returned 1
	[0297.956] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0297.957] SetEvent (hEvent=0x12c) returned 1
	[0297.957] SetEvent (hEvent=0x14c) returned 1
	[0297.957] SetEvent (hEvent=0x174) returned 1
	[0297.957] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0297.957] SetEvent (hEvent=0x174) returned 1
	[0297.996] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0297.996] SetEvent (hEvent=0x168) returned 1
	[0297.997] SetEvent (hEvent=0x174) returned 1
	[0297.999] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0298.000] SetEvent (hEvent=0x174) returned 1
	[0298.000] SetEvent (hEvent=0x14c) returned 1
	[0298.000] SetEvent (hEvent=0x12c) returned 1
	[0298.000] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0298.001] SetEvent (hEvent=0x12c) returned 1
	[0298.001] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\qz5exDr.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\qz5exdr.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0298.002] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0298.002] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0298.027] CloseHandle (hObject=0x178) returned 1
	[0298.028] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\qz5exDr.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\qz5exdr.flv")) returned 1
	[0298.034] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\sMtmQH ol44 -c" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\smtmqh ol44 -c"), fInfoLevelId=0x0, lpFileInformation=0x124a6008 | out: lpFileInformation=0x124a6008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x230930a0, ftCreationTime.dwHighDateTime=0x1d81c17, ftLastAccessTime.dwLowDateTime=0x579fe080, ftLastAccessTime.dwHighDateTime=0x1d81ee1, ftLastWriteTime.dwLowDateTime=0x579fe080, ftLastWriteTime.dwHighDateTime=0x1d81ee1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0298.035] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\sMtmQH ol44 -c" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\smtmqh ol44 -c"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0298.035] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\sMtmQH ol44 -c\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x230930a0, ftCreationTime.dwHighDateTime=0x1d81c17, ftLastAccessTime.dwLowDateTime=0x579fe080, ftLastAccessTime.dwHighDateTime=0x1d81ee1, ftLastWriteTime.dwLowDateTime=0x579fe080, ftLastWriteTime.dwHighDateTime=0x1d81ee1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ff68
	[0298.035] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x230930a0, ftCreationTime.dwHighDateTime=0x1d81c17, ftLastAccessTime.dwLowDateTime=0x579fe080, ftLastAccessTime.dwHighDateTime=0x1d81ee1, ftLastWriteTime.dwLowDateTime=0x579fe080, ftLastWriteTime.dwHighDateTime=0x1d81ee1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0298.035] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x157854c0, ftCreationTime.dwHighDateTime=0x1d82036, ftLastAccessTime.dwLowDateTime=0xbbfb3af0, ftLastAccessTime.dwHighDateTime=0x1d82366, ftLastWriteTime.dwLowDateTime=0xbbfb3af0, ftLastWriteTime.dwHighDateTime=0x1d82366, nFileSizeHigh=0x0, nFileSizeLow=0x5486, dwReserved0=0x0, dwReserved1=0x0, cFileName="nqj57_351LVanv4t.mp4", cAlternateFileName="NQJ57_~1.MP4")) returned 1
	[0298.035] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0298.035] FindClose (in: hFindFile=0x79ff68 | out: hFindFile=0x79ff68) returned 1
	[0298.036] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\sMtmQH ol44 -c\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\smtmqh ol44 -c\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0298.036] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422ccc | out: lpMode=0x12422ccc) returned 0
	[0298.036] WriteFile (in: hFile=0x178, lpBuffer=0x12694000*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422cbc, lpOverlapped=0x0 | out: lpBuffer=0x12694000*, lpNumberOfBytesWritten=0x12422cbc*=0xc85, lpOverlapped=0x0) returned 1
	[0298.038] CloseHandle (hObject=0x178) returned 1
	[0298.038] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12516000*, nNumberOfCharsToWrite=0x5b, lpNumberOfCharsWritten=0x1242284c, lpReserved=0x0 | out: lpBuffer=0x12516000*, lpNumberOfCharsWritten=0x1242284c*=0x5b) returned 1
	[0298.052] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\sMtmQH ol44 -c\\nqj57_351LVanv4t.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\smtmqh ol44 -c\\nqj57_351lvanv4t.mp4"), fInfoLevelId=0x0, lpFileInformation=0x124a6148 | out: lpFileInformation=0x124a6148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x157854c0, ftCreationTime.dwHighDateTime=0x1d82036, ftLastAccessTime.dwLowDateTime=0xbbfb3af0, ftLastAccessTime.dwHighDateTime=0x1d82366, ftLastWriteTime.dwLowDateTime=0xbbfb3af0, ftLastWriteTime.dwHighDateTime=0x1d82366, nFileSizeHigh=0x0, nFileSizeLow=0x5486)) returned 1
	[0298.053] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\sMtmQH ol44 -c\\nqj57_351LVanv4t.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\smtmqh ol44 -c\\nqj57_351lvanv4t.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0298.053] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b48 | out: lpMode=0x12422b48) returned 0
	[0298.053] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\sMtmQH ol44 -c\\nqj57_351LVanv4t.mp4.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\smtmqh ol44 -c\\nqj57_351lvanv4t.mp4.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0298.060] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422b48 | out: lpMode=0x12422b48) returned 0
	[0298.060] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc340 | out: pbBuffer=0x123cc340) returned 1
	[0298.060] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x12412320 | out: pbBuffer=0x12412320) returned 1
	[0298.060] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0301 | out: pbBuffer=0x123c0301) returned 1
	[0298.060] WriteFile (in: hFile=0x17c, lpBuffer=0x12507000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b24, lpOverlapped=0x0 | out: lpBuffer=0x12507000*, lpNumberOfBytesWritten=0x12422b24*=0x80, lpOverlapped=0x0) returned 1
	[0298.064] SetEvent (hEvent=0x14c) returned 1
	[0298.064] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b14, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b14*=0x5486, lpOverlapped=0x0) returned 1
	[0298.066] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x5486, lpNumberOfBytesWritten=0x12422b20, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b20*=0x5486, lpOverlapped=0x0) returned 1
	[0298.069] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b14, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b14*=0x0, lpOverlapped=0x0) returned 1
	[0298.069] CloseHandle (hObject=0x17c) returned 1
	[0298.070] CloseHandle (hObject=0x178) returned 1
	[0298.070] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x125d2000*, nNumberOfCharsToWrite=0x5a, lpNumberOfCharsWritten=0x124227d8, lpReserved=0x0 | out: lpBuffer=0x125d2000*, lpNumberOfCharsWritten=0x124227d8*=0x5a) returned 1
	[0298.091] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0298.093] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\sMtmQH ol44 -c\\nqj57_351LVanv4t.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\smtmqh ol44 -c\\nqj57_351lvanv4t.mp4")) returned 1
	[0298.102] SetEvent (hEvent=0x14c) returned 1
	[0298.106] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0298.108] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0298.108] SetEvent (hEvent=0x14c) returned 1
	[0298.108] SetEvent (hEvent=0x104) returned 1
	[0298.108] SetEvent (hEvent=0x174) returned 1
	[0298.108] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0298.109] SetEvent (hEvent=0x168) returned 1
	[0298.109] SetEvent (hEvent=0x174) returned 1
	[0298.139] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0298.140] SetEvent (hEvent=0x168) returned 1
	[0298.140] SetEvent (hEvent=0x174) returned 1
	[0298.143] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0298.143] SetEvent (hEvent=0x174) returned 1
	[0298.143] SetEvent (hEvent=0x104) returned 1
	[0298.143] SetEvent (hEvent=0x14c) returned 1
	[0298.143] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0298.144] SetEvent (hEvent=0x14c) returned 1
	[0298.145] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\sMtmQH ol44 -c\\nqj57_351LVanv4t.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\smtmqh ol44 -c\\nqj57_351lvanv4t.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0298.146] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c34 | out: lpMode=0x12422c34) returned 0
	[0298.146] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c24, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c24*=0xfa000, lpOverlapped=0x0) returned 1
	[0298.171] CloseHandle (hObject=0x178) returned 1
	[0298.172] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\XwBoItD2EDdRnLbEsBcT\\sMtmQH ol44 -c\\nqj57_351LVanv4t.mp4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\xwboitd2eddrnlbesbct\\smtmqh ol44 -c\\nqj57_351lvanv4t.mp4")) returned 1
	[0298.179] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\a5Xvi1981.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\a5xvi1981.flv"), fInfoLevelId=0x0, lpFileInformation=0x124a60a8 | out: lpFileInformation=0x124a60a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x974e0d10, ftCreationTime.dwHighDateTime=0x1d81f27, ftLastAccessTime.dwLowDateTime=0x92991640, ftLastAccessTime.dwHighDateTime=0x1d81f84, ftLastWriteTime.dwLowDateTime=0x92991640, ftLastWriteTime.dwHighDateTime=0x1d81f84, nFileSizeHigh=0x0, nFileSizeLow=0x135f9)) returned 1
	[0298.179] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\a5Xvi1981.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\a5xvi1981.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0298.180] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0298.180] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\a5Xvi1981.flv.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\a5xvi1981.flv.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0298.180] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0298.181] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc300 | out: pbBuffer=0x123cc300) returned 1
	[0298.181] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c110 | out: pbBuffer=0x1251c110) returned 1
	[0298.181] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0298.181] WriteFile (in: hFile=0x17c, lpBuffer=0x12537000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12537000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0298.184] SetEvent (hEvent=0x104) returned 1
	[0298.184] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x135f9, lpOverlapped=0x0) returned 1
	[0298.188] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x135f9, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0x135f9, lpOverlapped=0x0) returned 1
	[0298.192] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0298.192] CloseHandle (hObject=0x17c) returned 1
	[0298.192] CloseHandle (hObject=0x178) returned 1
	[0298.192] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12538000*, nNumberOfCharsToWrite=0x2f, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x12538000*, lpNumberOfCharsWritten=0x124228a0*=0x2f) returned 1
	[0298.210] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0298.212] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\a5Xvi1981.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\a5xvi1981.flv")) returned 1
	[0298.244] SetEvent (hEvent=0x104) returned 1
	[0298.258] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0298.260] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0298.260] SetEvent (hEvent=0x104) returned 1
	[0298.260] SetEvent (hEvent=0x12c) returned 1
	[0298.260] SetEvent (hEvent=0x174) returned 1
	[0298.260] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0298.262] SetEvent (hEvent=0x168) returned 1
	[0298.262] SetEvent (hEvent=0x174) returned 1
	[0298.296] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0298.296] SetEvent (hEvent=0x174) returned 1
	[0298.299] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0298.300] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0298.300] SetEvent (hEvent=0x174) returned 1
	[0298.300] SetEvent (hEvent=0x12c) returned 1
	[0298.300] SetEvent (hEvent=0x104) returned 1
	[0298.300] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0298.301] SetEvent (hEvent=0x168) returned 1
	[0298.301] SetEvent (hEvent=0x104) returned 1
	[0298.302] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\a5Xvi1981.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\a5xvi1981.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0298.303] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0298.304] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0298.330] CloseHandle (hObject=0x178) returned 1
	[0298.331] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\a5Xvi1981.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\a5xvi1981.flv")) returned 1
	[0298.337] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\dR7bCt_DEjsDVvvsD4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\dr7bct_dejsdvvvsd4"), fInfoLevelId=0x0, lpFileInformation=0x124a6008 | out: lpFileInformation=0x124a6008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x298a830, ftCreationTime.dwHighDateTime=0x1d81c50, ftLastAccessTime.dwLowDateTime=0xac10dc10, ftLastAccessTime.dwHighDateTime=0x1d8257f, ftLastWriteTime.dwLowDateTime=0xac10dc10, ftLastWriteTime.dwHighDateTime=0x1d8257f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0298.337] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\dR7bCt_DEjsDVvvsD4" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\dr7bct_dejsdvvvsd4"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0298.337] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\dR7bCt_DEjsDVvvsD4\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x298a830, ftCreationTime.dwHighDateTime=0x1d81c50, ftLastAccessTime.dwLowDateTime=0xac10dc10, ftLastAccessTime.dwHighDateTime=0x1d8257f, ftLastWriteTime.dwLowDateTime=0xac10dc10, ftLastWriteTime.dwHighDateTime=0x1d8257f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0028
	[0298.338] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x298a830, ftCreationTime.dwHighDateTime=0x1d81c50, ftLastAccessTime.dwLowDateTime=0xac10dc10, ftLastAccessTime.dwHighDateTime=0x1d8257f, ftLastWriteTime.dwLowDateTime=0xac10dc10, ftLastWriteTime.dwHighDateTime=0x1d8257f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0298.338] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5155bf20, ftCreationTime.dwHighDateTime=0x1d81b2a, ftLastAccessTime.dwLowDateTime=0xd8e94700, ftLastAccessTime.dwHighDateTime=0x1d81e85, ftLastWriteTime.dwLowDateTime=0xd8e94700, ftLastWriteTime.dwHighDateTime=0x1d81e85, nFileSizeHigh=0x0, nFileSizeLow=0x4723, dwReserved0=0x0, dwReserved1=0x0, cFileName="b0Mx6X21CscLFf9nku6Q.mkv", cAlternateFileName="B0MX6X~1.MKV")) returned 1
	[0298.338] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79774b00, ftCreationTime.dwHighDateTime=0x1d82060, ftLastAccessTime.dwLowDateTime=0x8c74c70, ftLastAccessTime.dwHighDateTime=0x1d82885, ftLastWriteTime.dwLowDateTime=0x8c74c70, ftLastWriteTime.dwHighDateTime=0x1d82885, nFileSizeHigh=0x0, nFileSizeLow=0x53e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ldlIbe2U6VK_y.avi", cAlternateFileName="LDLIBE~1.AVI")) returned 1
	[0298.338] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0298.338] FindClose (in: hFindFile=0x7a0028 | out: hFindFile=0x7a0028) returned 1
	[0298.338] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\dR7bCt_DEjsDVvvsD4\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\dr7bct_dejsdvvvsd4\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0298.342] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d30 | out: lpMode=0x12422d30) returned 0
	[0298.342] WriteFile (in: hFile=0x178, lpBuffer=0x12694000*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d20, lpOverlapped=0x0 | out: lpBuffer=0x12694000*, lpNumberOfBytesWritten=0x12422d20*=0xc85, lpOverlapped=0x0) returned 1
	[0298.343] CloseHandle (hObject=0x178) returned 1
	[0298.344] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12644000*, nNumberOfCharsToWrite=0x4a, lpNumberOfCharsWritten=0x124228b0, lpReserved=0x0 | out: lpBuffer=0x12644000*, lpNumberOfCharsWritten=0x124228b0*=0x4a) returned 1
	[0298.363] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\dR7bCt_DEjsDVvvsD4\\b0Mx6X21CscLFf9nku6Q.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\dr7bct_dejsdvvvsd4\\b0mx6x21csclff9nku6q.mkv"), fInfoLevelId=0x0, lpFileInformation=0x124a6148 | out: lpFileInformation=0x124a6148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5155bf20, ftCreationTime.dwHighDateTime=0x1d81b2a, ftLastAccessTime.dwLowDateTime=0xd8e94700, ftLastAccessTime.dwHighDateTime=0x1d81e85, ftLastWriteTime.dwLowDateTime=0xd8e94700, ftLastWriteTime.dwHighDateTime=0x1d81e85, nFileSizeHigh=0x0, nFileSizeLow=0x4723)) returned 1
	[0298.363] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\dR7bCt_DEjsDVvvsD4\\b0Mx6X21CscLFf9nku6Q.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\dr7bct_dejsdvvvsd4\\b0mx6x21csclff9nku6q.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0298.364] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0298.364] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\dR7bCt_DEjsDVvvsD4\\b0Mx6X21CscLFf9nku6Q.mkv.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\dr7bct_dejsdvvvsd4\\b0mx6x21csclff9nku6q.mkv.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0298.364] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0298.364] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc2c0 | out: pbBuffer=0x123cc2c0) returned 1
	[0298.364] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124122d0 | out: pbBuffer=0x124122d0) returned 1
	[0298.364] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0301 | out: pbBuffer=0x123c0301) returned 1
	[0298.365] WriteFile (in: hFile=0x17c, lpBuffer=0x125cf000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x125cf000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0298.368] SetEvent (hEvent=0x12c) returned 1
	[0298.368] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x4723, lpOverlapped=0x0) returned 1
	[0298.370] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x4723, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b84*=0x4723, lpOverlapped=0x0) returned 1
	[0298.378] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0298.378] CloseHandle (hObject=0x17c) returned 1
	[0298.379] CloseHandle (hObject=0x178) returned 1
	[0298.379] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12508000*, nNumberOfCharsToWrite=0x4d, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x12508000*, lpNumberOfCharsWritten=0x1242283c*=0x4d) returned 1
	[0298.399] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0298.401] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\dR7bCt_DEjsDVvvsD4\\b0Mx6X21CscLFf9nku6Q.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\dr7bct_dejsdvvvsd4\\b0mx6x21csclff9nku6q.mkv")) returned 1
	[0298.463] SetEvent (hEvent=0x12c) returned 1
	[0298.464] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x102
	[0298.467] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0298.467] SetEvent (hEvent=0x12c) returned 1
	[0298.467] SetEvent (hEvent=0x14c) returned 1
	[0298.467] SetEvent (hEvent=0x174) returned 1
	[0298.467] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0298.468] SetEvent (hEvent=0x168) returned 1
	[0298.468] SetEvent (hEvent=0x174) returned 1
	[0298.503] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0298.503] SetEvent (hEvent=0x174) returned 1
	[0298.506] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0298.508] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0298.508] SetEvent (hEvent=0x174) returned 1
	[0298.508] SetEvent (hEvent=0x14c) returned 1
	[0298.508] SetEvent (hEvent=0x12c) returned 1
	[0298.508] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0298.508] SetEvent (hEvent=0x12c) returned 1
	[0298.509] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\dR7bCt_DEjsDVvvsD4\\b0Mx6X21CscLFf9nku6Q.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\dr7bct_dejsdvvvsd4\\b0mx6x21csclff9nku6q.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0298.511] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0298.511] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0298.535] CloseHandle (hObject=0x178) returned 1
	[0298.536] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\dR7bCt_DEjsDVvvsD4\\b0Mx6X21CscLFf9nku6Q.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\dr7bct_dejsdvvvsd4\\b0mx6x21csclff9nku6q.mkv")) returned 1
	[0298.573] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\dR7bCt_DEjsDVvvsD4\\ldlIbe2U6VK_y.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\dr7bct_dejsdvvvsd4\\ldlibe2u6vk_y.avi"), fInfoLevelId=0x0, lpFileInformation=0x124a6058 | out: lpFileInformation=0x124a6058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79774b00, ftCreationTime.dwHighDateTime=0x1d82060, ftLastAccessTime.dwLowDateTime=0x8c74c70, ftLastAccessTime.dwHighDateTime=0x1d82885, ftLastWriteTime.dwLowDateTime=0x8c74c70, ftLastWriteTime.dwHighDateTime=0x1d82885, nFileSizeHigh=0x0, nFileSizeLow=0x53e3)) returned 1
	[0298.573] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\dR7bCt_DEjsDVvvsD4\\ldlIbe2U6VK_y.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\dr7bct_dejsdvvvsd4\\ldlibe2u6vk_y.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0298.573] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0298.573] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\dR7bCt_DEjsDVvvsD4\\ldlIbe2U6VK_y.avi.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\dr7bct_dejsdvvvsd4\\ldlibe2u6vk_y.avi.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0298.574] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0298.574] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc280 | out: pbBuffer=0x123cc280) returned 1
	[0298.574] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c110 | out: pbBuffer=0x1251c110) returned 1
	[0298.574] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0298.574] WriteFile (in: hFile=0x17c, lpBuffer=0x12537000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x12537000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0298.581] SetEvent (hEvent=0x14c) returned 1
	[0298.581] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x53e3, lpOverlapped=0x0) returned 1
	[0298.582] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x53e3, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b84*=0x53e3, lpOverlapped=0x0) returned 1
	[0298.588] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0298.588] CloseHandle (hObject=0x17c) returned 1
	[0298.589] CloseHandle (hObject=0x178) returned 1
	[0298.589] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1250a000*, nNumberOfCharsToWrite=0x46, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x1250a000*, lpNumberOfCharsWritten=0x1242283c*=0x46) returned 1
	[0298.601] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0298.607] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\dR7bCt_DEjsDVvvsD4\\ldlIbe2U6VK_y.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\dr7bct_dejsdvvvsd4\\ldlibe2u6vk_y.avi")) returned 1
	[0298.613] SetEvent (hEvent=0x14c) returned 1
	[0298.615] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0298.616] SetEvent (hEvent=0x14c) returned 1
	[0298.616] SetEvent (hEvent=0x104) returned 1
	[0298.616] SetEvent (hEvent=0x174) returned 1
	[0298.616] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0298.616] SetEvent (hEvent=0x168) returned 1
	[0298.616] SetEvent (hEvent=0x174) returned 1
	[0298.650] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0298.652] SetEvent (hEvent=0x174) returned 1
	[0298.656] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0298.660] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0298.661] SetEvent (hEvent=0x174) returned 1
	[0298.661] SetEvent (hEvent=0x104) returned 1
	[0298.661] SetEvent (hEvent=0x14c) returned 1
	[0298.661] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0298.661] SetEvent (hEvent=0x168) returned 1
	[0298.661] SetEvent (hEvent=0x14c) returned 1
	[0298.662] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\dR7bCt_DEjsDVvvsD4\\ldlIbe2U6VK_y.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\dr7bct_dejsdvvvsd4\\ldlibe2u6vk_y.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0298.667] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0298.667] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0298.688] CloseHandle (hObject=0x178) returned 1
	[0298.689] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\dR7bCt_DEjsDVvvsD4\\ldlIbe2U6VK_y.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\dr7bct_dejsdvvvsd4\\ldlibe2u6vk_y.avi")) returned 1
	[0298.694] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\desktop.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x124a60a8 | out: lpFileInformation=0x124a60a8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4347fe61, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4347fe61, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x1f8)) returned 1
	[0298.695] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\mMJ8LgwTwoK5YdLT9n.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mmj8lgwtwok5ydlt9n.swf"), fInfoLevelId=0x0, lpFileInformation=0x124a60f8 | out: lpFileInformation=0x124a60f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5f8d3b0, ftCreationTime.dwHighDateTime=0x1d81be7, ftLastAccessTime.dwLowDateTime=0x9556bb40, ftLastAccessTime.dwHighDateTime=0x1d82398, ftLastWriteTime.dwLowDateTime=0x9556bb40, ftLastWriteTime.dwHighDateTime=0x1d82398, nFileSizeHigh=0x0, nFileSizeLow=0x9936)) returned 1
	[0298.695] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\mMJ8LgwTwoK5YdLT9n.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mmj8lgwtwok5ydlt9n.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0298.695] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0298.695] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\mMJ8LgwTwoK5YdLT9n.swf.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mmj8lgwtwok5ydlt9n.swf.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0298.696] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0298.696] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc280 | out: pbBuffer=0x123cc280) returned 1
	[0298.696] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x12412260 | out: pbBuffer=0x12412260) returned 1
	[0298.696] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0281 | out: pbBuffer=0x123c0281) returned 1
	[0298.696] WriteFile (in: hFile=0x17c, lpBuffer=0x12539000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12539000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0298.700] SetEvent (hEvent=0x104) returned 1
	[0298.700] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x9936, lpOverlapped=0x0) returned 1
	[0298.702] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x9936, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0x9936, lpOverlapped=0x0) returned 1
	[0298.705] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0298.705] CloseHandle (hObject=0x17c) returned 1
	[0298.706] CloseHandle (hObject=0x178) returned 1
	[0298.706] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123d00e0*, nNumberOfCharsToWrite=0x38, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x123d00e0*, lpNumberOfCharsWritten=0x124228a0*=0x38) returned 1
	[0298.721] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0298.724] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\mMJ8LgwTwoK5YdLT9n.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mmj8lgwtwok5ydlt9n.swf")) returned 1
	[0298.735] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0298.736] SetEvent (hEvent=0x168) returned 1
	[0298.736] SetEvent (hEvent=0x104) returned 1
	[0298.737] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0298.737] SetEvent (hEvent=0x104) returned 1
	[0298.737] SetEvent (hEvent=0x12c) returned 1
	[0298.737] SetEvent (hEvent=0x174) returned 1
	[0298.737] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0298.738] SetEvent (hEvent=0x174) returned 1
	[0298.762] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0298.762] SetEvent (hEvent=0x168) returned 1
	[0298.762] SetEvent (hEvent=0x174) returned 1
	[0298.764] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0298.765] SetEvent (hEvent=0x174) returned 1
	[0298.765] SetEvent (hEvent=0x12c) returned 1
	[0298.765] SetEvent (hEvent=0x104) returned 1
	[0298.765] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0298.765] SetEvent (hEvent=0x104) returned 1
	[0298.766] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\mMJ8LgwTwoK5YdLT9n.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mmj8lgwtwok5ydlt9n.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0298.767] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0298.767] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0298.789] CloseHandle (hObject=0x178) returned 1
	[0298.790] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\mMJ8LgwTwoK5YdLT9n.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mmj8lgwtwok5ydlt9n.swf")) returned 1
	[0298.794] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\mf6GaSZm.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mf6gaszm.swf"), fInfoLevelId=0x0, lpFileInformation=0x124a6008 | out: lpFileInformation=0x124a6008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8728e100, ftCreationTime.dwHighDateTime=0x1d81c0f, ftLastAccessTime.dwLowDateTime=0xf7435fc0, ftLastAccessTime.dwHighDateTime=0x1d81f42, ftLastWriteTime.dwLowDateTime=0xf7435fc0, ftLastWriteTime.dwHighDateTime=0x1d81f42, nFileSizeHigh=0x0, nFileSizeLow=0x12fb6)) returned 1
	[0298.794] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\mf6GaSZm.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mf6gaszm.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0298.794] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0298.794] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\mf6GaSZm.swf.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mf6gaszm.swf.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0298.795] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0298.795] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc240 | out: pbBuffer=0x123cc240) returned 1
	[0298.795] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c110 | out: pbBuffer=0x1251c110) returned 1
	[0298.795] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0298.795] WriteFile (in: hFile=0x17c, lpBuffer=0x12507000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12507000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0298.798] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0298.800] SetEvent (hEvent=0x168) returned 1
	[0298.800] SetEvent (hEvent=0x104) returned 1
	[0298.800] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x12fb6, lpOverlapped=0x0) returned 1
	[0298.803] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x12fb6, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0x12fb6, lpOverlapped=0x0) returned 1
	[0298.805] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0298.806] CloseHandle (hObject=0x17c) returned 1
	[0298.806] CloseHandle (hObject=0x178) returned 1
	[0298.806] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1250c000*, nNumberOfCharsToWrite=0x2e, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x1250c000*, lpNumberOfCharsWritten=0x124228a0*=0x2e) returned 1
	[0298.819] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0298.821] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\mf6GaSZm.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mf6gaszm.swf")) returned 1
	[0298.833] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0298.834] SetEvent (hEvent=0x168) returned 1
	[0298.834] SetEvent (hEvent=0x104) returned 1
	[0298.836] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0298.850] SetEvent (hEvent=0x104) returned 1
	[0298.850] SetEvent (hEvent=0x14c) returned 1
	[0298.850] SetEvent (hEvent=0x174) returned 1
	[0298.850] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0298.853] SetEvent (hEvent=0x168) returned 1
	[0298.853] SetEvent (hEvent=0x174) returned 1
	[0298.874] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0298.874] SetEvent (hEvent=0x174) returned 1
	[0298.876] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0298.876] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0x1) returned 0x0
	[0298.877] SetEvent (hEvent=0x174) returned 1
	[0298.877] SetEvent (hEvent=0x14c) returned 1
	[0298.877] SetEvent (hEvent=0x104) returned 1
	[0298.877] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) returned 0x0
	[0298.877] SetEvent (hEvent=0x104) returned 1
	[0298.878] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\mf6GaSZm.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mf6gaszm.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0298.878] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0298.878] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0298.899] CloseHandle (hObject=0x178) returned 1
	[0298.899] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\mf6GaSZm.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\mf6gaszm.swf")) returned 1
	[0298.904] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\ntuser.dat.LOG1" (normalized: "c:\\users\\rdhj0cnfevzx\\ntuser.dat.log1"), fInfoLevelId=0x0, lpFileInformation=0x124a6058 | out: lpFileInformation=0x124a6058*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3d2dc444, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d2dc444, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d2dc444, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x62c00)) returned 1
	[0298.907] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\ntuser.dat.LOG2" (normalized: "c:\\users\\rdhj0cnfevzx\\ntuser.dat.log2"), fInfoLevelId=0x0, lpFileInformation=0x124a60a8 | out: lpFileInformation=0x124a60a8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3d2dc444, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d2dc444, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d2dc444, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x8f000)) returned 1
	[0298.907] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\ntuser.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\ntuser.ini"), fInfoLevelId=0x0, lpFileInformation=0x124a60f8 | out: lpFileInformation=0x124a60f8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x14)) returned 1
	[0298.907] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\windows" (normalized: "c:\\users\\rdhj0cnfevzx\\windows"), fInfoLevelId=0x0, lpFileInformation=0x124a6148 | out: lpFileInformation=0x124a6148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7c536d, ftCreationTime.dwHighDateTime=0x1d83aa1, ftLastAccessTime.dwLowDateTime=0xeb7c536d, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xeb97077e, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x6ac)) returned 1
	[0298.908] GetFileAttributesExW (in: lpFileName="C:\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x124a6198 | out: lpFileInformation=0x124a6198*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3757c8c, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973af366, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x973af366, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xae)) returned 1
	[0298.908] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x124a61e8 | out: lpFileInformation=0x124a61e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xd9a60a69, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xd9a60a69, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1
	[0298.908] CreateFileW (lpFileName="C:\\Windows" (normalized: "c:\\windows"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0298.908] FindFirstFileW (in: lpFileName="C:\\Windows\\*", lpFindFileData=0x12423a44 | out: lpFindFileData=0x12423a44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xd9a60a69, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xd9a60a69, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fee8
	[0298.908] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xd9a60a69, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xd9a60a69, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0298.909] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x383caa7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x383caa7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="addins", cAlternateFileName="")) returned 1
	[0298.909] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xdc4d01, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xdc4d01, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="appcompat", cAlternateFileName="APPCOM~1")) returned 1
	[0298.909] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd313219, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd313219, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPatch", cAlternateFileName="")) returned 1
	[0298.909] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x22e61277, ftLastAccessTime.dwHighDateTime=0x1d70503, ftLastWriteTime.dwLowDateTime=0x22e61277, ftLastWriteTime.dwHighDateTime=0x1d70503, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppReadiness", cAlternateFileName="APPREA~1")) returned 1
	[0298.909] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x9d1522, ftLastAccessTime.dwHighDateTime=0x1d705f0, ftLastWriteTime.dwLowDateTime=0x9d1522, ftLastWriteTime.dwHighDateTime=0x1d705f0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="assembly", cAlternateFileName="")) returned 1
	[0298.909] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3888f58, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3888f58, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bcastdvr", cAlternateFileName="")) returned 1
	[0298.909] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1425a437, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1425a437, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x14280695, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf200, dwReserved0=0x0, dwReserved1=0x0, cFileName="bfsvc.exe", cAlternateFileName="")) returned 1
	[0298.909] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x6ec87d0d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ecfa42d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ecfa42d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BitLockerDiscoveryVolumeContents", cAlternateFileName="BITLOC~1")) returned 1
	[0298.909] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe111b6, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xe111b6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1
	[0298.909] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x9012b7dc, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x9012b7dc, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xe49c37bf, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x10800, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootstat.dat", cAlternateFileName="")) returned 1
	[0298.909] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe111b6, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xe111b6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Branding", cAlternateFileName="")) returned 1
	[0298.909] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x388963fa, ftCreationTime.dwHighDateTime=0x1d112e2, ftLastAccessTime.dwLowDateTime=0x77a1c398, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x77a1c398, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CbsTemp", cAlternateFileName="")) returned 1
	[0298.909] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9a60a69, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xd9a60a69, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xd9a60a69, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CSC", cAlternateFileName="")) returned 1
	[0298.909] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3b5dc04, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3b5dc04, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cursors", cAlternateFileName="")) returned 1
	[0298.909] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x87c914ec, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x87c914ec, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="debug", cAlternateFileName="")) returned 1
	[0298.909] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3b5dc04, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3b5dc04, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DesktopTileResources", cAlternateFileName="DESKTO~1")) returned 1
	[0298.909] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xe37410, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x9559687a, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x9559687a, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DevicesFlow", cAlternateFileName="DEVICE~1")) returned 1
	[0298.909] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe37410, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe37410, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xe37410, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="diagnostics", cAlternateFileName="DIAGNO~1")) returned 1
	[0298.909] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd3f8070, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd3f8070, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd3f8070, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigitalLocker", cAlternateFileName="DIGITA~1")) returned 1
	[0298.910] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe5d667, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x4022730, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x4022730, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloaded Program Files", cAlternateFileName="DOWNLO~1")) returned 1
	[0298.910] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37f054c7, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37f054c7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xbaa4d45e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x6b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DtcInstall.log", cAlternateFileName="DTCINS~1.LOG")) returned 1
	[0298.910] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xe5d667, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x4022730, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x4022730, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ELAMBKUP", cAlternateFileName="")) returned 1
	[0298.910] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd3f8070, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd41e2a2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd41e2a2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0298.910] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x220ad5e0, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x220ad5e0, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x220ad5e0, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x44b550, dwReserved0=0x0, dwReserved1=0x0, cFileName="explorer.exe", cAlternateFileName="")) returned 1
	[0298.910] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xe5d667, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2bf387cd, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x2bf387cd, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1
	[0298.910] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5d667, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe5d667, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xe5d667, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Globalization", cAlternateFileName="GLOBAL~1")) returned 1
	[0298.910] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5d667, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd41e2a2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd41e2a2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1
	[0298.910] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x192f7b5f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x192f7b5f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x192f7b5f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf2e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="HelpPane.exe", cAlternateFileName="")) returned 1
	[0298.910] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1883d233, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1883d233, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1883d233, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="hh.exe", cAlternateFileName="")) returned 1
	[0298.910] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe838c5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd44450f, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd44450f, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IME", cAlternateFileName="")) returned 1
	[0298.910] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xe838c5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5eeea3fc, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5eeea3fc, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImmersiveControlPanel", cAlternateFileName="IMMERS~1")) returned 1
	[0298.910] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa31f8be1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xbadb70d3, ftLastAccessTime.dwHighDateTime=0x1d7e768, ftLastWriteTime.dwLowDateTime=0xbadb70d3, ftLastWriteTime.dwHighDateTime=0x1d7e768, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INF", cAlternateFileName="")) returned 1
	[0298.910] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef5fd1, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xef5fd1, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xef5fd1, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfusedApps", cAlternateFileName="INFUSE~1")) returned 1
	[0298.910] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef5fd1, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xef5fd1, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xef5fd1, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputMethod", cAlternateFileName="INPUTM~1")) returned 1
	[0298.910] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xef5fd1, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x63d4f3ad, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x63f5b630, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Installer", cAlternateFileName="INSTAL~1")) returned 1
	[0298.910] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef5fd1, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x4d1939a, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x4d1939a, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="L2Schemas", cAlternateFileName="L2SCHE~1")) returned 1
	[0298.911] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef5fd1, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xef5fd1, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xef5fd1, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LiveKernelReports", cAlternateFileName="LIVEKE~1")) returned 1
	[0298.911] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8cf3e7ab, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x1a869a96, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x6449ebcb, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1
	[0298.911] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87e0eb86, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x87e0eb86, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x87e0eb86, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x540, dwReserved0=0x0, dwReserved1=0x0, cFileName="lsasetup.log", cAlternateFileName="")) returned 1
	[0298.911] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xef5fd1, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x4dfe1b9, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x4dfe1b9, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media", cAlternateFileName="")) returned 1
	[0298.911] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10293695, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x10293695, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x10293695, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa87b, dwReserved0=0x0, dwReserved1=0x0, cFileName="mib.bin", cAlternateFileName="")) returned 1
	[0298.911] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x8a7d6dae, ftLastAccessTime.dwHighDateTime=0x1d7e768, ftLastWriteTime.dwLowDateTime=0x8a7d6dae, ftLastWriteTime.dwHighDateTime=0x1d7e768, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1
	[0298.911] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf686e4, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf686e4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf686e4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Migration", cAlternateFileName="MIGRAT~1")) returned 1
	[0298.911] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xf686e4, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x9f657f27, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x9f657f27, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MiracastView", cAlternateFileName="MIRACA~1")) returned 1
	[0298.911] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf686e4, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf686e4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf686e4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ModemLogs", cAlternateFileName="MODEML~1")) returned 1
	[0298.911] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505b5aa3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x505b5aa3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x505b5aa3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="notepad.exe", cAlternateFileName="")) returned 1
	[0298.911] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe139e089, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xe139e089, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xe139e089, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCR", cAlternateFileName="")) returned 1
	[0298.911] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xf686e4, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x61f5c95, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x61f5c95, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Offline Web Pages", cAlternateFileName="OFFLIN~1")) returned 1
	[0298.911] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f8fa6db, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x4fa275ed, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x4fa4d76f, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Panther", cAlternateFileName="")) returned 1
	[0298.911] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf686e4, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf686e4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf686e4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Performance", cAlternateFileName="PERFOR~1")) returned 1
	[0298.911] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf686e4, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf8e937, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf8e937, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PLA", cAlternateFileName="")) returned 1
	[0298.911] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf8e937, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6ee9dc43, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ee9dc43, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PolicyDefinitions", cAlternateFileName="POLICY~1")) returned 1
	[0298.911] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938e66c3, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xe37cf9d, ftLastAccessTime.dwHighDateTime=0x1d7b062, ftLastWriteTime.dwLowDateTime=0xe37cf9d, ftLastWriteTime.dwHighDateTime=0x1d7b062, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prefetch", cAlternateFileName="")) returned 1
	[0298.911] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xf8e937, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xa039b1b2, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0xa039b1b2, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrintDialog", cAlternateFileName="PRINTD~1")) returned 1
	[0298.911] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b1269a, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x96b1269a, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x3ac00f7d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x7dc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Professional.xml", cAlternateFileName="PROFES~1.XML")) returned 1
	[0298.911] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf8e937, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6300d36, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x6300d36, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Provisioning", cAlternateFileName="PROVIS~1")) returned 1
	[0298.911] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xf8e937, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xaaed1dd9, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0xaaed1dd9, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PurchaseDialog", cAlternateFileName="PURCHA~1")) returned 1
	[0298.911] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14eb873f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x14eb873f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x14eb873f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4e400, dwReserved0=0x0, dwReserved1=0x0, cFileName="regedit.exe", cAlternateFileName="")) returned 1
	[0298.912] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf8e937, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x637340b, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x637340b, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Registration", cAlternateFileName="REGIST~1")) returned 1
	[0298.912] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf8e937, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x4d6bf5ba, ftLastAccessTime.dwHighDateTime=0x1d7b05a, ftLastWriteTime.dwLowDateTime=0x4d6bf5ba, ftLastWriteTime.dwHighDateTime=0x1d7b05a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rescache", cAlternateFileName="")) returned 1
	[0298.912] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf8e937, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf8e937, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf8e937, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1
	[0298.912] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf8e937, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf8e937, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf8e937, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SchCache", cAlternateFileName="")) returned 1
	[0298.912] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf8e937, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xfb4b8d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xfb4b8d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="schemas", cAlternateFileName="")) returned 1
	[0298.912] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb4b8d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6f04186d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6f04186d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="security", cAlternateFileName="")) returned 1
	[0298.912] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x506c8f22, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x88109cb8, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x88109cb8, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ServiceProfiles", cAlternateFileName="SERVIC~2")) returned 1
	[0298.912] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xbd54f5be, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd54f5be, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="servicing", cAlternateFileName="SERVIC~1")) returned 1
	[0298.912] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50226d22, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x50226d22, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x50226d22, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup", cAlternateFileName="")) returned 1
	[0298.912] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cb14070, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x8cb14070, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x8f64ac44, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0xf45, dwReserved0=0x0, dwReserved1=0x0, cFileName="setupact.log", cAlternateFileName="")) returned 1
	[0298.912] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cb14070, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x8cb14070, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x8cb14070, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="setuperr.log", cAlternateFileName="")) returned 1
	[0298.912] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f04186d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6f067ab4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6f067ab4, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellNew", cAlternateFileName="")) returned 1
	[0298.912] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd13c1c8a, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xd13c1c8a, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xd13c1c8a, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKB", cAlternateFileName="")) returned 1
	[0298.912] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x675574ee, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0xdfc2100c, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xdfc2100c, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftwareDistribution", cAlternateFileName="SOFTWA~1")) returned 1
	[0298.912] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb4b8d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xfb4b8d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xfb4b8d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech", cAlternateFileName="")) returned 1
	[0298.912] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb4b8d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xfb4b8d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xfb4b8d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech_OneCore", cAlternateFileName="SPEECH~1")) returned 1
	[0298.912] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x213b6972, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x213b6972, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x213dcbcc, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1f400, dwReserved0=0x0, dwReserved1=0x0, cFileName="splwow64.exe", cAlternateFileName="")) returned 1
	[0298.912] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb4b8d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xfb4b8d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xfb4b8d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1
	[0298.913] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x383caa7, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97447ccc, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97447ccc, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="system.ini", cAlternateFileName="")) returned 1
	[0298.913] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xbae59694, ftLastAccessTime.dwHighDateTime=0x1d7e768, ftLastWriteTime.dwLowDateTime=0xbae59694, ftLastWriteTime.dwHighDateTime=0x1d7e768, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 1
	[0298.913] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13e0d5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6f95896c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6f95896c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemApps", cAlternateFileName="SYSTEM~1")) returned 1
	[0298.913] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14796bd, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x149f91c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x149f91c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemResources", cAlternateFileName="SYSTEM~2")) returned 1
	[0298.913] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35938b58, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xe0e516ca, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xe0e516ca, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysWOW64", cAlternateFileName="")) returned 1
	[0298.913] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16b59ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x16b59ff, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x16b59ff, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAPI", cAlternateFileName="")) returned 1
	[0298.913] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16b59ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5f793717, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5f793717, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tasks", cAlternateFileName="")) returned 1
	[0298.913] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16b59ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xecd3e007, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xecd3e007, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0298.913] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16b59ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x16b59ff, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x16b59ff, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tracing", cAlternateFileName="")) returned 1
	[0298.913] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16b59ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd761812, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd761812, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="twain_32", cAlternateFileName="")) returned 1
	[0298.913] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5139153c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5139153c, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5139153c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xec00, dwReserved0=0x0, dwReserved1=0x0, cFileName="twain_32.dll", cAlternateFileName="")) returned 1
	[0298.913] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16b59ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x16b59ff, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x16b59ff, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vss", cAlternateFileName="")) returned 1
	[0298.913] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16b59ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x706c1e39, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x706c1e39, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web", cAlternateFileName="")) returned 1
	[0298.913] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x383caa7, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97447ccc, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97447ccc, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="win.ini", cAlternateFileName="")) returned 1
	[0298.913] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x252e4dc1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252e4dc1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252e4dc1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x29e, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsShell.Manifest", cAlternateFileName="")) returned 1
	[0298.913] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x675574ee, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x675574ee, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0xaf1efec6, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x113, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsUpdate.log", cAlternateFileName="WINDOW~1.LOG")) returned 1
	[0298.913] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d082a6f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2d082a6f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2d082a6f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="winhlp32.exe", cAlternateFileName="")) returned 1
	[0298.913] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x83447569, ftLastAccessTime.dwHighDateTime=0x1d7b059, ftLastWriteTime.dwLowDateTime=0x83447569, ftLastWriteTime.dwHighDateTime=0x1d7b059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinSxS", cAlternateFileName="")) returned 1
	[0298.914] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x342f36fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x342f36fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x342f36fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4d4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMSysPr9.prx", cAlternateFileName="")) returned 1
	[0298.914] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x245a1c9a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x245a1c9a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x245a1c9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="write.exe", cAlternateFileName="")) returned 1
	[0298.914] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423a64 | out: lpFindFileData=0x12423a64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0298.914] FindClose (in: hFindFile=0x79fee8 | out: hFindFile=0x79fee8) returned 1
	[0298.914] GetFileAttributesExW (in: lpFileName="C:\\Windows\\AppPatch" (normalized: "c:\\windows\\apppatch"), fInfoLevelId=0x0, lpFileInformation=0x125da148 | out: lpFileInformation=0x125da148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd313219, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd313219, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0298.914] CreateFileW (lpFileName="C:\\Windows\\AppPatch" (normalized: "c:\\windows\\apppatch"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0298.914] FindFirstFileW (in: lpFileName="C:\\Windows\\AppPatch\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd313219, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd313219, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fe68
	[0298.915] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd313219, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd313219, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0298.915] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x333e69a8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x333e69a8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x333e69a8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x25d200, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcGenral.dll", cAlternateFileName="")) returned 1
	[0298.915] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3339a4f3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x3339a4f3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x3339a4f3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x51e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcLayers.dll", cAlternateFileName="")) returned 1
	[0298.915] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x333c074d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x333c074d, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x333c074d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4e360, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcRes.dll", cAlternateFileName="")) returned 1
	[0298.915] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x333e69a8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x333e69a8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x333e69a8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x74a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcSpecfc.dll", cAlternateFileName="")) returned 1
	[0298.915] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x333e69a8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x333e69a8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x333e69a8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x7800, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcWinRT.dll", cAlternateFileName="")) returned 1
	[0298.915] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29d40238, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x29d40238, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x29d40238, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9600, dwReserved0=0x0, dwReserved1=0x0, cFileName="acwow64.dll", cAlternateFileName="")) returned 1
	[0298.915] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3339a4f3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x3339a4f3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x3339a4f3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x15800, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcXtrnal.dll", cAlternateFileName="")) returned 1
	[0298.915] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3888f58, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3888f58, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="apppatch64", cAlternateFileName="APPPAT~1")) returned 1
	[0298.915] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xdc4d01, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xdc4d01, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Custom", cAlternateFileName="")) returned 1
	[0298.915] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2765bcea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2765bcea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2765bcea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x24836, dwReserved0=0x0, dwReserved1=0x0, cFileName="drvmain.sdb", cAlternateFileName="")) returned 1
	[0298.915] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd313219, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd313219, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd313219, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0298.915] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1379fb0e, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1379fb0e, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1379fb0e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1020, dwReserved0=0x0, dwReserved1=0x0, cFileName="frxmain.sdb", cAlternateFileName="")) returned 1
	[0298.915] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2765bcea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2765bcea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x27681f4c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2dcce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msimain.sdb", cAlternateFileName="")) returned 1
	[0298.915] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29c351c3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x29c351c3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x29c5b419, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xec8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pcamain.sdb", cAlternateFileName="")) returned 1
	[0298.915] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3339a4f3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x3339a4f3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x333c074d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3a0e5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="sysmain.sdb", cAlternateFileName="")) returned 1
	[0298.915] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0298.915] FindClose (in: hFindFile=0x79fe68 | out: hFindFile=0x79fe68) returned 1
	[0298.916] GetFileAttributesExW (in: lpFileName="C:\\Windows\\AppPatch\\AcGenral.dll" (normalized: "c:\\windows\\apppatch\\acgenral.dll"), fInfoLevelId=0x0, lpFileInformation=0x125da648 | out: lpFileInformation=0x125da648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x333e69a8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x333e69a8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x333e69a8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x25d200)) returned 1
	[0298.922] GetFileAttributesExW (in: lpFileName="C:\\Windows\\AppPatch\\AcLayers.dll" (normalized: "c:\\windows\\apppatch\\aclayers.dll"), fInfoLevelId=0x0, lpFileInformation=0x125da698 | out: lpFileInformation=0x125da698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3339a4f3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x3339a4f3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x3339a4f3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x51e00)) returned 1
	[0298.923] GetFileAttributesExW (in: lpFileName="C:\\Windows\\AppPatch\\AcRes.dll" (normalized: "c:\\windows\\apppatch\\acres.dll"), fInfoLevelId=0x0, lpFileInformation=0x125da6e8 | out: lpFileInformation=0x125da6e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x333c074d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x333c074d, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x333c074d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4e360)) returned 1
	[0298.923] GetFileAttributesExW (in: lpFileName="C:\\Windows\\AppPatch\\AcSpecfc.dll" (normalized: "c:\\windows\\apppatch\\acspecfc.dll"), fInfoLevelId=0x0, lpFileInformation=0x125da738 | out: lpFileInformation=0x125da738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x333e69a8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x333e69a8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x333e69a8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x74a00)) returned 1
	[0298.923] GetFileAttributesExW (in: lpFileName="C:\\Windows\\AppPatch\\AcWinRT.dll" (normalized: "c:\\windows\\apppatch\\acwinrt.dll"), fInfoLevelId=0x0, lpFileInformation=0x125da788 | out: lpFileInformation=0x125da788*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x333e69a8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x333e69a8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x333e69a8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x7800)) returned 1
	[0298.924] GetFileAttributesExW (in: lpFileName="C:\\Windows\\AppPatch\\AcXtrnal.dll" (normalized: "c:\\windows\\apppatch\\acxtrnal.dll"), fInfoLevelId=0x0, lpFileInformation=0x125da7d8 | out: lpFileInformation=0x125da7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3339a4f3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x3339a4f3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x3339a4f3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x15800)) returned 1
	[0298.924] GetFileAttributesExW (in: lpFileName="C:\\Windows\\AppPatch\\Custom" (normalized: "c:\\windows\\apppatch\\custom"), fInfoLevelId=0x0, lpFileInformation=0x125da828 | out: lpFileInformation=0x125da828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xdc4d01, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xdc4d01, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0298.924] CreateFileW (lpFileName="C:\\Windows\\AppPatch\\Custom" (normalized: "c:\\windows\\apppatch\\custom"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0298.925] FindFirstFileW (in: lpFileName="C:\\Windows\\AppPatch\\Custom\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xdc4d01, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xdc4d01, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fce8
	[0298.925] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xdc4d01, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xdc4d01, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0298.925] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xdc4d01, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xdc4d01, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Custom64", cAlternateFileName="")) returned 1
	[0298.925] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0298.925] FindClose (in: hFindFile=0x79fce8 | out: hFindFile=0x79fce8) returned 1
	[0298.925] GetFileAttributesExW (in: lpFileName="C:\\Windows\\AppPatch\\Custom\\Custom64" (normalized: "c:\\windows\\apppatch\\custom\\custom64"), fInfoLevelId=0x0, lpFileInformation=0x125da8c8 | out: lpFileInformation=0x125da8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xdc4d01, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xdc4d01, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0298.925] CreateFileW (lpFileName="C:\\Windows\\AppPatch\\Custom\\Custom64" (normalized: "c:\\windows\\apppatch\\custom\\custom64"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0298.926] FindFirstFileW (in: lpFileName="C:\\Windows\\AppPatch\\Custom\\Custom64\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xdc4d01, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xdc4d01, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fe68
	[0298.926] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xdc4d01, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xdc4d01, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0298.926] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0298.926] FindClose (in: hFindFile=0x79fe68 | out: hFindFile=0x79fe68) returned 1
	[0298.926] GetFileAttributesExW (in: lpFileName="C:\\Windows\\AppPatch\\acwow64.dll" (normalized: "c:\\windows\\apppatch\\acwow64.dll"), fInfoLevelId=0x0, lpFileInformation=0x125da918 | out: lpFileInformation=0x125da918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29d40238, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x29d40238, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x29d40238, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9600)) returned 1
	[0298.926] GetFileAttributesExW (in: lpFileName="C:\\Windows\\AppPatch\\apppatch64" (normalized: "c:\\windows\\apppatch\\apppatch64"), fInfoLevelId=0x0, lpFileInformation=0x125da968 | out: lpFileInformation=0x125da968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3888f58, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3888f58, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0298.926] CreateFileW (lpFileName="C:\\Windows\\AppPatch\\apppatch64" (normalized: "c:\\windows\\apppatch\\apppatch64"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0298.927] FindFirstFileW (in: lpFileName="C:\\Windows\\AppPatch\\apppatch64\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3888f58, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3888f58, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79faa8
	[0298.927] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3888f58, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3888f58, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0298.927] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2765bcea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2765bcea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2765bcea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4c600, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcGenral.dll", cAlternateFileName="")) returned 1
	[0298.927] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2765bcea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2765bcea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2765bcea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcLayers.dll", cAlternateFileName="")) returned 1
	[0298.927] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2765bcea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2765bcea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2765bcea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="acspecfc.dll", cAlternateFileName="")) returned 1
	[0298.927] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2765bcea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2765bcea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2765bcea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcWinRT.dll", cAlternateFileName="")) returned 1
	[0298.927] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2765bcea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2765bcea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2765bcea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcXtrnal.dll", cAlternateFileName="")) returned 1
	[0298.927] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x143b1959, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x143b1959, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x143b1959, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3246, dwReserved0=0x0, dwReserved1=0x0, cFileName="pcamain.sdb", cAlternateFileName="")) returned 1
	[0298.927] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27681f4c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x27681f4c, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x27681f4c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x7dabe, dwReserved0=0x0, dwReserved1=0x0, cFileName="sysmain.sdb", cAlternateFileName="")) returned 1
	[0298.927] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0298.927] FindClose (in: hFindFile=0x79faa8 | out: hFindFile=0x79faa8) returned 1
	[0298.927] GetFileAttributesExW (in: lpFileName="C:\\Windows\\AppPatch\\apppatch64\\AcGenral.dll" (normalized: "c:\\windows\\apppatch\\apppatch64\\acgenral.dll"), fInfoLevelId=0x0, lpFileInformation=0x125dabe8 | out: lpFileInformation=0x125dabe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2765bcea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2765bcea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2765bcea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4c600)) returned 1
	[0298.928] GetFileAttributesExW (in: lpFileName="C:\\Windows\\AppPatch\\apppatch64\\AcLayers.dll" (normalized: "c:\\windows\\apppatch\\apppatch64\\aclayers.dll"), fInfoLevelId=0x0, lpFileInformation=0x125dac38 | out: lpFileInformation=0x125dac38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2765bcea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2765bcea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2765bcea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3bc00)) returned 1
	[0298.928] GetFileAttributesExW (in: lpFileName="C:\\Windows\\AppPatch\\apppatch64\\AcWinRT.dll" (normalized: "c:\\windows\\apppatch\\apppatch64\\acwinrt.dll"), fInfoLevelId=0x0, lpFileInformation=0x125dac88 | out: lpFileInformation=0x125dac88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2765bcea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2765bcea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2765bcea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9400)) returned 1
	[0298.931] GetFileAttributesExW (in: lpFileName="C:\\Windows\\AppPatch\\apppatch64\\AcXtrnal.dll" (normalized: "c:\\windows\\apppatch\\apppatch64\\acxtrnal.dll"), fInfoLevelId=0x0, lpFileInformation=0x125dacd8 | out: lpFileInformation=0x125dacd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2765bcea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2765bcea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2765bcea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3a00)) returned 1
	[0298.931] GetFileAttributesExW (in: lpFileName="C:\\Windows\\AppPatch\\apppatch64\\acspecfc.dll" (normalized: "c:\\windows\\apppatch\\apppatch64\\acspecfc.dll"), fInfoLevelId=0x0, lpFileInformation=0x125dad28 | out: lpFileInformation=0x125dad28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2765bcea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2765bcea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2765bcea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xba00)) returned 1
	[0298.931] GetFileAttributesExW (in: lpFileName="C:\\Windows\\AppPatch\\apppatch64\\pcamain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\pcamain.sdb"), fInfoLevelId=0x0, lpFileInformation=0x125dad78 | out: lpFileInformation=0x125dad78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x143b1959, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x143b1959, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x143b1959, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3246)) returned 1
	[0298.931] GetFileAttributesExW (in: lpFileName="C:\\Windows\\AppPatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb"), fInfoLevelId=0x0, lpFileInformation=0x125dadc8 | out: lpFileInformation=0x125dadc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27681f4c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x27681f4c, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x27681f4c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x7dabe)) returned 1
	[0298.932] GetFileAttributesExW (in: lpFileName="C:\\Windows\\AppPatch\\drvmain.sdb" (normalized: "c:\\windows\\apppatch\\drvmain.sdb"), fInfoLevelId=0x0, lpFileInformation=0x125dae18 | out: lpFileInformation=0x125dae18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2765bcea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2765bcea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2765bcea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x24836)) returned 1
	[0298.932] GetFileAttributesExW (in: lpFileName="C:\\Windows\\AppPatch\\en-US" (normalized: "c:\\windows\\apppatch\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x125dae68 | out: lpFileInformation=0x125dae68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd313219, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd313219, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd313219, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0298.932] CreateFileW (lpFileName="C:\\Windows\\AppPatch\\en-US" (normalized: "c:\\windows\\apppatch\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0298.932] FindFirstFileW (in: lpFileName="C:\\Windows\\AppPatch\\en-US\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd313219, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd313219, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd313219, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fb28
	[0298.932] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd313219, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd313219, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd313219, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0298.933] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa45a635a, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa45a635a, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa45a635a, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x4be00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcRes.dll.mui", cAlternateFileName="")) returned 1
	[0298.933] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0298.933] FindClose (in: hFindFile=0x79fb28 | out: hFindFile=0x79fb28) returned 1
	[0298.933] GetFileAttributesExW (in: lpFileName="C:\\Windows\\AppPatch\\en-US\\AcRes.dll.mui" (normalized: "c:\\windows\\apppatch\\en-us\\acres.dll.mui"), fInfoLevelId=0x0, lpFileInformation=0x125daf08 | out: lpFileInformation=0x125daf08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa45a635a, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa45a635a, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa45a635a, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x4be00)) returned 1
	[0298.934] GetFileAttributesExW (in: lpFileName="C:\\Windows\\AppPatch\\frxmain.sdb" (normalized: "c:\\windows\\apppatch\\frxmain.sdb"), fInfoLevelId=0x0, lpFileInformation=0x125daf58 | out: lpFileInformation=0x125daf58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1379fb0e, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1379fb0e, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1379fb0e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1020)) returned 1
	[0298.934] GetFileAttributesExW (in: lpFileName="C:\\Windows\\AppPatch\\msimain.sdb" (normalized: "c:\\windows\\apppatch\\msimain.sdb"), fInfoLevelId=0x0, lpFileInformation=0x125dafa8 | out: lpFileInformation=0x125dafa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2765bcea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2765bcea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x27681f4c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2dcce0)) returned 1
	[0298.935] GetFileAttributesExW (in: lpFileName="C:\\Windows\\AppPatch\\pcamain.sdb" (normalized: "c:\\windows\\apppatch\\pcamain.sdb"), fInfoLevelId=0x0, lpFileInformation=0x125daff8 | out: lpFileInformation=0x125daff8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29c351c3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x29c351c3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x29c5b419, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xec8a)) returned 1
	[0298.935] GetFileAttributesExW (in: lpFileName="C:\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb"), fInfoLevelId=0x0, lpFileInformation=0x125db048 | out: lpFileInformation=0x125db048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3339a4f3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x3339a4f3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x333c074d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3a0e5a)) returned 1
	[0298.936] GetFileAttributesExW (in: lpFileName="C:\\Windows\\AppReadiness" (normalized: "c:\\windows\\appreadiness"), fInfoLevelId=0x0, lpFileInformation=0x125db098 | out: lpFileInformation=0x125db098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x22e61277, ftLastAccessTime.dwHighDateTime=0x1d70503, ftLastWriteTime.dwLowDateTime=0x22e61277, ftLastWriteTime.dwHighDateTime=0x1d70503, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0298.936] CreateFileW (lpFileName="C:\\Windows\\AppReadiness" (normalized: "c:\\windows\\appreadiness"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0298.936] FindFirstFileW (in: lpFileName="C:\\Windows\\AppReadiness\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x22e61277, ftLastAccessTime.dwHighDateTime=0x1d70503, ftLastWriteTime.dwLowDateTime=0x22e61277, ftLastWriteTime.dwHighDateTime=0x1d70503, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9e8
	[0298.936] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x22e61277, ftLastAccessTime.dwHighDateTime=0x1d70503, ftLastWriteTime.dwLowDateTime=0x22e61277, ftLastWriteTime.dwHighDateTime=0x1d70503, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0298.936] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0298.936] FindClose (in: hFindFile=0x79f9e8 | out: hFindFile=0x79f9e8) returned 1
	[0298.936] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents"), fInfoLevelId=0x0, lpFileInformation=0x125db0e8 | out: lpFileInformation=0x125db0e8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x6ec87d0d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ecfa42d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ecfa42d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0298.937] CreateFileW (lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0298.937] FindFirstFileW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x6ec87d0d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ecfa42d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ecfa42d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffe8
	[0298.939] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x6ec87d0d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ecfa42d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ecfa42d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0298.939] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62eb057d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5c78fc08, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5c78fc08, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-SA_BitLockerToGo.exe.mui", cAlternateFileName="")) returned 1
	[0298.939] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x7, ftCreationTime.dwLowDateTime=0x584f7138, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x584f7138, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x584f7138, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x74, dwReserved0=0x0, dwReserved1=0x0, cFileName="autorun.inf", cAlternateFileName="")) returned 1
	[0298.940] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62eb057d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5a975d0e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5a975d0e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG_BitLockerToGo.exe.mui", cAlternateFileName="")) returned 1
	[0298.940] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x5, ftCreationTime.dwLowDateTime=0x584f7138, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x59d3d8db, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x59d3d8db, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x37360, dwReserved0=0x0, dwReserved1=0x0, cFileName="BitLockerToGo.exe", cAlternateFileName="")) returned 1
	[0298.940] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62eb057d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x653571a9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x653571a9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ_BitLockerToGo.exe.mui", cAlternateFileName="")) returned 1
	[0298.940] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62eb057d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x633e5bba, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x633e5bba, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK_BitLockerToGo.exe.mui", cAlternateFileName="")) returned 1
	[0298.940] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62eb057d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x59db0012, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x59db0012, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE_BitLockerToGo.exe.mui", cAlternateFileName="")) returned 1
	[0298.940] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62e8a32a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5f0182b4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5f03e52e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR_BitLockerToGo.exe.mui", cAlternateFileName="")) returned 1
	[0298.940] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62eb057d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x68379151, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x68379151, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB_BitLockerToGo.exe.mui", cAlternateFileName="")) returned 1
	[0298.940] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62e8a32a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5cced1a0, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5cced1a0, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US_BitLockerToGo.exe.mui", cAlternateFileName="")) returned 1
	[0298.940] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62e8a32a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x62efad4a, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x62efad4a, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES_BitLockerToGo.exe.mui", cAlternateFileName="")) returned 1
	[0298.940] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62e8a32a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6508247e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6508247e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX_BitLockerToGo.exe.mui", cAlternateFileName="")) returned 1
	[0298.940] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62e8a32a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x62e885f8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x62e885f8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE_BitLockerToGo.exe.mui", cAlternateFileName="")) returned 1
	[0298.940] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62e8a32a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x66e4ffb1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x66e4ffb1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI_BitLockerToGo.exe.mui", cAlternateFileName="")) returned 1
	[0298.940] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62e8a32a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5cc7aa4a, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5cc7aa4a, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CA_BitLockerToGo.exe.mui", cAlternateFileName="")) returned 1
	[0298.940] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62e8a32a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5a1dc2a1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5a1dc2a1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR_BitLockerToGo.exe.mui", cAlternateFileName="")) returned 1
	[0298.940] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62e8a32a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x65841ed6, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x65841ed6, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL_BitLockerToGo.exe.mui", cAlternateFileName="")) returned 1
	[0298.940] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62e8a32a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5d75b7ed, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5d75b7ed, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR_BitLockerToGo.exe.mui", cAlternateFileName="")) returned 1
	[0298.940] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62e640c4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x64a66291, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x64a66291, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU_BitLockerToGo.exe.mui", cAlternateFileName="")) returned 1
	[0298.940] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62e640c4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5c93364c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5c93364c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT_BitLockerToGo.exe.mui", cAlternateFileName="")) returned 1
	[0298.940] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62e640c4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5e9fc114, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5e9fc114, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP_BitLockerToGo.exe.mui", cAlternateFileName="")) returned 1
	[0298.940] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62e640c4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5ee4e60d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5ee4e60d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR_BitLockerToGo.exe.mui", cAlternateFileName="")) returned 1
	[0298.940] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62ed67d7, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5a75fbb5, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5a75fbb5, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT_BitLockerToGo.exe.mui", cAlternateFileName="")) returned 1
	[0298.940] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62ed67d7, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5de5c7ec, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5de5c7ec, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV_BitLockerToGo.exe.mui", cAlternateFileName="")) returned 1
	[0298.940] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62ed67d7, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x63ba56c7, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x63ba56c7, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO_BitLockerToGo.exe.mui", cAlternateFileName="")) returned 1
	[0298.940] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62ed67d7, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5d22459a, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5d22459a, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL_BitLockerToGo.exe.mui", cAlternateFileName="")) returned 1
	[0298.941] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62ed67d7, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5f8bcc62, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5f8bcc62, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL_BitLockerToGo.exe.mui", cAlternateFileName="")) returned 1
	[0298.941] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62ed67d7, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5e8cae12, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5e8cae12, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR_BitLockerToGo.exe.mui", cAlternateFileName="")) returned 1
	[0298.941] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62ed67d7, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6244025b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6244025b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT_BitLockerToGo.exe.mui", cAlternateFileName="")) returned 1
	[0298.941] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x5, ftCreationTime.dwLowDateTime=0x584f7138, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x584f7138, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x584f7138, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x47, dwReserved0=0x0, dwReserved1=0x0, cFileName="Read Me.url", cAlternateFileName="")) returned 1
	[0298.941] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62eb057d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5c52d68b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5c553845, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO_BitLockerToGo.exe.mui", cAlternateFileName="")) returned 1
	[0298.941] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62eb057d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6896ef30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6896ef30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU_BitLockerToGo.exe.mui", cAlternateFileName="")) returned 1
	[0298.941] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62eb057d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5d13f60f, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5d13f60f, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK_BitLockerToGo.exe.mui", cAlternateFileName="")) returned 1
	[0298.941] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62eb057d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6500fd43, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6500fd43, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI_BitLockerToGo.exe.mui", cAlternateFileName="")) returned 1
	[0298.941] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62e640c4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x62d7d560, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x62d7d560, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS_BitLockerToGo.exe.mui", cAlternateFileName="")) returned 1
	[0298.941] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62e640c4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x64dad702, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x64dad702, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-RS_BitLockerToGo.exe.mui", cAlternateFileName="")) returned 1
	[0298.941] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62eb057d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5bff628a, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5bff628a, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE_BitLockerToGo.exe.mui", cAlternateFileName="")) returned 1
	[0298.941] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62eb057d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5f3d1e61, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5f3d1e61, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="th-TH_BitLockerToGo.exe.mui", cAlternateFileName="")) returned 1
	[0298.941] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62eb057d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x656c483b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x656c483b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR_BitLockerToGo.exe.mui", cAlternateFileName="")) returned 1
	[0298.941] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62eb057d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5e6b4a70, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5e6b4a70, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA_BitLockerToGo.exe.mui", cAlternateFileName="")) returned 1
	[0298.941] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62e8a32a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x668cc79b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x668cc79b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN_BitLockerToGo.exe.mui", cAlternateFileName="")) returned 1
	[0298.941] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62e8a32a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x59983d8e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x59983d8e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK_BitLockerToGo.exe.mui", cAlternateFileName="")) returned 1
	[0298.941] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62e8a32a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x64fe9b2d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x64fe9b2d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW_BitLockerToGo.exe.mui", cAlternateFileName="")) returned 1
	[0298.941] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0298.941] FindClose (in: hFindFile=0x79ffe8 | out: hFindFile=0x79ffe8) returned 1
	[0298.942] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\BitLockerToGo.exe" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\bitlockertogo.exe"), fInfoLevelId=0x0, lpFileInformation=0x125dbef8 | out: lpFileInformation=0x125dbef8*(dwFileAttributes=0x25, ftCreationTime.dwLowDateTime=0x584f7138, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x59d3d8db, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x59d3d8db, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x37360)) returned 1
	[0298.976] SetEvent (hEvent=0x168) returned 1
	[0298.977] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\Read Me.url" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\read me.url"), fInfoLevelId=0x0, lpFileInformation=0x125dbf48 | out: lpFileInformation=0x125dbf48*(dwFileAttributes=0x25, ftCreationTime.dwLowDateTime=0x584f7138, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x584f7138, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x584f7138, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x47)) returned 1
	[0299.116] SetEvent (hEvent=0x168) returned 1
	[0299.116] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\ar-SA_BitLockerToGo.exe.mui" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\ar-sa_bitlockertogo.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x125dbf98 | out: lpFileInformation=0x125dbf98*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62eb057d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5c78fc08, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5c78fc08, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2600)) returned 1
	[0299.117] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\autorun.inf" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\autorun.inf"), fInfoLevelId=0x0, lpFileInformation=0x12430058 | out: lpFileInformation=0x12430058*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x584f7138, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x584f7138, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x584f7138, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x74)) returned 1
	[0299.117] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\bg-BG_BitLockerToGo.exe.mui" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\bg-bg_bitlockertogo.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x124300a8 | out: lpFileInformation=0x124300a8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62eb057d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5a975d0e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5a975d0e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2600)) returned 1
	[0299.214] SetEvent (hEvent=0x168) returned 1
	[0299.214] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\cs-CZ_BitLockerToGo.exe.mui" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\cs-cz_bitlockertogo.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x124300f8 | out: lpFileInformation=0x124300f8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62eb057d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x653571a9, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x653571a9, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2600)) returned 1
	[0299.232] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\da-DK_BitLockerToGo.exe.mui" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\da-dk_bitlockertogo.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x12430148 | out: lpFileInformation=0x12430148*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62eb057d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x633e5bba, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x633e5bba, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2600)) returned 1
	[0299.232] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\de-DE_BitLockerToGo.exe.mui" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\de-de_bitlockertogo.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x12430198 | out: lpFileInformation=0x12430198*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62eb057d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x59db0012, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x59db0012, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2a00)) returned 1
	[0299.232] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\el-GR_BitLockerToGo.exe.mui" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\el-gr_bitlockertogo.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x124301e8 | out: lpFileInformation=0x124301e8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62e8a32a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5f0182b4, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5f03e52e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2c00)) returned 1
	[0299.232] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\en-GB_BitLockerToGo.exe.mui" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\en-gb_bitlockertogo.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x12430238 | out: lpFileInformation=0x12430238*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62eb057d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x68379151, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x68379151, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2400)) returned 1
	[0299.235] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\en-US_BitLockerToGo.exe.mui" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\en-us_bitlockertogo.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x12430288 | out: lpFileInformation=0x12430288*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62e8a32a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5cced1a0, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5cced1a0, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2400)) returned 1
	[0299.236] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\es-ES_BitLockerToGo.exe.mui" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\es-es_bitlockertogo.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x124302d8 | out: lpFileInformation=0x124302d8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62e8a32a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x62efad4a, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x62efad4a, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2600)) returned 1
	[0299.236] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\es-MX_BitLockerToGo.exe.mui" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\es-mx_bitlockertogo.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x12430328 | out: lpFileInformation=0x12430328*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62e8a32a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6508247e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6508247e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2600)) returned 1
	[0299.236] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\et-EE_BitLockerToGo.exe.mui" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\et-ee_bitlockertogo.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x12430378 | out: lpFileInformation=0x12430378*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62e8a32a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x62e885f8, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x62e885f8, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2400)) returned 1
	[0299.237] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\fi-FI_BitLockerToGo.exe.mui" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\fi-fi_bitlockertogo.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x124303c8 | out: lpFileInformation=0x124303c8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62e8a32a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x66e4ffb1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x66e4ffb1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2800)) returned 1
	[0299.237] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\fr-CA_BitLockerToGo.exe.mui" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\fr-ca_bitlockertogo.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x12430418 | out: lpFileInformation=0x12430418*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62e8a32a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5cc7aa4a, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5cc7aa4a, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2a00)) returned 1
	[0299.237] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\fr-FR_BitLockerToGo.exe.mui" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\fr-fr_bitlockertogo.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x12430468 | out: lpFileInformation=0x12430468*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62e8a32a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5a1dc2a1, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5a1dc2a1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2a00)) returned 1
	[0299.237] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\he-IL_BitLockerToGo.exe.mui" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\he-il_bitlockertogo.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x124304b8 | out: lpFileInformation=0x124304b8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62e8a32a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x65841ed6, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x65841ed6, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2200)) returned 1
	[0299.238] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\hr-HR_BitLockerToGo.exe.mui" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\hr-hr_bitlockertogo.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x12430508 | out: lpFileInformation=0x12430508*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62e8a32a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5d75b7ed, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5d75b7ed, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2600)) returned 1
	[0299.239] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\hu-HU_BitLockerToGo.exe.mui" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\hu-hu_bitlockertogo.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x12430558 | out: lpFileInformation=0x12430558*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62e640c4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x64a66291, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x64a66291, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2800)) returned 1
	[0299.239] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\it-IT_BitLockerToGo.exe.mui" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\it-it_bitlockertogo.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x124305a8 | out: lpFileInformation=0x124305a8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62e640c4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5c93364c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5c93364c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2600)) returned 1
	[0299.239] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\ja-JP_BitLockerToGo.exe.mui" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\ja-jp_bitlockertogo.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x124305f8 | out: lpFileInformation=0x124305f8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62e640c4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5e9fc114, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5e9fc114, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1e00)) returned 1
	[0299.254] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\ko-KR_BitLockerToGo.exe.mui" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\ko-kr_bitlockertogo.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1253c008 | out: lpFileInformation=0x1253c008*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62e640c4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5ee4e60d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5ee4e60d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1e00)) returned 1
	[0299.255] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\lt-LT_BitLockerToGo.exe.mui" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\lt-lt_bitlockertogo.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1253c058 | out: lpFileInformation=0x1253c058*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62ed67d7, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5a75fbb5, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5a75fbb5, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2800)) returned 1
	[0299.255] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\lv-LV_BitLockerToGo.exe.mui" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\lv-lv_bitlockertogo.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1253c0a8 | out: lpFileInformation=0x1253c0a8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62ed67d7, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5de5c7ec, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5de5c7ec, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2600)) returned 1
	[0299.255] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\nb-NO_BitLockerToGo.exe.mui" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\nb-no_bitlockertogo.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1253c0f8 | out: lpFileInformation=0x1253c0f8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62ed67d7, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x63ba56c7, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x63ba56c7, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2600)) returned 1
	[0299.256] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\nl-NL_BitLockerToGo.exe.mui" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\nl-nl_bitlockertogo.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1253c148 | out: lpFileInformation=0x1253c148*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62ed67d7, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5d22459a, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5d22459a, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2800)) returned 1
	[0299.256] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\pl-PL_BitLockerToGo.exe.mui" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\pl-pl_bitlockertogo.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1253c198 | out: lpFileInformation=0x1253c198*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62ed67d7, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5f8bcc62, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5f8bcc62, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2800)) returned 1
	[0299.257] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\pt-BR_BitLockerToGo.exe.mui" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\pt-br_bitlockertogo.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1253c1e8 | out: lpFileInformation=0x1253c1e8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62ed67d7, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5e8cae12, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5e8cae12, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2800)) returned 1
	[0299.257] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\pt-PT_BitLockerToGo.exe.mui" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\pt-pt_bitlockertogo.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1253c238 | out: lpFileInformation=0x1253c238*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62ed67d7, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6244025b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6244025b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2800)) returned 1
	[0299.257] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\ro-RO_BitLockerToGo.exe.mui" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\ro-ro_bitlockertogo.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1253c288 | out: lpFileInformation=0x1253c288*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62eb057d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5c52d68b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5c553845, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2800)) returned 1
	[0299.257] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\ru-RU_BitLockerToGo.exe.mui" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\ru-ru_bitlockertogo.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1253c2d8 | out: lpFileInformation=0x1253c2d8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62eb057d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6896ef30, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6896ef30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2800)) returned 1
	[0299.257] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\sk-SK_BitLockerToGo.exe.mui" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\sk-sk_bitlockertogo.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1253c328 | out: lpFileInformation=0x1253c328*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62eb057d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5d13f60f, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5d13f60f, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2600)) returned 1
	[0299.258] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\sl-SI_BitLockerToGo.exe.mui" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\sl-si_bitlockertogo.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1253c378 | out: lpFileInformation=0x1253c378*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62eb057d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6500fd43, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6500fd43, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2600)) returned 1
	[0299.258] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\sr-Latn-CS_BitLockerToGo.exe.mui" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\sr-latn-cs_bitlockertogo.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1253c3c8 | out: lpFileInformation=0x1253c3c8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62e640c4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x62d7d560, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x62d7d560, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2800)) returned 1
	[0299.259] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\sr-Latn-RS_BitLockerToGo.exe.mui" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\sr-latn-rs_bitlockertogo.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1253c418 | out: lpFileInformation=0x1253c418*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62e640c4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x64dad702, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x64dad702, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2800)) returned 1
	[0299.259] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\sv-SE_BitLockerToGo.exe.mui" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\sv-se_bitlockertogo.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1253c468 | out: lpFileInformation=0x1253c468*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62eb057d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5bff628a, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5bff628a, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2600)) returned 1
	[0299.260] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\th-TH_BitLockerToGo.exe.mui" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\th-th_bitlockertogo.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1253c4b8 | out: lpFileInformation=0x1253c4b8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62eb057d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5f3d1e61, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5f3d1e61, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2400)) returned 1
	[0299.260] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\tr-TR_BitLockerToGo.exe.mui" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\tr-tr_bitlockertogo.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1253c508 | out: lpFileInformation=0x1253c508*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62eb057d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x656c483b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x656c483b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2600)) returned 1
	[0299.260] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\uk-UA_BitLockerToGo.exe.mui" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\uk-ua_bitlockertogo.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1253c558 | out: lpFileInformation=0x1253c558*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62eb057d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5e6b4a70, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x5e6b4a70, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x2600)) returned 1
	[0299.261] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\zh-CN_BitLockerToGo.exe.mui" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\zh-cn_bitlockertogo.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1253c5a8 | out: lpFileInformation=0x1253c5a8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62e8a32a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x668cc79b, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x668cc79b, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1c00)) returned 1
	[0299.261] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\zh-HK_BitLockerToGo.exe.mui" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\zh-hk_bitlockertogo.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1253c5f8 | out: lpFileInformation=0x1253c5f8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62e8a32a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x59983d8e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x59983d8e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1c00)) returned 1
	[0299.261] GetFileAttributesExW (in: lpFileName="C:\\Windows\\BitLockerDiscoveryVolumeContents\\zh-TW_BitLockerToGo.exe.mui" (normalized: "c:\\windows\\bitlockerdiscoveryvolumecontents\\zh-tw_bitlockertogo.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x1253c648 | out: lpFileInformation=0x1253c648*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x62e8a32a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x64fe9b2d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x64fe9b2d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1c00)) returned 1
	[0299.262] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot" (normalized: "c:\\windows\\boot"), fInfoLevelId=0x0, lpFileInformation=0x1253c698 | out: lpFileInformation=0x1253c698*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe111b6, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xe111b6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.263] CreateFileW (lpFileName="C:\\Windows\\Boot" (normalized: "c:\\windows\\boot"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.263] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\*", lpFindFileData=0x124239e0 | out: lpFindFileData=0x124239e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe111b6, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xe111b6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fa68
	[0299.342] SetEvent (hEvent=0x168) returned 1
	[0299.343] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe111b6, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xe111b6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.343] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x209949ab, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x209949ab, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x87, dwReserved0=0x0, dwReserved1=0x0, cFileName="BootDebuggerFiles.ini", cAlternateFileName="")) returned 1
	[0299.343] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xdeaf5f, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xdeaf5f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVD", cAlternateFileName="")) returned 1
	[0299.343] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xdeaf5f, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xdeaf5f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EFI", cAlternateFileName="")) returned 1
	[0299.343] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38fb668, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38fb668, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1
	[0299.343] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe111b6, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xe111b6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PCAT", cAlternateFileName="")) returned 1
	[0299.343] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd313219, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd313219, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1
	[0299.343] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x12423a00 | out: lpFindFileData=0x12423a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.343] FindClose (in: hFindFile=0x79fa68 | out: hFindFile=0x79fa68) returned 1
	[0299.346] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\BootDebuggerFiles.ini" (normalized: "c:\\windows\\boot\\bootdebuggerfiles.ini"), fInfoLevelId=0x0, lpFileInformation=0x1253c8c8 | out: lpFileInformation=0x1253c8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x209949ab, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x209949ab, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x87)) returned 1
	[0299.347] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\DVD" (normalized: "c:\\windows\\boot\\dvd"), fInfoLevelId=0x0, lpFileInformation=0x1253c918 | out: lpFileInformation=0x1253c918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xdeaf5f, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xdeaf5f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.347] CreateFileW (lpFileName="C:\\Windows\\Boot\\DVD" (normalized: "c:\\windows\\boot\\dvd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.347] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\DVD\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xdeaf5f, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xdeaf5f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fea8
	[0299.348] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xdeaf5f, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xdeaf5f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.348] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3888f58, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3888f58, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EFI", cAlternateFileName="")) returned 1
	[0299.348] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd313219, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd313219, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PCAT", cAlternateFileName="")) returned 1
	[0299.348] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.348] FindClose (in: hFindFile=0x79fea8 | out: hFindFile=0x79fea8) returned 1
	[0299.348] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\DVD\\EFI" (normalized: "c:\\windows\\boot\\dvd\\efi"), fInfoLevelId=0x0, lpFileInformation=0x1253ca08 | out: lpFileInformation=0x1253ca08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3888f58, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3888f58, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.349] CreateFileW (lpFileName="C:\\Windows\\Boot\\DVD\\EFI" (normalized: "c:\\windows\\boot\\dvd\\efi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.349] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\DVD\\EFI\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3888f58, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3888f58, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffa8
	[0299.349] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3888f58, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3888f58, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.350] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e4c7361, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e4c7361, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e4c7361, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1
	[0299.350] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e4c7361, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e4c7361, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e4c7361, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x306000, dwReserved0=0x0, dwReserved1=0x0, cFileName="boot.sdi", cAlternateFileName="")) returned 1
	[0299.350] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3888f58, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3888f58, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0299.350] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.350] FindClose (in: hFindFile=0x79ffa8 | out: hFindFile=0x79ffa8) returned 1
	[0299.350] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\DVD\\EFI\\BCD" (normalized: "c:\\windows\\boot\\dvd\\efi\\bcd"), fInfoLevelId=0x0, lpFileInformation=0x1253cb48 | out: lpFileInformation=0x1253cb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e4c7361, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e4c7361, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e4c7361, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1
	[0299.350] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\DVD\\EFI\\boot.sdi" (normalized: "c:\\windows\\boot\\dvd\\efi\\boot.sdi"), fInfoLevelId=0x0, lpFileInformation=0x1253cb98 | out: lpFileInformation=0x1253cb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e4c7361, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e4c7361, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e4c7361, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x306000)) returned 1
	[0299.351] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\DVD\\EFI\\en-US" (normalized: "c:\\windows\\boot\\dvd\\efi\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x1253cbe8 | out: lpFileInformation=0x1253cbe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3888f58, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3888f58, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.351] CreateFileW (lpFileName="C:\\Windows\\Boot\\DVD\\EFI\\en-US" (normalized: "c:\\windows\\boot\\dvd\\efi\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.352] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\DVD\\EFI\\en-US\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3888f58, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3888f58, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fe68
	[0299.352] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3888f58, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3888f58, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.352] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e4ed5bb, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e4ed5bb, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e4ed5bb, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x168000, dwReserved0=0x0, dwReserved1=0x0, cFileName="efisys.bin", cAlternateFileName="")) returned 1
	[0299.352] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e4ed5bb, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e4ed5bb, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e4ed5bb, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x168000, dwReserved0=0x0, dwReserved1=0x0, cFileName="efisys_noprompt.bin", cAlternateFileName="")) returned 1
	[0299.352] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.352] FindClose (in: hFindFile=0x79fe68 | out: hFindFile=0x79fe68) returned 1
	[0299.352] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\DVD\\EFI\\en-US\\efisys.bin" (normalized: "c:\\windows\\boot\\dvd\\efi\\en-us\\efisys.bin"), fInfoLevelId=0x0, lpFileInformation=0x1253ccd8 | out: lpFileInformation=0x1253ccd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e4ed5bb, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e4ed5bb, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e4ed5bb, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x168000)) returned 1
	[0299.353] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\DVD\\EFI\\en-US\\efisys_noprompt.bin" (normalized: "c:\\windows\\boot\\dvd\\efi\\en-us\\efisys_noprompt.bin"), fInfoLevelId=0x0, lpFileInformation=0x1253cd28 | out: lpFileInformation=0x1253cd28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e4ed5bb, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e4ed5bb, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e4ed5bb, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x168000)) returned 1
	[0299.353] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\DVD\\PCAT" (normalized: "c:\\windows\\boot\\dvd\\pcat"), fInfoLevelId=0x0, lpFileInformation=0x1253cd78 | out: lpFileInformation=0x1253cd78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd313219, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd313219, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.354] CreateFileW (lpFileName="C:\\Windows\\Boot\\DVD\\PCAT" (normalized: "c:\\windows\\boot\\dvd\\pcat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.354] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\DVD\\PCAT\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd313219, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd313219, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fb68
	[0299.354] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd313219, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd313219, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.354] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e4ed5bb, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e4ed5bb, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e4ed5bb, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1
	[0299.354] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e4c7361, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e4c7361, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e4ed5bb, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x306000, dwReserved0=0x0, dwReserved1=0x0, cFileName="boot.sdi", cAlternateFileName="")) returned 1
	[0299.354] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd313219, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd313219, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd313219, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0299.354] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e4ed5bb, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e4ed5bb, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e4ed5bb, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="etfsboot.com", cAlternateFileName="")) returned 1
	[0299.354] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.354] FindClose (in: hFindFile=0x79fb68 | out: hFindFile=0x79fb68) returned 1
	[0299.354] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\DVD\\PCAT\\BCD" (normalized: "c:\\windows\\boot\\dvd\\pcat\\bcd"), fInfoLevelId=0x0, lpFileInformation=0x1253cf08 | out: lpFileInformation=0x1253cf08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e4ed5bb, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e4ed5bb, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e4ed5bb, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1
	[0299.365] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\DVD\\PCAT\\boot.sdi" (normalized: "c:\\windows\\boot\\dvd\\pcat\\boot.sdi"), fInfoLevelId=0x0, lpFileInformation=0x1253cf58 | out: lpFileInformation=0x1253cf58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e4c7361, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e4c7361, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e4ed5bb, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x306000)) returned 1
	[0299.365] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\DVD\\PCAT\\en-US" (normalized: "c:\\windows\\boot\\dvd\\pcat\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x1253cfa8 | out: lpFileInformation=0x1253cfa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd313219, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd313219, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd313219, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.365] CreateFileW (lpFileName="C:\\Windows\\Boot\\DVD\\PCAT\\en-US" (normalized: "c:\\windows\\boot\\dvd\\pcat\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.365] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd313219, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd313219, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd313219, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fc28
	[0299.366] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd313219, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd313219, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd313219, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.366] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5a82f01, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa5a82f01, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa5a82f01, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x400, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootfix.bin", cAlternateFileName="")) returned 1
	[0299.366] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.366] FindClose (in: hFindFile=0x79fc28 | out: hFindFile=0x79fc28) returned 1
	[0299.366] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\DVD\\PCAT\\en-US\\bootfix.bin" (normalized: "c:\\windows\\boot\\dvd\\pcat\\en-us\\bootfix.bin"), fInfoLevelId=0x0, lpFileInformation=0x1253d048 | out: lpFileInformation=0x1253d048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5a82f01, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xa5a82f01, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xa5a82f01, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x400)) returned 1
	[0299.371] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\DVD\\PCAT\\etfsboot.com" (normalized: "c:\\windows\\boot\\dvd\\pcat\\etfsboot.com"), fInfoLevelId=0x0, lpFileInformation=0x1253d098 | out: lpFileInformation=0x1253d098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e4ed5bb, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e4ed5bb, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e4ed5bb, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0299.371] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI" (normalized: "c:\\windows\\boot\\efi"), fInfoLevelId=0x0, lpFileInformation=0x1253d0e8 | out: lpFileInformation=0x1253d0e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xdeaf5f, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xdeaf5f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.372] CreateFileW (lpFileName="C:\\Windows\\Boot\\EFI" (normalized: "c:\\windows\\boot\\efi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.372] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xdeaf5f, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xdeaf5f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffa8
	[0299.456] SetEvent (hEvent=0x168) returned 1
	[0299.456] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xdeaf5f, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xdeaf5f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.457] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210e1cce, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x210e1cce, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1127, dwReserved0=0x0, dwReserved1=0x0, cFileName="boot.stl", cAlternateFileName="")) returned 1
	[0299.457] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210e1cce, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x210e1cce, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x11af60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgfw.efi", cAlternateFileName="")) returned 1
	[0299.457] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210e1cce, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x210e1cce, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x118360, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi", cAlternateFileName="")) returned 1
	[0299.457] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3888f58, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3888f58, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1
	[0299.457] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0299.457] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0299.457] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0299.457] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0299.457] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0299.457] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0299.457] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0299.457] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0299.457] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1
	[0299.457] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0299.457] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0299.457] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2117a634, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2117a634, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xfbd60, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.efi", cAlternateFileName="")) returned 1
	[0299.457] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1
	[0299.457] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0299.457] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0299.457] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0299.458] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0299.458] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qps-ploc", cAlternateFileName="")) returned 1
	[0299.458] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38d540d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38d540d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1
	[0299.458] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38d540d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38d540d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1
	[0299.458] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38d540d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38d540d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1
	[0299.458] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38d540d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38d540d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1
	[0299.458] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38d540d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38d540d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1
	[0299.458] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38d540d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38d540d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1
	[0299.458] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38d540d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38d540d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1
	[0299.458] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.458] FindClose (in: hFindFile=0x79ffa8 | out: hFindFile=0x79ffa8) returned 1
	[0299.459] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\boot.stl" (normalized: "c:\\windows\\boot\\efi\\boot.stl"), fInfoLevelId=0x0, lpFileInformation=0x1253da48 | out: lpFileInformation=0x1253da48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210e1cce, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x210e1cce, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1127)) returned 1
	[0299.460] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\bootmgfw.efi" (normalized: "c:\\windows\\boot\\efi\\bootmgfw.efi"), fInfoLevelId=0x0, lpFileInformation=0x1253da98 | out: lpFileInformation=0x1253da98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210e1cce, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x210e1cce, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x11af60)) returned 1
	[0299.462] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\bootmgr.efi" (normalized: "c:\\windows\\boot\\efi\\bootmgr.efi"), fInfoLevelId=0x0, lpFileInformation=0x1253dae8 | out: lpFileInformation=0x1253dae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210e1cce, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x210e1cce, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x118360)) returned 1
	[0299.463] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\cs-CZ" (normalized: "c:\\windows\\boot\\efi\\cs-cz"), fInfoLevelId=0x0, lpFileInformation=0x1253db38 | out: lpFileInformation=0x1253db38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3888f58, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3888f58, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.463] CreateFileW (lpFileName="C:\\Windows\\Boot\\EFI\\cs-CZ" (normalized: "c:\\windows\\boot\\efi\\cs-cz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.463] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\cs-CZ\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3888f58, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3888f58, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0068
	[0299.464] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3888f58, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3888f58, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.464] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210e1cce, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x210e1cce, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb160, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.efi.mui", cAlternateFileName="")) returned 1
	[0299.464] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.464] FindClose (in: hFindFile=0x7a0068 | out: hFindFile=0x7a0068) returned 1
	[0299.464] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\cs-CZ\\memtest.efi.mui" (normalized: "c:\\windows\\boot\\efi\\cs-cz\\memtest.efi.mui"), fInfoLevelId=0x0, lpFileInformation=0x1253dbd8 | out: lpFileInformation=0x1253dbd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210e1cce, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x210e1cce, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb160)) returned 1
	[0299.464] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\da-DK" (normalized: "c:\\windows\\boot\\efi\\da-dk"), fInfoLevelId=0x0, lpFileInformation=0x1253dc28 | out: lpFileInformation=0x1253dc28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.464] CreateFileW (lpFileName="C:\\Windows\\Boot\\EFI\\da-DK" (normalized: "c:\\windows\\boot\\efi\\da-dk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.465] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\da-DK\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f8e8
	[0299.465] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.465] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210e1cce, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x210e1cce, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb160, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.efi.mui", cAlternateFileName="")) returned 1
	[0299.465] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.465] FindClose (in: hFindFile=0x79f8e8 | out: hFindFile=0x79f8e8) returned 1
	[0299.465] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\da-DK\\memtest.efi.mui" (normalized: "c:\\windows\\boot\\efi\\da-dk\\memtest.efi.mui"), fInfoLevelId=0x0, lpFileInformation=0x1253dcc8 | out: lpFileInformation=0x1253dcc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210e1cce, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x210e1cce, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb160)) returned 1
	[0299.466] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\de-DE" (normalized: "c:\\windows\\boot\\efi\\de-de"), fInfoLevelId=0x0, lpFileInformation=0x1253dd18 | out: lpFileInformation=0x1253dd18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.466] CreateFileW (lpFileName="C:\\Windows\\Boot\\EFI\\de-DE" (normalized: "c:\\windows\\boot\\efi\\de-de"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.466] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\de-DE\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f8e8
	[0299.466] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.467] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210e1cce, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x210e1cce, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.efi.mui", cAlternateFileName="")) returned 1
	[0299.467] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.467] FindClose (in: hFindFile=0x79f8e8 | out: hFindFile=0x79f8e8) returned 1
	[0299.467] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\de-DE\\memtest.efi.mui" (normalized: "c:\\windows\\boot\\efi\\de-de\\memtest.efi.mui"), fInfoLevelId=0x0, lpFileInformation=0x1253ddb8 | out: lpFileInformation=0x1253ddb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210e1cce, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x210e1cce, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb360)) returned 1
	[0299.467] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\el-GR" (normalized: "c:\\windows\\boot\\efi\\el-gr"), fInfoLevelId=0x0, lpFileInformation=0x1253de08 | out: lpFileInformation=0x1253de08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.468] CreateFileW (lpFileName="C:\\Windows\\Boot\\EFI\\el-GR" (normalized: "c:\\windows\\boot\\efi\\el-gr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.468] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\el-GR\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fce8
	[0299.468] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.468] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210bba74, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x210bba74, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb560, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.efi.mui", cAlternateFileName="")) returned 1
	[0299.468] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.468] FindClose (in: hFindFile=0x79fce8 | out: hFindFile=0x79fce8) returned 1
	[0299.468] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\el-GR\\memtest.efi.mui" (normalized: "c:\\windows\\boot\\efi\\el-gr\\memtest.efi.mui"), fInfoLevelId=0x0, lpFileInformation=0x1253dea8 | out: lpFileInformation=0x1253dea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210bba74, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x210bba74, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb560)) returned 1
	[0299.469] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\en-US" (normalized: "c:\\windows\\boot\\efi\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x1253def8 | out: lpFileInformation=0x1253def8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.469] CreateFileW (lpFileName="C:\\Windows\\Boot\\EFI\\en-US" (normalized: "c:\\windows\\boot\\efi\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.469] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\en-US\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fce8
	[0299.469] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.469] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2112e17f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2112e17f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgfw.efi.mui", cAlternateFileName="")) returned 1
	[0299.469] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2112e17f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2112e17f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.efi.mui", cAlternateFileName="")) returned 1
	[0299.469] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2109581d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2109581d, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaf60, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.efi.mui", cAlternateFileName="")) returned 1
	[0299.469] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.469] FindClose (in: hFindFile=0x79fce8 | out: hFindFile=0x79fce8) returned 1
	[0299.470] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\en-US\\bootmgfw.efi.mui" (normalized: "c:\\windows\\boot\\efi\\en-us\\bootmgfw.efi.mui"), fInfoLevelId=0x0, lpFileInformation=0x123e6058 | out: lpFileInformation=0x123e6058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2112e17f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2112e17f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12160)) returned 1
	[0299.470] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\en-US\\bootmgr.efi.mui" (normalized: "c:\\windows\\boot\\efi\\en-us\\bootmgr.efi.mui"), fInfoLevelId=0x0, lpFileInformation=0x123e60a8 | out: lpFileInformation=0x123e60a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2112e17f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2112e17f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12160)) returned 1
	[0299.470] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\en-US\\memtest.efi.mui" (normalized: "c:\\windows\\boot\\efi\\en-us\\memtest.efi.mui"), fInfoLevelId=0x0, lpFileInformation=0x123e60f8 | out: lpFileInformation=0x123e60f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2109581d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2109581d, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaf60)) returned 1
	[0299.471] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\es-ES" (normalized: "c:\\windows\\boot\\efi\\es-es"), fInfoLevelId=0x0, lpFileInformation=0x123e6148 | out: lpFileInformation=0x123e6148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.471] CreateFileW (lpFileName="C:\\Windows\\Boot\\EFI\\es-ES" (normalized: "c:\\windows\\boot\\efi\\es-es"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.471] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\es-ES\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9e8
	[0299.471] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.471] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2109581d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2109581d, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.efi.mui", cAlternateFileName="")) returned 1
	[0299.471] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.471] FindClose (in: hFindFile=0x79f9e8 | out: hFindFile=0x79f9e8) returned 1
	[0299.471] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\es-ES\\memtest.efi.mui" (normalized: "c:\\windows\\boot\\efi\\es-es\\memtest.efi.mui"), fInfoLevelId=0x0, lpFileInformation=0x123e61e8 | out: lpFileInformation=0x123e61e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2109581d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2109581d, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb360)) returned 1
	[0299.472] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\fi-FI" (normalized: "c:\\windows\\boot\\efi\\fi-fi"), fInfoLevelId=0x0, lpFileInformation=0x123e6238 | out: lpFileInformation=0x123e6238*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.472] CreateFileW (lpFileName="C:\\Windows\\Boot\\EFI\\fi-FI" (normalized: "c:\\windows\\boot\\efi\\fi-fi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.472] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\fi-FI\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fba8
	[0299.472] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.472] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x209bac02, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x209bac02, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb160, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.efi.mui", cAlternateFileName="")) returned 1
	[0299.472] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.472] FindClose (in: hFindFile=0x79fba8 | out: hFindFile=0x79fba8) returned 1
	[0299.472] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\fi-FI\\memtest.efi.mui" (normalized: "c:\\windows\\boot\\efi\\fi-fi\\memtest.efi.mui"), fInfoLevelId=0x0, lpFileInformation=0x123e62d8 | out: lpFileInformation=0x123e62d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x209bac02, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x209bac02, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb160)) returned 1
	[0299.472] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\fr-FR" (normalized: "c:\\windows\\boot\\efi\\fr-fr"), fInfoLevelId=0x0, lpFileInformation=0x123e6328 | out: lpFileInformation=0x123e6328*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.473] CreateFileW (lpFileName="C:\\Windows\\Boot\\EFI\\fr-FR" (normalized: "c:\\windows\\boot\\efi\\fr-fr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.473] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\fr-FR\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fce8
	[0299.473] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.473] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x209bac02, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x209bac02, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.efi.mui", cAlternateFileName="")) returned 1
	[0299.473] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.474] FindClose (in: hFindFile=0x79fce8 | out: hFindFile=0x79fce8) returned 1
	[0299.474] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\fr-FR\\memtest.efi.mui" (normalized: "c:\\windows\\boot\\efi\\fr-fr\\memtest.efi.mui"), fInfoLevelId=0x0, lpFileInformation=0x123e63c8 | out: lpFileInformation=0x123e63c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x209bac02, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x209bac02, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb360)) returned 1
	[0299.474] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\hu-HU" (normalized: "c:\\windows\\boot\\efi\\hu-hu"), fInfoLevelId=0x0, lpFileInformation=0x123e6418 | out: lpFileInformation=0x123e6418*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.474] CreateFileW (lpFileName="C:\\Windows\\Boot\\EFI\\hu-HU" (normalized: "c:\\windows\\boot\\efi\\hu-hu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.474] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\hu-HU\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ff68
	[0299.474] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.475] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2096e751, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2096e751, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.efi.mui", cAlternateFileName="")) returned 1
	[0299.475] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.475] FindClose (in: hFindFile=0x79ff68 | out: hFindFile=0x79ff68) returned 1
	[0299.475] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\hu-HU\\memtest.efi.mui" (normalized: "c:\\windows\\boot\\efi\\hu-hu\\memtest.efi.mui"), fInfoLevelId=0x0, lpFileInformation=0x123e64b8 | out: lpFileInformation=0x123e64b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2096e751, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2096e751, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb360)) returned 1
	[0299.475] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\it-IT" (normalized: "c:\\windows\\boot\\efi\\it-it"), fInfoLevelId=0x0, lpFileInformation=0x123e6508 | out: lpFileInformation=0x123e6508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.475] CreateFileW (lpFileName="C:\\Windows\\Boot\\EFI\\it-IT" (normalized: "c:\\windows\\boot\\efi\\it-it"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.475] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\it-IT\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fc68
	[0299.476] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.476] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2123921c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2123921c, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb158, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.efi.mui", cAlternateFileName="")) returned 1
	[0299.476] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.476] FindClose (in: hFindFile=0x79fc68 | out: hFindFile=0x79fc68) returned 1
	[0299.476] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\it-IT\\memtest.efi.mui" (normalized: "c:\\windows\\boot\\efi\\it-it\\memtest.efi.mui"), fInfoLevelId=0x0, lpFileInformation=0x123e65a8 | out: lpFileInformation=0x123e65a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2123921c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2123921c, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb158)) returned 1
	[0299.476] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\ja-JP" (normalized: "c:\\windows\\boot\\efi\\ja-jp"), fInfoLevelId=0x0, lpFileInformation=0x123e65f8 | out: lpFileInformation=0x123e65f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.477] CreateFileW (lpFileName="C:\\Windows\\Boot\\EFI\\ja-JP" (normalized: "c:\\windows\\boot\\efi\\ja-jp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.477] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\ja-JP\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9e8
	[0299.477] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.477] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2123921c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2123921c, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa760, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.efi.mui", cAlternateFileName="")) returned 1
	[0299.477] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.477] FindClose (in: hFindFile=0x79f9e8 | out: hFindFile=0x79f9e8) returned 1
	[0299.477] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\ja-JP\\memtest.efi.mui" (normalized: "c:\\windows\\boot\\efi\\ja-jp\\memtest.efi.mui"), fInfoLevelId=0x0, lpFileInformation=0x123e6698 | out: lpFileInformation=0x123e6698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2123921c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2123921c, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa760)) returned 1
	[0299.478] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\ko-KR" (normalized: "c:\\windows\\boot\\efi\\ko-kr"), fInfoLevelId=0x0, lpFileInformation=0x123e66e8 | out: lpFileInformation=0x123e66e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.479] CreateFileW (lpFileName="C:\\Windows\\Boot\\EFI\\ko-KR" (normalized: "c:\\windows\\boot\\efi\\ko-kr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.479] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\ko-KR\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fba8
	[0299.479] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.479] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2123921c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2123921c, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa758, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.efi.mui", cAlternateFileName="")) returned 1
	[0299.479] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.479] FindClose (in: hFindFile=0x79fba8 | out: hFindFile=0x79fba8) returned 1
	[0299.479] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\ko-KR\\memtest.efi.mui" (normalized: "c:\\windows\\boot\\efi\\ko-kr\\memtest.efi.mui"), fInfoLevelId=0x0, lpFileInformation=0x123e6788 | out: lpFileInformation=0x123e6788*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2123921c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2123921c, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa758)) returned 1
	[0299.480] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\memtest.efi" (normalized: "c:\\windows\\boot\\efi\\memtest.efi"), fInfoLevelId=0x0, lpFileInformation=0x123e67d8 | out: lpFileInformation=0x123e67d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2117a634, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2117a634, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xfbd60)) returned 1
	[0299.480] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\nb-NO" (normalized: "c:\\windows\\boot\\efi\\nb-no"), fInfoLevelId=0x0, lpFileInformation=0x123e6828 | out: lpFileInformation=0x123e6828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.480] CreateFileW (lpFileName="C:\\Windows\\Boot\\EFI\\nb-NO" (normalized: "c:\\windows\\boot\\efi\\nb-no"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.480] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\nb-NO\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fe68
	[0299.480] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.480] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211a0897, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x211a0897, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x211a0897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb160, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.efi.mui", cAlternateFileName="")) returned 1
	[0299.480] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.480] FindClose (in: hFindFile=0x79fe68 | out: hFindFile=0x79fe68) returned 1
	[0299.481] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\nb-NO\\memtest.efi.mui" (normalized: "c:\\windows\\boot\\efi\\nb-no\\memtest.efi.mui"), fInfoLevelId=0x0, lpFileInformation=0x123e68c8 | out: lpFileInformation=0x123e68c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211a0897, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x211a0897, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x211a0897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb160)) returned 1
	[0299.481] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\nl-NL" (normalized: "c:\\windows\\boot\\efi\\nl-nl"), fInfoLevelId=0x0, lpFileInformation=0x123e6918 | out: lpFileInformation=0x123e6918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.481] CreateFileW (lpFileName="C:\\Windows\\Boot\\EFI\\nl-NL" (normalized: "c:\\windows\\boot\\efi\\nl-nl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.481] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\nl-NL\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fde8
	[0299.481] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.481] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211a0897, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x211a0897, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x211a0897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb160, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.efi.mui", cAlternateFileName="")) returned 1
	[0299.481] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.481] FindClose (in: hFindFile=0x79fde8 | out: hFindFile=0x79fde8) returned 1
	[0299.482] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\nl-NL\\memtest.efi.mui" (normalized: "c:\\windows\\boot\\efi\\nl-nl\\memtest.efi.mui"), fInfoLevelId=0x0, lpFileInformation=0x123e69b8 | out: lpFileInformation=0x123e69b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211a0897, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x211a0897, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x211a0897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb160)) returned 1
	[0299.482] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\pl-PL" (normalized: "c:\\windows\\boot\\efi\\pl-pl"), fInfoLevelId=0x0, lpFileInformation=0x123e6a08 | out: lpFileInformation=0x123e6a08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.482] CreateFileW (lpFileName="C:\\Windows\\Boot\\EFI\\pl-PL" (normalized: "c:\\windows\\boot\\efi\\pl-pl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.482] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\pl-PL\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fa28
	[0299.482] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.482] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211543da, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x211543da, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb358, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.efi.mui", cAlternateFileName="")) returned 1
	[0299.482] FindNextFileW (in: hFindFile=0x79fa28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.482] FindClose (in: hFindFile=0x79fa28 | out: hFindFile=0x79fa28) returned 1
	[0299.483] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\pl-PL\\memtest.efi.mui" (normalized: "c:\\windows\\boot\\efi\\pl-pl\\memtest.efi.mui"), fInfoLevelId=0x0, lpFileInformation=0x123e6aa8 | out: lpFileInformation=0x123e6aa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211543da, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x211543da, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb358)) returned 1
	[0299.483] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\pt-BR" (normalized: "c:\\windows\\boot\\efi\\pt-br"), fInfoLevelId=0x0, lpFileInformation=0x123e6af8 | out: lpFileInformation=0x123e6af8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.484] CreateFileW (lpFileName="C:\\Windows\\Boot\\EFI\\pt-BR" (normalized: "c:\\windows\\boot\\efi\\pt-br"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.484] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\pt-BR\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fbe8
	[0299.484] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.484] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211543da, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x211543da, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb160, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.efi.mui", cAlternateFileName="")) returned 1
	[0299.484] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.484] FindClose (in: hFindFile=0x79fbe8 | out: hFindFile=0x79fbe8) returned 1
	[0299.484] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\pt-BR\\memtest.efi.mui" (normalized: "c:\\windows\\boot\\efi\\pt-br\\memtest.efi.mui"), fInfoLevelId=0x0, lpFileInformation=0x123e6b98 | out: lpFileInformation=0x123e6b98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211543da, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x211543da, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb160)) returned 1
	[0299.485] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\pt-PT" (normalized: "c:\\windows\\boot\\efi\\pt-pt"), fInfoLevelId=0x0, lpFileInformation=0x123e6be8 | out: lpFileInformation=0x123e6be8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.485] CreateFileW (lpFileName="C:\\Windows\\Boot\\EFI\\pt-PT" (normalized: "c:\\windows\\boot\\efi\\pt-pt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.485] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\pt-PT\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0068
	[0299.485] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.485] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211543da, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x211543da, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.efi.mui", cAlternateFileName="")) returned 1
	[0299.485] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.485] FindClose (in: hFindFile=0x7a0068 | out: hFindFile=0x7a0068) returned 1
	[0299.485] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\pt-PT\\memtest.efi.mui" (normalized: "c:\\windows\\boot\\efi\\pt-pt\\memtest.efi.mui"), fInfoLevelId=0x0, lpFileInformation=0x123e6c88 | out: lpFileInformation=0x123e6c88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211543da, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x211543da, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb360)) returned 1
	[0299.486] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\qps-ploc" (normalized: "c:\\windows\\boot\\efi\\qps-ploc"), fInfoLevelId=0x0, lpFileInformation=0x123e6cd8 | out: lpFileInformation=0x123e6cd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.487] CreateFileW (lpFileName="C:\\Windows\\Boot\\EFI\\qps-ploc" (normalized: "c:\\windows\\boot\\efi\\qps-ploc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.487] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\qps-ploc\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fda8
	[0299.487] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38af1b7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38af1b7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.487] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2112e17f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2112e17f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaf60, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.efi.mui", cAlternateFileName="")) returned 1
	[0299.487] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.487] FindClose (in: hFindFile=0x79fda8 | out: hFindFile=0x79fda8) returned 1
	[0299.487] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\qps-ploc\\memtest.efi.mui" (normalized: "c:\\windows\\boot\\efi\\qps-ploc\\memtest.efi.mui"), fInfoLevelId=0x0, lpFileInformation=0x123e6d78 | out: lpFileInformation=0x123e6d78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2112e17f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2112e17f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaf60)) returned 1
	[0299.487] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\ru-RU" (normalized: "c:\\windows\\boot\\efi\\ru-ru"), fInfoLevelId=0x0, lpFileInformation=0x123e6dc8 | out: lpFileInformation=0x123e6dc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38d540d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38d540d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.488] CreateFileW (lpFileName="C:\\Windows\\Boot\\EFI\\ru-RU" (normalized: "c:\\windows\\boot\\efi\\ru-ru"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.488] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\ru-RU\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38d540d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38d540d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fd28
	[0299.488] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38d540d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38d540d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.488] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2112e17f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2112e17f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.efi.mui", cAlternateFileName="")) returned 1
	[0299.488] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.488] FindClose (in: hFindFile=0x79fd28 | out: hFindFile=0x79fd28) returned 1
	[0299.488] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\ru-RU\\memtest.efi.mui" (normalized: "c:\\windows\\boot\\efi\\ru-ru\\memtest.efi.mui"), fInfoLevelId=0x0, lpFileInformation=0x123e6e68 | out: lpFileInformation=0x123e6e68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2112e17f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2112e17f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaf58)) returned 1
	[0299.488] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\sr-Latn-CS" (normalized: "c:\\windows\\boot\\efi\\sr-latn-cs"), fInfoLevelId=0x0, lpFileInformation=0x123e6eb8 | out: lpFileInformation=0x123e6eb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38d540d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38d540d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.489] CreateFileW (lpFileName="C:\\Windows\\Boot\\EFI\\sr-Latn-CS" (normalized: "c:\\windows\\boot\\efi\\sr-latn-cs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.489] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\sr-Latn-CS\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38d540d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38d540d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fe28
	[0299.490] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38d540d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38d540d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.490] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2123921c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2123921c, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaf60, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.efi.mui", cAlternateFileName="")) returned 1
	[0299.490] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.490] FindClose (in: hFindFile=0x79fe28 | out: hFindFile=0x79fe28) returned 1
	[0299.490] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\sr-Latn-CS\\memtest.efi.mui" (normalized: "c:\\windows\\boot\\efi\\sr-latn-cs\\memtest.efi.mui"), fInfoLevelId=0x0, lpFileInformation=0x123e6f58 | out: lpFileInformation=0x123e6f58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2123921c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2123921c, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaf60)) returned 1
	[0299.490] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\sv-SE" (normalized: "c:\\windows\\boot\\efi\\sv-se"), fInfoLevelId=0x0, lpFileInformation=0x123e6fa8 | out: lpFileInformation=0x123e6fa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38d540d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38d540d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.490] CreateFileW (lpFileName="C:\\Windows\\Boot\\EFI\\sv-SE" (normalized: "c:\\windows\\boot\\efi\\sv-se"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.491] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\sv-SE\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38d540d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38d540d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fce8
	[0299.491] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38d540d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38d540d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.491] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2112e17f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2112e17f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaf60, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.efi.mui", cAlternateFileName="")) returned 1
	[0299.491] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.491] FindClose (in: hFindFile=0x79fce8 | out: hFindFile=0x79fce8) returned 1
	[0299.491] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\sv-SE\\memtest.efi.mui" (normalized: "c:\\windows\\boot\\efi\\sv-se\\memtest.efi.mui"), fInfoLevelId=0x0, lpFileInformation=0x123e7048 | out: lpFileInformation=0x123e7048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2112e17f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2112e17f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaf60)) returned 1
	[0299.499] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\tr-TR" (normalized: "c:\\windows\\boot\\efi\\tr-tr"), fInfoLevelId=0x0, lpFileInformation=0x123e7098 | out: lpFileInformation=0x123e7098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38d540d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38d540d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.499] CreateFileW (lpFileName="C:\\Windows\\Boot\\EFI\\tr-TR" (normalized: "c:\\windows\\boot\\efi\\tr-tr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.499] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\tr-TR\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38d540d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38d540d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ff68
	[0299.500] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38d540d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38d540d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.500] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21107f25, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x21107f25, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb160, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.efi.mui", cAlternateFileName="")) returned 1
	[0299.500] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.500] FindClose (in: hFindFile=0x79ff68 | out: hFindFile=0x79ff68) returned 1
	[0299.500] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\tr-TR\\memtest.efi.mui" (normalized: "c:\\windows\\boot\\efi\\tr-tr\\memtest.efi.mui"), fInfoLevelId=0x0, lpFileInformation=0x123e7138 | out: lpFileInformation=0x123e7138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21107f25, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x21107f25, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb160)) returned 1
	[0299.500] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\zh-CN" (normalized: "c:\\windows\\boot\\efi\\zh-cn"), fInfoLevelId=0x0, lpFileInformation=0x123e7188 | out: lpFileInformation=0x123e7188*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38d540d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38d540d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.500] CreateFileW (lpFileName="C:\\Windows\\Boot\\EFI\\zh-CN" (normalized: "c:\\windows\\boot\\efi\\zh-cn"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.500] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\zh-CN\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38d540d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38d540d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fd68
	[0299.501] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38d540d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38d540d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.501] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x209bac02, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x209bac02, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa560, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.efi.mui", cAlternateFileName="")) returned 1
	[0299.501] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.501] FindClose (in: hFindFile=0x79fd68 | out: hFindFile=0x79fd68) returned 1
	[0299.501] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\zh-CN\\memtest.efi.mui" (normalized: "c:\\windows\\boot\\efi\\zh-cn\\memtest.efi.mui"), fInfoLevelId=0x0, lpFileInformation=0x123e7228 | out: lpFileInformation=0x123e7228*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x209bac02, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x209bac02, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa560)) returned 1
	[0299.501] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\zh-HK" (normalized: "c:\\windows\\boot\\efi\\zh-hk"), fInfoLevelId=0x0, lpFileInformation=0x123e7278 | out: lpFileInformation=0x123e7278*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38d540d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38d540d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.503] CreateFileW (lpFileName="C:\\Windows\\Boot\\EFI\\zh-HK" (normalized: "c:\\windows\\boot\\efi\\zh-hk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.503] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\zh-HK\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38d540d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38d540d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0068
	[0299.503] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38d540d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38d540d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.503] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x209bac02, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x209bac02, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa560, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.efi.mui", cAlternateFileName="")) returned 1
	[0299.503] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.503] FindClose (in: hFindFile=0x7a0068 | out: hFindFile=0x7a0068) returned 1
	[0299.504] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\zh-HK\\memtest.efi.mui" (normalized: "c:\\windows\\boot\\efi\\zh-hk\\memtest.efi.mui"), fInfoLevelId=0x0, lpFileInformation=0x123e7318 | out: lpFileInformation=0x123e7318*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x209bac02, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x209bac02, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa560)) returned 1
	[0299.504] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\zh-TW" (normalized: "c:\\windows\\boot\\efi\\zh-tw"), fInfoLevelId=0x0, lpFileInformation=0x123e7368 | out: lpFileInformation=0x123e7368*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38d540d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38d540d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.504] CreateFileW (lpFileName="C:\\Windows\\Boot\\EFI\\zh-TW" (normalized: "c:\\windows\\boot\\efi\\zh-tw"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.504] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\EFI\\zh-TW\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38d540d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38d540d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fe28
	[0299.504] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38d540d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38d540d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.504] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x209949ab, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x209949ab, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa560, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.efi.mui", cAlternateFileName="")) returned 1
	[0299.504] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.504] FindClose (in: hFindFile=0x79fe28 | out: hFindFile=0x79fe28) returned 1
	[0299.504] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\EFI\\zh-TW\\memtest.efi.mui" (normalized: "c:\\windows\\boot\\efi\\zh-tw\\memtest.efi.mui"), fInfoLevelId=0x0, lpFileInformation=0x123e7408 | out: lpFileInformation=0x123e7408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x209949ab, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x209949ab, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa560)) returned 1
	[0299.505] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\Fonts" (normalized: "c:\\windows\\boot\\fonts"), fInfoLevelId=0x0, lpFileInformation=0x123e7458 | out: lpFileInformation=0x123e7458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38fb668, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38fb668, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.505] CreateFileW (lpFileName="C:\\Windows\\Boot\\Fonts" (normalized: "c:\\windows\\boot\\fonts"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.506] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\Fonts\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38fb668, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38fb668, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fce8
	[0299.706] SetEvent (hEvent=0x168) returned 1
	[0299.706] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38fb668, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38fb668, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.706] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211a0897, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x211a0897, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x211a0897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1
	[0299.706] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211ecd4c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x211ecd4c, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x211ecd4c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1
	[0299.706] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21212f9a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x21212f9a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1
	[0299.706] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210bba74, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x210bba74, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1
	[0299.706] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210bba74, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x210bba74, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x28784, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgunn_boot.ttf", cAlternateFileName="")) returned 1
	[0299.706] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210bba74, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x210bba74, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x29114, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgun_boot.ttf", cAlternateFileName="")) returned 1
	[0299.707] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21212f9a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x21212f9a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x20718, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryon_boot.ttf", cAlternateFileName="")) returned 1
	[0299.707] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21212f9a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x21212f9a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x20d6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryo_boot.ttf", cAlternateFileName="")) returned 1
	[0299.707] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211ecd4c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x211ecd4c, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x211ecd4c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2553c, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjhn_boot.ttf", cAlternateFileName="")) returned 1
	[0299.707] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211ecd4c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x211ecd4c, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x211ecd4c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x25d10, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjh_boot.ttf", cAlternateFileName="")) returned 1
	[0299.707] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211a0897, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x211a0897, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x211a0897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x22b2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyhn_boot.ttf", cAlternateFileName="")) returned 1
	[0299.707] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211a0897, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x211a0897, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x211a0897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x23b34, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyh_boot.ttf", cAlternateFileName="")) returned 1
	[0299.707] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ae3c95a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1ae3c95a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1ae3c95a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8cb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="segmono_boot.ttf", cAlternateFileName="")) returned 1
	[0299.707] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ae3c95a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1ae3c95a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1ae3c95a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d20, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoen_slboot.ttf", cAlternateFileName="")) returned 1
	[0299.707] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ae62bb5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1ae62bb5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1ae62bb5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12e5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoe_slboot.ttf", cAlternateFileName="")) returned 1
	[0299.707] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ae3c95a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1ae3c95a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1ae3c95a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="")) returned 1
	[0299.707] FindNextFileW (in: hFindFile=0x79fce8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.707] FindClose (in: hFindFile=0x79fce8 | out: hFindFile=0x79fce8) returned 1
	[0299.708] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\windows\\boot\\fonts\\chs_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x123e79a8 | out: lpFileInformation=0x123e79a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211a0897, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x211a0897, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x211a0897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x385e00)) returned 1
	[0299.711] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\windows\\boot\\fonts\\cht_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x123e79f8 | out: lpFileInformation=0x123e79f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211ecd4c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x211ecd4c, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x211ecd4c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4)) returned 1
	[0299.712] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\windows\\boot\\fonts\\jpn_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x123e7a48 | out: lpFileInformation=0x123e7a48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21212f9a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x21212f9a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4)) returned 1
	[0299.712] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\windows\\boot\\fonts\\kor_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x123e7a98 | out: lpFileInformation=0x123e7a98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210bba74, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x210bba74, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x242f20)) returned 1
	[0299.713] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\windows\\boot\\fonts\\malgun_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x123e7ae8 | out: lpFileInformation=0x123e7ae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210bba74, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x210bba74, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x29114)) returned 1
	[0299.713] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\windows\\boot\\fonts\\malgunn_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x123e7b38 | out: lpFileInformation=0x123e7b38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210bba74, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x210bba74, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x28784)) returned 1
	[0299.714] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\windows\\boot\\fonts\\meiryo_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x123e7b88 | out: lpFileInformation=0x123e7b88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21212f9a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x21212f9a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x20d6c)) returned 1
	[0299.714] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\windows\\boot\\fonts\\meiryon_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x123e7bd8 | out: lpFileInformation=0x123e7bd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21212f9a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x21212f9a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x20718)) returned 1
	[0299.714] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\windows\\boot\\fonts\\msjh_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x123e7c28 | out: lpFileInformation=0x123e7c28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211ecd4c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x211ecd4c, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x211ecd4c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x25d10)) returned 1
	[0299.715] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\windows\\boot\\fonts\\msjhn_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x123e7c78 | out: lpFileInformation=0x123e7c78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211ecd4c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x211ecd4c, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x211ecd4c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2553c)) returned 1
	[0299.715] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\windows\\boot\\fonts\\msyh_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x123e7cc8 | out: lpFileInformation=0x123e7cc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211a0897, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x211a0897, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x211a0897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x23b34)) returned 1
	[0299.716] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\windows\\boot\\fonts\\msyhn_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x123e7d18 | out: lpFileInformation=0x123e7d18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211a0897, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x211a0897, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x211a0897, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x22b2c)) returned 1
	[0299.716] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\windows\\boot\\fonts\\segmono_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x123e7d68 | out: lpFileInformation=0x123e7d68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ae3c95a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1ae3c95a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1ae3c95a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8cb4)) returned 1
	[0299.716] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\windows\\boot\\fonts\\segoe_slboot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x123e7db8 | out: lpFileInformation=0x123e7db8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ae62bb5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1ae62bb5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1ae62bb5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12e5c)) returned 1
	[0299.717] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\windows\\boot\\fonts\\segoen_slboot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x123e7e08 | out: lpFileInformation=0x123e7e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ae3c95a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1ae3c95a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1ae3c95a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d20)) returned 1
	[0299.717] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\windows\\boot\\fonts\\wgl4_boot.ttf"), fInfoLevelId=0x0, lpFileInformation=0x123e7e58 | out: lpFileInformation=0x123e7e58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ae3c95a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1ae3c95a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1ae3c95a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb95c)) returned 1
	[0299.717] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\PCAT" (normalized: "c:\\windows\\boot\\pcat"), fInfoLevelId=0x0, lpFileInformation=0x123e7ea8 | out: lpFileInformation=0x123e7ea8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe111b6, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xe111b6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.717] CreateFileW (lpFileName="C:\\Windows\\Boot\\PCAT" (normalized: "c:\\windows\\boot\\pcat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.717] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe111b6, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xe111b6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fb28
	[0299.757] SetEvent (hEvent=0x168) returned 1
	[0299.757] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe111b6, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xe111b6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.759] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38fb668, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38fb668, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1
	[0299.759] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2feb42d5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2feb42d5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x61b64, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1
	[0299.759] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2feb42d5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2feb42d5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootnxt", cAlternateFileName="")) returned 1
	[0299.759] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2feb42d5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2feb42d5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x17f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1
	[0299.759] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38fb668, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38fb668, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1
	[0299.759] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38fb668, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38fb668, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0299.759] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38fb668, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38fb668, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0299.759] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x39218ca, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x39218ca, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0299.759] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x39218ca, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x39218ca, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1
	[0299.759] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x39218ca, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x39218ca, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0299.759] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x39218ca, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x39218ca, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0299.759] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x39218ca, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x39218ca, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1
	[0299.759] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x39218ca, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x39218ca, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1
	[0299.759] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x39218ca, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x39218ca, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0299.759] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x39218ca, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x39218ca, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CA", cAlternateFileName="")) returned 1
	[0299.759] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x39218ca, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x39218ca, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0299.759] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x39218ca, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x39218ca, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1
	[0299.759] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3947b1d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3947b1d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0299.759] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3947b1d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3947b1d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1
	[0299.759] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3947b1d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3947b1d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0299.759] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3947b1d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3947b1d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0299.760] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3947b1d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3947b1d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1
	[0299.760] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3947b1d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3947b1d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1
	[0299.760] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2feb42d5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2feb42d5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc2960, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1
	[0299.760] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3947b1d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3947b1d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1
	[0299.760] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3947b1d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3947b1d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0299.760] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3947b1d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3947b1d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0299.760] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x396dd87, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x396dd87, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0299.760] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x396dd87, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x396dd87, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0299.760] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x396dd87, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x396dd87, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qps-ploc", cAlternateFileName="")) returned 1
	[0299.760] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x396dd87, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x396dd87, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1
	[0299.760] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x396dd87, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x396dd87, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1
	[0299.760] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x396dd87, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x396dd87, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1
	[0299.760] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x396dd87, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x396dd87, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1
	[0299.760] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x396dd87, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x396dd87, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1
	[0299.760] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x396dd87, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x396dd87, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1
	[0299.760] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3993fce, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3993fce, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1
	[0299.760] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3993fce, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3993fce, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1
	[0299.760] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3993fce, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3993fce, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1
	[0299.760] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3993fce, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3993fce, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1
	[0299.760] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3993fce, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3993fce, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1
	[0299.760] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3993fce, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3993fce, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1
	[0299.760] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.761] FindClose (in: hFindFile=0x79fb28 | out: hFindFile=0x79fb28) returned 1
	[0299.762] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\bg-BG" (normalized: "c:\\windows\\boot\\pcat\\bg-bg"), fInfoLevelId=0x0, lpFileInformation=0x126cac38 | out: lpFileInformation=0x126cac38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38fb668, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38fb668, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.764] CreateFileW (lpFileName="C:\\Windows\\Boot\\PCAT\\bg-BG" (normalized: "c:\\windows\\boot\\pcat\\bg-bg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.764] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\bg-BG\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38fb668, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38fb668, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0028
	[0299.764] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38fb668, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38fb668, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.764] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210bba74, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x210bba74, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1
	[0299.764] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.764] FindClose (in: hFindFile=0x7a0028 | out: hFindFile=0x7a0028) returned 1
	[0299.765] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\windows\\boot\\pcat\\bg-bg\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126cacd8 | out: lpFileInformation=0x126cacd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210bba74, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x210bba74, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60)) returned 1
	[0299.765] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\bootmgr" (normalized: "c:\\windows\\boot\\pcat\\bootmgr"), fInfoLevelId=0x0, lpFileInformation=0x126cad28 | out: lpFileInformation=0x126cad28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2feb42d5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2feb42d5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x61b64)) returned 1
	[0299.767] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\bootnxt" (normalized: "c:\\windows\\boot\\pcat\\bootnxt"), fInfoLevelId=0x0, lpFileInformation=0x126cad78 | out: lpFileInformation=0x126cad78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2feb42d5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2feb42d5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1)) returned 1
	[0299.769] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\bootvhd.dll" (normalized: "c:\\windows\\boot\\pcat\\bootvhd.dll"), fInfoLevelId=0x0, lpFileInformation=0x126cadc8 | out: lpFileInformation=0x126cadc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2feb42d5, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2feb42d5, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x17f60)) returned 1
	[0299.769] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\cs-CZ" (normalized: "c:\\windows\\boot\\pcat\\cs-cz"), fInfoLevelId=0x0, lpFileInformation=0x126cae18 | out: lpFileInformation=0x126cae18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38fb668, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38fb668, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.770] CreateFileW (lpFileName="C:\\Windows\\Boot\\PCAT\\cs-CZ" (normalized: "c:\\windows\\boot\\pcat\\cs-cz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.770] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\cs-CZ\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38fb668, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38fb668, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0068
	[0299.770] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38fb668, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38fb668, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.770] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2109581d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2109581d, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1
	[0299.770] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2112e17f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2112e17f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb160, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="")) returned 1
	[0299.770] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.770] FindClose (in: hFindFile=0x7a0068 | out: hFindFile=0x7a0068) returned 1
	[0299.771] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\windows\\boot\\pcat\\cs-cz\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126caf08 | out: lpFileInformation=0x126caf08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2109581d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2109581d, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58)) returned 1
	[0299.771] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\windows\\boot\\pcat\\cs-cz\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126caf58 | out: lpFileInformation=0x126caf58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2112e17f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2112e17f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb160)) returned 1
	[0299.771] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\da-DK" (normalized: "c:\\windows\\boot\\pcat\\da-dk"), fInfoLevelId=0x0, lpFileInformation=0x126cafa8 | out: lpFileInformation=0x126cafa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38fb668, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38fb668, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.771] CreateFileW (lpFileName="C:\\Windows\\Boot\\PCAT\\da-DK" (normalized: "c:\\windows\\boot\\pcat\\da-dk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.772] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\da-DK\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38fb668, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38fb668, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fd28
	[0299.772] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38fb668, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38fb668, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.772] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x209bac02, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x209bac02, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1
	[0299.772] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2112e17f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2112e17f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb160, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="")) returned 1
	[0299.772] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.772] FindClose (in: hFindFile=0x79fd28 | out: hFindFile=0x79fd28) returned 1
	[0299.772] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\windows\\boot\\pcat\\da-dk\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126cb098 | out: lpFileInformation=0x126cb098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x209bac02, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x209bac02, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760)) returned 1
	[0299.773] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\da-DK\\memtest.exe.mui" (normalized: "c:\\windows\\boot\\pcat\\da-dk\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126cb0e8 | out: lpFileInformation=0x126cb0e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2112e17f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2112e17f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb160)) returned 1
	[0299.774] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\de-DE" (normalized: "c:\\windows\\boot\\pcat\\de-de"), fInfoLevelId=0x0, lpFileInformation=0x126cb138 | out: lpFileInformation=0x126cb138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38fb668, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38fb668, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.774] CreateFileW (lpFileName="C:\\Windows\\Boot\\PCAT\\de-DE" (normalized: "c:\\windows\\boot\\pcat\\de-de"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.774] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\de-DE\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38fb668, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38fb668, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fe68
	[0299.774] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x38fb668, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x38fb668, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.774] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x209bac02, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x209bac02, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1
	[0299.774] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2112e17f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2112e17f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb358, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="")) returned 1
	[0299.774] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.775] FindClose (in: hFindFile=0x79fe68 | out: hFindFile=0x79fe68) returned 1
	[0299.775] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\windows\\boot\\pcat\\de-de\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126cb228 | out: lpFileInformation=0x126cb228*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x209bac02, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x209bac02, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560)) returned 1
	[0299.777] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\de-DE\\memtest.exe.mui" (normalized: "c:\\windows\\boot\\pcat\\de-de\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126cb278 | out: lpFileInformation=0x126cb278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2112e17f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2112e17f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb358)) returned 1
	[0299.777] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\el-GR" (normalized: "c:\\windows\\boot\\pcat\\el-gr"), fInfoLevelId=0x0, lpFileInformation=0x126cb2c8 | out: lpFileInformation=0x126cb2c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x39218ca, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x39218ca, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.779] CreateFileW (lpFileName="C:\\Windows\\Boot\\PCAT\\el-GR" (normalized: "c:\\windows\\boot\\pcat\\el-gr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.779] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\el-GR\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x39218ca, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x39218ca, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fb28
	[0299.779] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdeaf5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x39218ca, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x39218ca, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.780] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x209949ab, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x209949ab, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1
	[0299.780] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21107f25, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x21107f25, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb560, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="")) returned 1
	[0299.780] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.780] FindClose (in: hFindFile=0x79fb28 | out: hFindFile=0x79fb28) returned 1
	[0299.780] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\windows\\boot\\pcat\\el-gr\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126cb3b8 | out: lpFileInformation=0x126cb3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x209949ab, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x209949ab, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960)) returned 1
	[0299.780] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\el-GR\\memtest.exe.mui" (normalized: "c:\\windows\\boot\\pcat\\el-gr\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126cb408 | out: lpFileInformation=0x126cb408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21107f25, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x21107f25, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb560)) returned 1
	[0299.781] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\en-GB" (normalized: "c:\\windows\\boot\\pcat\\en-gb"), fInfoLevelId=0x0, lpFileInformation=0x126cb458 | out: lpFileInformation=0x126cb458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x39218ca, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x39218ca, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.781] CreateFileW (lpFileName="C:\\Windows\\Boot\\PCAT\\en-GB" (normalized: "c:\\windows\\boot\\pcat\\en-gb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.781] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\en-GB\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x39218ca, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x39218ca, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fd68
	[0299.781] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x39218ca, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x39218ca, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.781] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x209bac02, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x209bac02, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1
	[0299.781] FindNextFileW (in: hFindFile=0x79fd68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.781] FindClose (in: hFindFile=0x79fd68 | out: hFindFile=0x79fd68) returned 1
	[0299.782] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\windows\\boot\\pcat\\en-gb\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126cb4f8 | out: lpFileInformation=0x126cb4f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x209bac02, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x209bac02, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158)) returned 1
	[0299.782] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\en-US" (normalized: "c:\\windows\\boot\\pcat\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x126cb548 | out: lpFileInformation=0x126cb548*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x39218ca, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x39218ca, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.782] CreateFileW (lpFileName="C:\\Windows\\Boot\\PCAT\\en-US" (normalized: "c:\\windows\\boot\\pcat\\en-us"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.782] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\en-US\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x39218ca, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x39218ca, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fea8
	[0299.783] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x39218ca, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x39218ca, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.783] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x209949ab, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x209949ab, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1
	[0299.783] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21107f25, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x21107f25, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="")) returned 1
	[0299.783] FindNextFileW (in: hFindFile=0x79fea8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.783] FindClose (in: hFindFile=0x79fea8 | out: hFindFile=0x79fea8) returned 1
	[0299.783] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\en-US\\bootmgr.exe.mui" (normalized: "c:\\windows\\boot\\pcat\\en-us\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126cb638 | out: lpFileInformation=0x126cb638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x209949ab, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x209949ab, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12160)) returned 1
	[0299.783] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\en-US\\memtest.exe.mui" (normalized: "c:\\windows\\boot\\pcat\\en-us\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126cb688 | out: lpFileInformation=0x126cb688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21107f25, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x21107f25, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaf58)) returned 1
	[0299.783] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\es-ES" (normalized: "c:\\windows\\boot\\pcat\\es-es"), fInfoLevelId=0x0, lpFileInformation=0x126cb6d8 | out: lpFileInformation=0x126cb6d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x39218ca, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x39218ca, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.784] CreateFileW (lpFileName="C:\\Windows\\Boot\\PCAT\\es-ES" (normalized: "c:\\windows\\boot\\pcat\\es-es"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.784] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\es-ES\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x39218ca, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x39218ca, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fb68
	[0299.784] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x39218ca, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x39218ca, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.784] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x209949ab, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x209949ab, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1
	[0299.784] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21107f25, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x21107f25, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb358, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="")) returned 1
	[0299.784] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.784] FindClose (in: hFindFile=0x79fb68 | out: hFindFile=0x79fb68) returned 1
	[0299.785] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\windows\\boot\\pcat\\es-es\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126cb7c8 | out: lpFileInformation=0x126cb7c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x209949ab, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x209949ab, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60)) returned 1
	[0299.787] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\es-ES\\memtest.exe.mui" (normalized: "c:\\windows\\boot\\pcat\\es-es\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126cb818 | out: lpFileInformation=0x126cb818*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21107f25, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x21107f25, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb358)) returned 1
	[0299.788] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\es-MX" (normalized: "c:\\windows\\boot\\pcat\\es-mx"), fInfoLevelId=0x0, lpFileInformation=0x126cb868 | out: lpFileInformation=0x126cb868*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x39218ca, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x39218ca, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.789] CreateFileW (lpFileName="C:\\Windows\\Boot\\PCAT\\es-MX" (normalized: "c:\\windows\\boot\\pcat\\es-mx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.790] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\es-MX\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x39218ca, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x39218ca, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9a8
	[0299.790] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x39218ca, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x39218ca, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.790] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x209949ab, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x209949ab, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1
	[0299.790] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.790] FindClose (in: hFindFile=0x79f9a8 | out: hFindFile=0x79f9a8) returned 1
	[0299.790] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\windows\\boot\\pcat\\es-mx\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126cb908 | out: lpFileInformation=0x126cb908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x209949ab, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x209949ab, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60)) returned 1
	[0299.806] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\et-EE" (normalized: "c:\\windows\\boot\\pcat\\et-ee"), fInfoLevelId=0x0, lpFileInformation=0x126cb958 | out: lpFileInformation=0x126cb958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x39218ca, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x39218ca, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.806] CreateFileW (lpFileName="C:\\Windows\\Boot\\PCAT\\et-EE" (normalized: "c:\\windows\\boot\\pcat\\et-ee"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.806] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\et-EE\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x39218ca, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x39218ca, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9e8
	[0299.806] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x39218ca, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x39218ca, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.806] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x209bac02, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x209bac02, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1
	[0299.806] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.806] FindClose (in: hFindFile=0x79f9e8 | out: hFindFile=0x79f9e8) returned 1
	[0299.807] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\windows\\boot\\pcat\\et-ee\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126cb9f8 | out: lpFileInformation=0x126cb9f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x209bac02, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x209bac02, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560)) returned 1
	[0299.807] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\fi-FI" (normalized: "c:\\windows\\boot\\pcat\\fi-fi"), fInfoLevelId=0x0, lpFileInformation=0x126cba48 | out: lpFileInformation=0x126cba48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x39218ca, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x39218ca, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.807] CreateFileW (lpFileName="C:\\Windows\\Boot\\PCAT\\fi-FI" (normalized: "c:\\windows\\boot\\pcat\\fi-fi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.807] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\fi-FI\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x39218ca, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x39218ca, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fc28
	[0299.807] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x39218ca, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x39218ca, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.807] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2096e751, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2096e751, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1
	[0299.807] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21107f25, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x21107f25, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb158, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="")) returned 1
	[0299.807] FindNextFileW (in: hFindFile=0x79fc28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.808] FindClose (in: hFindFile=0x79fc28 | out: hFindFile=0x79fc28) returned 1
	[0299.808] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\windows\\boot\\pcat\\fi-fi\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126cbb38 | out: lpFileInformation=0x126cbb38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2096e751, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2096e751, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60)) returned 1
	[0299.809] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\fi-FI\\memtest.exe.mui" (normalized: "c:\\windows\\boot\\pcat\\fi-fi\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126cbb88 | out: lpFileInformation=0x126cbb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21107f25, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x21107f25, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb158)) returned 1
	[0299.809] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\fr-CA" (normalized: "c:\\windows\\boot\\pcat\\fr-ca"), fInfoLevelId=0x0, lpFileInformation=0x126cbbd8 | out: lpFileInformation=0x126cbbd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x39218ca, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x39218ca, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.809] CreateFileW (lpFileName="C:\\Windows\\Boot\\PCAT\\fr-CA" (normalized: "c:\\windows\\boot\\pcat\\fr-ca"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.809] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\fr-CA\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x39218ca, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x39218ca, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f8e8
	[0299.810] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x39218ca, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x39218ca, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.810] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x209949ab, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x209949ab, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1
	[0299.810] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.810] FindClose (in: hFindFile=0x79f8e8 | out: hFindFile=0x79f8e8) returned 1
	[0299.810] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\windows\\boot\\pcat\\fr-ca\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126cbc78 | out: lpFileInformation=0x126cbc78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x209949ab, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x209949ab, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560)) returned 1
	[0299.810] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\fr-FR" (normalized: "c:\\windows\\boot\\pcat\\fr-fr"), fInfoLevelId=0x0, lpFileInformation=0x126cbcc8 | out: lpFileInformation=0x126cbcc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x39218ca, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x39218ca, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.812] CreateFileW (lpFileName="C:\\Windows\\Boot\\PCAT\\fr-FR" (normalized: "c:\\windows\\boot\\pcat\\fr-fr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.812] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\fr-FR\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x39218ca, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x39218ca, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9e8
	[0299.812] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x39218ca, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x39218ca, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.812] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2096e751, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2096e751, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1
	[0299.812] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21107f25, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x21107f25, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="")) returned 1
	[0299.812] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0299.812] FindClose (in: hFindFile=0x79f9e8 | out: hFindFile=0x79f9e8) returned 1
	[0299.813] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\windows\\boot\\pcat\\fr-fr\\bootmgr.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126cbdb8 | out: lpFileInformation=0x126cbdb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2096e751, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2096e751, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13558)) returned 1
	[0299.813] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\fr-FR\\memtest.exe.mui" (normalized: "c:\\windows\\boot\\pcat\\fr-fr\\memtest.exe.mui"), fInfoLevelId=0x0, lpFileInformation=0x126cbe08 | out: lpFileInformation=0x126cbe08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21107f25, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x21107f25, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb360)) returned 1
	[0299.814] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\hr-HR" (normalized: "c:\\windows\\boot\\pcat\\hr-hr"), fInfoLevelId=0x0, lpFileInformation=0x126cbe58 | out: lpFileInformation=0x126cbe58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x39218ca, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x39218ca, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0299.814] CreateFileW (lpFileName="C:\\Windows\\Boot\\PCAT\\hr-HR" (normalized: "c:\\windows\\boot\\pcat\\hr-hr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0299.814] FindFirstFileW (in: lpFileName="C:\\Windows\\Boot\\PCAT\\hr-HR\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x39218ca, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x39218ca, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9e8
	[0299.814] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x39218ca, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x39218ca, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0299.814] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2123921c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2123921c, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="")) returned 1

Thread:
	id = 9
	os_tid = 0xc64

	[0109.487] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x3278ff58, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x3278ff58*=0x128) returned 1
	[0109.488] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x12c
	[0109.488] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0109.554] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0197.243] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0197.252] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0197.303] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0197.320] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0197.401] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0197.404] SetEvent (hEvent=0x124) returned 1
	[0197.404] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0197.410] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0239.773] SetEvent (hEvent=0x124) returned 1
	[0239.773] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0239.774] SetEvent (hEvent=0x124) returned 1
	[0239.774] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0239.830] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0239.837] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0239.839] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0239.973] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0239.997] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0240.033] SetEvent (hEvent=0x124) returned 1
	[0240.033] SetEvent (hEvent=0x14c) returned 1
	[0240.033] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0240.034] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0240.035] SetEvent (hEvent=0x124) returned 1
	[0240.035] SetEvent (hEvent=0x14c) returned 1
	[0240.035] SetEvent (hEvent=0x174) returned 1
	[0240.035] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0240.038] SetEvent (hEvent=0x168) returned 1
	[0240.038] SetEvent (hEvent=0x174) returned 1
	[0240.038] SetEvent (hEvent=0x104) returned 1
	[0240.038] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0240.043] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0240.069] SetEvent (hEvent=0x104) returned 1
	[0240.069] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0240.070] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0240.102] SetEvent (hEvent=0x104) returned 1
	[0240.102] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0240.104] SetEvent (hEvent=0x174) returned 1
	[0240.104] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0240.348] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0240.350] SetEvent (hEvent=0x174) returned 1
	[0240.350] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0240.360] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0240.686] SetEvent (hEvent=0x124) returned 1
	[0240.686] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0240.687] SetEvent (hEvent=0x124) returned 1
	[0240.687] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0240.699] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0240.742] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0241.064] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0241.257] SetEvent (hEvent=0x124) returned 1
	[0241.257] SetEvent (hEvent=0x14c) returned 1
	[0241.257] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0241.414] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0241.414] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0241.455] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0241.455] SetEvent (hEvent=0x124) returned 1
	[0241.455] SetEvent (hEvent=0x14c) returned 1
	[0241.455] SetEvent (hEvent=0x174) returned 1
	[0241.455] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0242.813] SetEvent (hEvent=0x168) returned 1
	[0242.813] SetEvent (hEvent=0x174) returned 1
	[0242.813] SetEvent (hEvent=0x104) returned 1
	[0242.813] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0242.824] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0242.891] SetEvent (hEvent=0x104) returned 1
	[0242.891] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0242.893] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0243.051] SetEvent (hEvent=0x104) returned 1
	[0243.051] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0243.070] SetEvent (hEvent=0x174) returned 1
	[0243.070] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0243.339] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0243.350] SetEvent (hEvent=0x174) returned 1
	[0243.350] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0243.354] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0244.319] SetEvent (hEvent=0x174) returned 1
	[0244.319] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0244.344] SetEvent (hEvent=0x174) returned 1
	[0244.344] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0244.467] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0244.689] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0244.883] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0244.942] SetEvent (hEvent=0x174) returned 1
	[0244.942] SetEvent (hEvent=0x14c) returned 1
	[0244.942] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0244.988] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0244.988] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0244.995] SetEvent (hEvent=0x174) returned 1
	[0244.995] SetEvent (hEvent=0x14c) returned 1
	[0244.995] SetEvent (hEvent=0x124) returned 1
	[0244.995] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0245.026] SetEvent (hEvent=0x168) returned 1
	[0245.026] SetEvent (hEvent=0x124) returned 1
	[0245.027] SetEvent (hEvent=0x104) returned 1
	[0245.027] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0245.059] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0245.096] SetEvent (hEvent=0x104) returned 1
	[0245.096] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0245.102] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0245.293] SetEvent (hEvent=0x104) returned 1
	[0245.293] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0245.335] SetEvent (hEvent=0x124) returned 1
	[0245.335] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0246.028] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0246.036] SetEvent (hEvent=0x124) returned 1
	[0246.036] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0246.042] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0247.127] SetEvent (hEvent=0x174) returned 1
	[0247.127] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0247.168] SetEvent (hEvent=0x174) returned 1
	[0247.168] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0247.280] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0247.481] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0247.934] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0248.027] SetEvent (hEvent=0x174) returned 1
	[0248.027] SetEvent (hEvent=0x14c) returned 1
	[0248.027] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0248.059] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0248.059] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0248.091] SetEvent (hEvent=0x174) returned 1
	[0248.091] SetEvent (hEvent=0x14c) returned 1
	[0248.091] SetEvent (hEvent=0x124) returned 1
	[0248.091] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0248.099] SetEvent (hEvent=0x168) returned 1
	[0248.099] SetEvent (hEvent=0x124) returned 1
	[0248.100] SetEvent (hEvent=0x104) returned 1
	[0248.100] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0248.177] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0248.232] SetEvent (hEvent=0x104) returned 1
	[0248.232] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0248.268] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0248.423] SetEvent (hEvent=0x104) returned 1
	[0248.424] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0248.489] SetEvent (hEvent=0x124) returned 1
	[0248.490] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0248.879] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0248.892] SetEvent (hEvent=0x124) returned 1
	[0248.892] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0248.997] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0249.807] SetEvent (hEvent=0x174) returned 1
	[0249.807] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0249.900] SetEvent (hEvent=0x174) returned 1
	[0249.901] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0249.985] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0250.197] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0250.356] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0250.485] SetEvent (hEvent=0x174) returned 1
	[0250.486] SetEvent (hEvent=0x14c) returned 1
	[0250.486] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0250.511] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0250.511] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0250.554] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0250.554] SetEvent (hEvent=0x174) returned 1
	[0250.554] SetEvent (hEvent=0x14c) returned 1
	[0250.554] SetEvent (hEvent=0x124) returned 1
	[0250.554] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0250.608] SetEvent (hEvent=0x168) returned 1
	[0250.608] SetEvent (hEvent=0x124) returned 1
	[0250.608] SetEvent (hEvent=0x104) returned 1
	[0250.608] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0250.748] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0250.797] SetEvent (hEvent=0x104) returned 1
	[0250.797] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0250.798] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0251.053] SetEvent (hEvent=0x104) returned 1
	[0251.053] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0251.095] SetEvent (hEvent=0x124) returned 1
	[0251.095] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0251.269] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0251.275] SetEvent (hEvent=0x124) returned 1
	[0251.275] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0251.282] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0252.244] SetEvent (hEvent=0x174) returned 1
	[0252.244] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0252.283] SetEvent (hEvent=0x174) returned 1
	[0252.283] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0252.479] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0252.554] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0252.727] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0252.771] SetEvent (hEvent=0x174) returned 1
	[0252.771] SetEvent (hEvent=0x14c) returned 1
	[0252.772] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0252.801] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0252.801] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0252.804] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0252.805] SetEvent (hEvent=0x174) returned 1
	[0252.805] SetEvent (hEvent=0x14c) returned 1
	[0252.805] SetEvent (hEvent=0x124) returned 1
	[0252.805] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0252.807] SetEvent (hEvent=0x168) returned 1
	[0252.807] SetEvent (hEvent=0x124) returned 1
	[0252.807] SetEvent (hEvent=0x104) returned 1
	[0252.807] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0252.820] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0252.833] SetEvent (hEvent=0x104) returned 1
	[0252.833] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0252.868] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0253.209] SetEvent (hEvent=0x104) returned 1
	[0253.209] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0253.369] SetEvent (hEvent=0x124) returned 1
	[0253.369] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0253.524] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0253.571] SetEvent (hEvent=0x124) returned 1
	[0253.571] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0253.642] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0254.189] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0254.198] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0254.865] SetEvent (hEvent=0x14c) returned 1
	[0254.865] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0254.898] SetEvent (hEvent=0x14c) returned 1
	[0254.899] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0254.994] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0255.139] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0255.146] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0255.751] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0256.198] SetEvent (hEvent=0x14c) returned 1
	[0256.198] SetEvent (hEvent=0x124) returned 1
	[0256.198] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0256.221] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0256.221] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0256.229] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0256.229] SetEvent (hEvent=0x14c) returned 1
	[0256.229] SetEvent (hEvent=0x124) returned 1
	[0256.230] SetEvent (hEvent=0x174) returned 1
	[0256.230] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0256.232] SetEvent (hEvent=0x168) returned 1
	[0256.232] SetEvent (hEvent=0x174) returned 1
	[0256.232] SetEvent (hEvent=0x104) returned 1
	[0256.232] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0256.238] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0256.254] SetEvent (hEvent=0x104) returned 1
	[0256.254] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0256.257] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0256.319] SetEvent (hEvent=0x104) returned 1
	[0256.319] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0256.321] SetEvent (hEvent=0x174) returned 1
	[0256.321] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0256.515] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0256.516] SetEvent (hEvent=0x174) returned 1
	[0256.516] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0256.516] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0258.018] SetEvent (hEvent=0x14c) returned 1
	[0258.018] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0258.062] SetEvent (hEvent=0x14c) returned 1
	[0258.062] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0258.263] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0258.491] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0258.821] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0258.947] SetEvent (hEvent=0x14c) returned 1
	[0258.947] SetEvent (hEvent=0x124) returned 1
	[0258.947] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0258.974] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0258.974] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0259.197] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0259.197] SetEvent (hEvent=0x14c) returned 1
	[0259.197] SetEvent (hEvent=0x124) returned 1
	[0259.197] SetEvent (hEvent=0x174) returned 1
	[0259.197] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0259.312] SetEvent (hEvent=0x168) returned 1
	[0259.312] SetEvent (hEvent=0x174) returned 1
	[0259.312] SetEvent (hEvent=0x104) returned 1
	[0259.312] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0259.346] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0259.374] SetEvent (hEvent=0x104) returned 1
	[0259.374] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0259.379] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0259.556] SetEvent (hEvent=0x104) returned 1
	[0259.556] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0259.574] SetEvent (hEvent=0x174) returned 1
	[0259.574] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0259.779] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0259.823] SetEvent (hEvent=0x174) returned 1
	[0259.823] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0259.868] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0260.610] SetEvent (hEvent=0x14c) returned 1
	[0260.610] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0260.654] SetEvent (hEvent=0x14c) returned 1
	[0260.654] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0260.815] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0260.989] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0261.103] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0261.334] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0261.411] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0261.606] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0261.816] SetEvent (hEvent=0x14c) returned 1
	[0261.816] SetEvent (hEvent=0x124) returned 1
	[0261.816] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0261.832] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0261.832] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0261.834] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0261.834] SetEvent (hEvent=0x14c) returned 1
	[0261.834] SetEvent (hEvent=0x124) returned 1
	[0261.834] SetEvent (hEvent=0x174) returned 1
	[0261.834] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0261.835] SetEvent (hEvent=0x168) returned 1
	[0261.835] SetEvent (hEvent=0x174) returned 1
	[0261.835] SetEvent (hEvent=0x104) returned 1
	[0261.835] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0261.836] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0261.851] SetEvent (hEvent=0x104) returned 1
	[0261.851] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0261.851] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0261.898] SetEvent (hEvent=0x104) returned 1
	[0261.898] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0261.899] SetEvent (hEvent=0x174) returned 1
	[0261.899] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0262.047] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0262.073] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0262.361] SetEvent (hEvent=0x104) returned 1
	[0262.361] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0262.390] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0262.630] SetEvent (hEvent=0x104) returned 1
	[0262.630] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0262.644] SetEvent (hEvent=0x124) returned 1
	[0262.644] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0262.865] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0262.889] SetEvent (hEvent=0x124) returned 1
	[0262.889] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0262.951] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0263.933] SetEvent (hEvent=0x14c) returned 1
	[0263.933] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0264.001] SetEvent (hEvent=0x14c) returned 1
	[0264.001] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0264.255] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0264.402] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0264.420] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0265.734] SetEvent (hEvent=0x14c) returned 1
	[0265.735] SetEvent (hEvent=0x174) returned 1
	[0265.735] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0265.756] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0265.769] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0266.728] SetEvent (hEvent=0x14c) returned 1
	[0266.728] SetEvent (hEvent=0x174) returned 1
	[0266.728] SetEvent (hEvent=0x124) returned 1
	[0266.728] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0266.910] SetEvent (hEvent=0x168) returned 1
	[0266.910] SetEvent (hEvent=0x124) returned 1
	[0266.910] SetEvent (hEvent=0x104) returned 1
	[0266.910] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0266.949] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0266.964] SetEvent (hEvent=0x104) returned 1
	[0266.964] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0267.014] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0267.269] SetEvent (hEvent=0x104) returned 1
	[0267.269] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0267.465] SetEvent (hEvent=0x124) returned 1
	[0267.465] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0267.737] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0267.744] SetEvent (hEvent=0x124) returned 1
	[0267.744] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0267.778] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0269.810] SetEvent (hEvent=0x14c) returned 1
	[0269.810] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0269.940] SetEvent (hEvent=0x14c) returned 1
	[0269.940] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0270.062] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0270.301] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0270.375] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0270.992] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0271.064] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0271.091] SetEvent (hEvent=0x14c) returned 1
	[0271.091] SetEvent (hEvent=0x174) returned 1
	[0271.091] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0271.147] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0271.147] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0271.302] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0271.302] SetEvent (hEvent=0x14c) returned 1
	[0271.302] SetEvent (hEvent=0x174) returned 1
	[0271.302] SetEvent (hEvent=0x124) returned 1
	[0271.304] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0271.509] SetEvent (hEvent=0x168) returned 1
	[0271.509] SetEvent (hEvent=0x124) returned 1
	[0271.509] SetEvent (hEvent=0x104) returned 1
	[0271.509] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0271.535] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0271.656] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0272.062] SetEvent (hEvent=0x104) returned 1
	[0272.062] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0272.093] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0272.324] SetEvent (hEvent=0x104) returned 1
	[0272.324] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0272.367] SetEvent (hEvent=0x124) returned 1
	[0272.367] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0273.089] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0273.098] SetEvent (hEvent=0x124) returned 1
	[0273.098] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0273.133] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0274.157] SetEvent (hEvent=0x14c) returned 1
	[0274.157] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0274.163] SetEvent (hEvent=0x14c) returned 1
	[0274.163] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0274.211] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0274.279] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0274.295] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.109] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.243] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.291] SetEvent (hEvent=0x14c) returned 1
	[0275.291] SetEvent (hEvent=0x174) returned 1
	[0275.291] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0275.412] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.412] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0275.426] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.426] SetEvent (hEvent=0x14c) returned 1
	[0275.426] SetEvent (hEvent=0x174) returned 1
	[0275.426] SetEvent (hEvent=0x124) returned 1
	[0275.426] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.447] SetEvent (hEvent=0x168) returned 1
	[0275.447] SetEvent (hEvent=0x124) returned 1
	[0275.447] SetEvent (hEvent=0x104) returned 1
	[0275.447] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.458] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.499] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.503] SetEvent (hEvent=0x104) returned 1
	[0275.503] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.503] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.529] SetEvent (hEvent=0x104) returned 1
	[0275.529] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.532] SetEvent (hEvent=0x104) returned 1
	[0275.532] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.533] SetEvent (hEvent=0x104) returned 1
	[0275.533] SwitchToThread () returned 1
	[0275.534] SetEvent (hEvent=0x104) returned 1
	[0275.534] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.534] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.621] SetEvent (hEvent=0x124) returned 1
	[0275.621] SetEvent (hEvent=0x174) returned 1
	[0275.621] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.622] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.656] SetEvent (hEvent=0x104) returned 1
	[0275.657] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.690] SetEvent (hEvent=0x104) returned 1
	[0275.690] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.694] SetEvent (hEvent=0x104) returned 1
	[0275.694] SwitchToThread () returned 1
	[0275.694] SetEvent (hEvent=0x104) returned 1
	[0275.694] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.695] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.832] SetEvent (hEvent=0x124) returned 1
	[0275.832] SetEvent (hEvent=0x14c) returned 1
	[0275.832] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.834] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.849] SetEvent (hEvent=0x104) returned 1
	[0275.849] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.884] SetEvent (hEvent=0x104) returned 1
	[0275.884] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.888] SetEvent (hEvent=0x104) returned 1
	[0275.888] SwitchToThread () returned 1
	[0275.889] SetEvent (hEvent=0x104) returned 1
	[0275.889] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.889] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.987] SetEvent (hEvent=0x174) returned 1
	[0275.987] SetEvent (hEvent=0x124) returned 1
	[0275.987] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.988] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0276.034] SetEvent (hEvent=0x104) returned 1
	[0276.034] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0276.052] SwitchToThread () returned 1
	[0276.071] SetEvent (hEvent=0x104) returned 1
	[0276.071] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0276.077] SetEvent (hEvent=0x104) returned 1
	[0276.077] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0276.077] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0276.176] SetEvent (hEvent=0x14c) returned 1
	[0276.176] SetEvent (hEvent=0x174) returned 1
	[0276.176] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0276.178] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0276.627] SetEvent (hEvent=0x104) returned 1
	[0276.627] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0276.693] SetEvent (hEvent=0x104) returned 1
	[0276.694] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0276.767] SetEvent (hEvent=0x104) returned 1
	[0276.767] SwitchToThread () returned 1
	[0276.839] SetEvent (hEvent=0x104) returned 1
	[0276.839] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0276.907] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0277.125] SetEvent (hEvent=0x124) returned 1
	[0277.125] SetEvent (hEvent=0x14c) returned 1
	[0277.125] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0277.193] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0277.380] SetEvent (hEvent=0x104) returned 1
	[0277.380] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0277.413] SetEvent (hEvent=0x104) returned 1
	[0277.413] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0277.470] SetEvent (hEvent=0x104) returned 1
	[0277.470] SwitchToThread () returned 1
	[0277.476] SetEvent (hEvent=0x104) returned 1
	[0277.476] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0277.540] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0277.751] SetEvent (hEvent=0x174) returned 1
	[0277.752] SetEvent (hEvent=0x124) returned 1
	[0277.752] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0277.799] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0277.964] SetEvent (hEvent=0x104) returned 1
	[0277.964] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0277.999] SetEvent (hEvent=0x104) returned 1
	[0277.999] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0278.053] SetEvent (hEvent=0x104) returned 1
	[0278.053] SwitchToThread () returned 1
	[0278.065] SetEvent (hEvent=0x104) returned 1
	[0278.065] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0278.088] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0278.286] SetEvent (hEvent=0x14c) returned 1
	[0278.286] SetEvent (hEvent=0x174) returned 1
	[0278.286] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0278.369] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0278.465] SetEvent (hEvent=0x104) returned 1
	[0278.465] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0278.502] SetEvent (hEvent=0x104) returned 1
	[0278.502] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0278.509] SetEvent (hEvent=0x104) returned 1
	[0278.509] SwitchToThread () returned 1
	[0278.509] SetEvent (hEvent=0x104) returned 1
	[0278.509] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0278.510] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0278.641] SetEvent (hEvent=0x124) returned 1
	[0278.641] SetEvent (hEvent=0x14c) returned 1
	[0278.641] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0278.647] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0278.658] SetEvent (hEvent=0x104) returned 1
	[0278.658] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0278.689] SetEvent (hEvent=0x104) returned 1
	[0278.689] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0278.692] SetEvent (hEvent=0x104) returned 1
	[0278.692] SwitchToThread () returned 1
	[0278.692] SetEvent (hEvent=0x104) returned 1
	[0278.692] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0278.692] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0278.887] SetEvent (hEvent=0x174) returned 1
	[0278.887] SetEvent (hEvent=0x124) returned 1
	[0278.887] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0278.899] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0278.938] SetEvent (hEvent=0x104) returned 1
	[0278.938] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0278.966] SetEvent (hEvent=0x104) returned 1
	[0278.966] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0278.974] SetEvent (hEvent=0x104) returned 1
	[0278.974] SwitchToThread () returned 1
	[0278.975] SetEvent (hEvent=0x104) returned 1
	[0278.975] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0278.975] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.078] SetEvent (hEvent=0x14c) returned 1
	[0279.078] SetEvent (hEvent=0x174) returned 1
	[0279.078] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.080] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.101] SetEvent (hEvent=0x104) returned 1
	[0279.101] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.132] SwitchToThread () returned 1
	[0279.140] SetEvent (hEvent=0x104) returned 1
	[0279.140] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.144] SetEvent (hEvent=0x104) returned 1
	[0279.144] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.144] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.267] SetEvent (hEvent=0x124) returned 1
	[0279.267] SetEvent (hEvent=0x14c) returned 1
	[0279.267] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.271] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.289] SetEvent (hEvent=0x104) returned 1
	[0279.289] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.305] SwitchToThread () returned 1
	[0279.371] SetEvent (hEvent=0x104) returned 1
	[0279.371] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.377] SetEvent (hEvent=0x104) returned 1
	[0279.377] SetEvent (hEvent=0x174) returned 1
	[0279.377] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.378] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.440] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.461] SetEvent (hEvent=0x104) returned 1
	[0279.461] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.461] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.512] SetEvent (hEvent=0x104) returned 1
	[0279.512] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.515] SetEvent (hEvent=0x104) returned 1
	[0279.515] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.516] SetEvent (hEvent=0x104) returned 1
	[0279.516] SwitchToThread () returned 1
	[0279.516] SetEvent (hEvent=0x104) returned 1
	[0279.516] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.516] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.621] SetEvent (hEvent=0x174) returned 1
	[0279.621] SetEvent (hEvent=0x124) returned 1
	[0279.621] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.667] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.679] SetEvent (hEvent=0x104) returned 1
	[0279.679] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.703] SetEvent (hEvent=0x104) returned 1
	[0279.703] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.705] SetEvent (hEvent=0x104) returned 1
	[0279.705] SwitchToThread () returned 1
	[0279.705] SetEvent (hEvent=0x104) returned 1
	[0279.705] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.706] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.787] SetEvent (hEvent=0x14c) returned 1
	[0279.787] SetEvent (hEvent=0x174) returned 1
	[0279.787] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.789] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.827] SetEvent (hEvent=0x104) returned 1
	[0279.827] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.855] SetEvent (hEvent=0x104) returned 1
	[0279.855] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.858] SetEvent (hEvent=0x104) returned 1
	[0279.858] SwitchToThread () returned 1
	[0279.859] SetEvent (hEvent=0x104) returned 1
	[0279.859] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.859] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.980] SetEvent (hEvent=0x124) returned 1
	[0279.981] SetEvent (hEvent=0x14c) returned 1
	[0279.981] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.982] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.995] SetEvent (hEvent=0x104) returned 1
	[0279.995] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.016] SetEvent (hEvent=0x104) returned 1
	[0280.016] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.018] SetEvent (hEvent=0x104) returned 1
	[0280.018] SwitchToThread () returned 1
	[0280.019] SetEvent (hEvent=0x104) returned 1
	[0280.019] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.020] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.095] SetEvent (hEvent=0x174) returned 1
	[0280.095] SetEvent (hEvent=0x124) returned 1
	[0280.095] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.109] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.119] SetEvent (hEvent=0x104) returned 1
	[0280.119] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.145] SetEvent (hEvent=0x104) returned 1
	[0280.145] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.149] SetEvent (hEvent=0x104) returned 1
	[0280.149] SwitchToThread () returned 1
	[0280.149] SetEvent (hEvent=0x104) returned 1
	[0280.149] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.150] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.238] SetEvent (hEvent=0x14c) returned 1
	[0280.238] SetEvent (hEvent=0x174) returned 1
	[0280.238] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.239] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.278] SetEvent (hEvent=0x104) returned 1
	[0280.278] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.307] SetEvent (hEvent=0x104) returned 1
	[0280.308] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.310] SetEvent (hEvent=0x104) returned 1
	[0280.310] SwitchToThread () returned 1
	[0280.310] SetEvent (hEvent=0x104) returned 1
	[0280.310] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.311] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.432] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.433] SetEvent (hEvent=0x14c) returned 1
	[0280.433] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.433] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.624] SetEvent (hEvent=0x174) returned 1
	[0280.624] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.624] SetEvent (hEvent=0x174) returned 1
	[0280.624] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.636] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.670] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.716] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.749] SetEvent (hEvent=0x174) returned 1
	[0280.749] SetEvent (hEvent=0x124) returned 1
	[0280.749] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0280.768] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.768] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0280.769] SetEvent (hEvent=0x174) returned 1
	[0280.769] SetEvent (hEvent=0x124) returned 1
	[0280.769] SetEvent (hEvent=0x14c) returned 1
	[0280.769] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.770] SetEvent (hEvent=0x168) returned 1
	[0280.770] SetEvent (hEvent=0x14c) returned 1
	[0280.770] SetEvent (hEvent=0x104) returned 1
	[0280.770] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.773] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.784] SetEvent (hEvent=0x104) returned 1
	[0280.784] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.785] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.811] SetEvent (hEvent=0x104) returned 1
	[0280.811] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.813] SetEvent (hEvent=0x14c) returned 1
	[0280.813] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.900] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.927] SetEvent (hEvent=0x14c) returned 1
	[0280.928] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.929] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0281.108] SetEvent (hEvent=0x174) returned 1
	[0281.108] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0281.108] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0281.387] SetEvent (hEvent=0x104) returned 1
	[0281.387] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0281.388] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0281.431] SetEvent (hEvent=0x104) returned 1
	[0281.431] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0281.433] SetEvent (hEvent=0x174) returned 1
	[0281.433] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0281.550] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0281.558] SetEvent (hEvent=0x174) returned 1
	[0281.558] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0281.559] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0281.800] SetEvent (hEvent=0x14c) returned 1
	[0281.800] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0281.801] SetEvent (hEvent=0x14c) returned 1
	[0281.801] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0281.844] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0281.885] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0281.951] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0281.990] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.000] SetEvent (hEvent=0x14c) returned 1
	[0282.000] SetEvent (hEvent=0x124) returned 1
	[0282.000] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0282.024] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.024] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0282.027] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.027] SetEvent (hEvent=0x14c) returned 1
	[0282.027] SetEvent (hEvent=0x124) returned 1
	[0282.027] SetEvent (hEvent=0x174) returned 1
	[0282.027] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.027] SetEvent (hEvent=0x168) returned 1
	[0282.027] SetEvent (hEvent=0x174) returned 1
	[0282.027] SetEvent (hEvent=0x104) returned 1
	[0282.028] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.029] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.041] SetEvent (hEvent=0x104) returned 1
	[0282.041] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.041] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.105] SetEvent (hEvent=0x104) returned 1
	[0282.105] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.118] SetEvent (hEvent=0x174) returned 1
	[0282.118] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.246] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.249] SetEvent (hEvent=0x174) returned 1
	[0282.249] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.250] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.440] SetEvent (hEvent=0x14c) returned 1
	[0282.440] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.441] SetEvent (hEvent=0x14c) returned 1
	[0282.441] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.453] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.480] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.515] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.555] SetEvent (hEvent=0x14c) returned 1
	[0282.555] SetEvent (hEvent=0x124) returned 1
	[0282.555] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0282.576] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.577] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0282.579] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.579] SetEvent (hEvent=0x14c) returned 1
	[0282.579] SetEvent (hEvent=0x124) returned 1
	[0282.579] SetEvent (hEvent=0x174) returned 1
	[0282.579] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.579] SetEvent (hEvent=0x168) returned 1
	[0282.579] SetEvent (hEvent=0x174) returned 1
	[0282.579] SetEvent (hEvent=0x104) returned 1
	[0282.579] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.582] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.592] SetEvent (hEvent=0x104) returned 1
	[0282.592] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.592] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.618] SetEvent (hEvent=0x104) returned 1
	[0282.618] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.620] SetEvent (hEvent=0x174) returned 1
	[0282.620] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.711] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.713] SetEvent (hEvent=0x174) returned 1
	[0282.713] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.714] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.856] SetEvent (hEvent=0x14c) returned 1
	[0282.856] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.857] SetEvent (hEvent=0x14c) returned 1
	[0282.857] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.873] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.908] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.930] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.992] SetEvent (hEvent=0x104) returned 1
	[0282.992] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.993] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.044] SetEvent (hEvent=0x104) returned 1
	[0283.044] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.046] SetEvent (hEvent=0x104) returned 1
	[0283.046] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.047] SetEvent (hEvent=0x104) returned 1
	[0283.047] SwitchToThread () returned 1
	[0283.047] SetEvent (hEvent=0x104) returned 1
	[0283.047] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.048] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.144] SetEvent (hEvent=0x124) returned 1
	[0283.144] SetEvent (hEvent=0x14c) returned 1
	[0283.144] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.146] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.159] SetEvent (hEvent=0x104) returned 1
	[0283.160] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.181] SetEvent (hEvent=0x104) returned 1
	[0283.181] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.184] SetEvent (hEvent=0x104) returned 1
	[0283.184] SwitchToThread () returned 1
	[0283.184] SetEvent (hEvent=0x104) returned 1
	[0283.184] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.184] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.304] SetEvent (hEvent=0x174) returned 1
	[0283.304] SetEvent (hEvent=0x124) returned 1
	[0283.304] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.340] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.349] SetEvent (hEvent=0x104) returned 1
	[0283.349] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.371] SetEvent (hEvent=0x104) returned 1
	[0283.371] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.378] SetEvent (hEvent=0x104) returned 1
	[0283.378] SwitchToThread () returned 1
	[0283.379] SetEvent (hEvent=0x104) returned 1
	[0283.379] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.379] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.460] SetEvent (hEvent=0x14c) returned 1
	[0283.460] SetEvent (hEvent=0x174) returned 1
	[0283.460] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.461] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.483] SetEvent (hEvent=0x104) returned 1
	[0283.483] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.507] SetEvent (hEvent=0x104) returned 1
	[0283.507] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.511] SetEvent (hEvent=0x104) returned 1
	[0283.511] SwitchToThread () returned 1
	[0283.511] SetEvent (hEvent=0x104) returned 1
	[0283.511] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.511] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.601] SetEvent (hEvent=0x124) returned 1
	[0283.601] SetEvent (hEvent=0x14c) returned 1
	[0283.601] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.602] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.652] SetEvent (hEvent=0x104) returned 1
	[0283.652] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.674] SetEvent (hEvent=0x104) returned 1
	[0283.674] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.676] SetEvent (hEvent=0x104) returned 1
	[0283.676] SwitchToThread () returned 1
	[0283.676] SetEvent (hEvent=0x104) returned 1
	[0283.676] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.676] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.775] SetEvent (hEvent=0x174) returned 1
	[0283.775] SetEvent (hEvent=0x124) returned 1
	[0283.775] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.777] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.815] SetEvent (hEvent=0x104) returned 1
	[0283.815] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.850] SetEvent (hEvent=0x104) returned 1
	[0283.850] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.855] SetEvent (hEvent=0x104) returned 1
	[0283.855] SwitchToThread () returned 1
	[0283.856] SetEvent (hEvent=0x104) returned 1
	[0283.856] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.856] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.955] SetEvent (hEvent=0x14c) returned 1
	[0283.956] SetEvent (hEvent=0x174) returned 1
	[0283.957] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.960] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.995] SetEvent (hEvent=0x104) returned 1
	[0283.995] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.030] SetEvent (hEvent=0x104) returned 1
	[0284.030] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.033] SetEvent (hEvent=0x104) returned 1
	[0284.033] SwitchToThread () returned 1
	[0284.034] SetEvent (hEvent=0x104) returned 1
	[0284.034] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.034] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.148] SetEvent (hEvent=0x124) returned 1
	[0284.148] SetEvent (hEvent=0x14c) returned 1
	[0284.149] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.150] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.167] SetEvent (hEvent=0x104) returned 1
	[0284.167] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.201] SetEvent (hEvent=0x104) returned 1
	[0284.201] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.206] SwitchToThread () returned 1
	[0284.207] SetEvent (hEvent=0x174) returned 1
	[0284.207] SetEvent (hEvent=0x104) returned 1
	[0284.208] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\LdD7S xtG\\sTfdrvnNNB6old.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\ldd7s xtg\\stfdrvnnnb6old.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0284.210] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.211] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b6c | out: lpMode=0x12422b6c) returned 0
	[0284.211] WriteFile (in: hFile=0x178, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422b5c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b5c*=0xfa000, lpOverlapped=0x0) returned 1
	[0284.257] CloseHandle (hObject=0x178) returned 1
	[0284.290] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\LdD7S xtG\\sTfdrvnNNB6old.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\ldd7s xtg\\stfdrvnnnb6old.doc")) returned 1
	[0284.311] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\ZRQK8ITXpYCj4zTc6UpV.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\zrqk8itxpycj4ztc6upv.rtf"), fInfoLevelId=0x0, lpFileInformation=0x124a61e8 | out: lpFileInformation=0x124a61e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49b3ad60, ftCreationTime.dwHighDateTime=0x1d81d9e, ftLastAccessTime.dwLowDateTime=0xed0abb30, ftLastAccessTime.dwHighDateTime=0x1d829e6, ftLastWriteTime.dwLowDateTime=0xed0abb30, ftLastWriteTime.dwHighDateTime=0x1d829e6, nFileSizeHigh=0x0, nFileSizeLow=0x147af)) returned 1
	[0284.311] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\ZRQK8ITXpYCj4zTc6UpV.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\zrqk8itxpycj4ztc6upv.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0284.311] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422ae4 | out: lpMode=0x12422ae4) returned 0
	[0284.312] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\ZRQK8ITXpYCj4zTc6UpV.rtf.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\zrqk8itxpycj4ztc6upv.rtf.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0284.312] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422ae4 | out: lpMode=0x12422ae4) returned 0
	[0284.312] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc540 | out: pbBuffer=0x123cc540) returned 1
	[0284.312] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c120 | out: pbBuffer=0x1251c120) returned 1
	[0284.312] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0284.313] WriteFile (in: hFile=0x17c, lpBuffer=0x1253d000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422ac0, lpOverlapped=0x0 | out: lpBuffer=0x1253d000*, lpNumberOfBytesWritten=0x12422ac0*=0x80, lpOverlapped=0x0) returned 1
	[0284.344] SetEvent (hEvent=0x104) returned 1
	[0284.344] ReadFile (in: hFile=0x178, lpBuffer=0x12d66000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422ab0, lpOverlapped=0x0 | out: lpBuffer=0x12d66000*, lpNumberOfBytesRead=0x12422ab0*=0x147af, lpOverlapped=0x0) returned 1
	[0284.348] WriteFile (in: hFile=0x17c, lpBuffer=0x12d66000*, nNumberOfBytesToWrite=0x147af, lpNumberOfBytesWritten=0x12422abc, lpOverlapped=0x0 | out: lpBuffer=0x12d66000*, lpNumberOfBytesWritten=0x12422abc*=0x147af, lpOverlapped=0x0) returned 1
	[0284.354] ReadFile (in: hFile=0x178, lpBuffer=0x12d66000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422ab0, lpOverlapped=0x0 | out: lpBuffer=0x12d66000*, lpNumberOfBytesRead=0x12422ab0*=0x0, lpOverlapped=0x0) returned 1
	[0284.354] CloseHandle (hObject=0x17c) returned 1
	[0284.359] CloseHandle (hObject=0x178) returned 1
	[0284.359] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12510000*, nNumberOfCharsToWrite=0x6c, lpNumberOfCharsWritten=0x12422774, lpReserved=0x0 | out: lpBuffer=0x12510000*, lpNumberOfCharsWritten=0x12422774*=0x6c) returned 1
	[0284.377] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.387] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\ZRQK8ITXpYCj4zTc6UpV.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\zrqk8itxpycj4ztc6upv.rtf")) returned 1
	[0284.396] SetEvent (hEvent=0x104) returned 1
	[0284.397] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0284.398] SetEvent (hEvent=0x104) returned 1
	[0284.398] SetEvent (hEvent=0x174) returned 1
	[0284.398] SetEvent (hEvent=0x124) returned 1
	[0284.398] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.399] SetEvent (hEvent=0x168) returned 1
	[0284.399] SetEvent (hEvent=0x124) returned 1
	[0284.433] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0284.435] SetEvent (hEvent=0x168) returned 1
	[0284.435] SetEvent (hEvent=0x124) returned 1
	[0284.439] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0284.439] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0284.440] SetEvent (hEvent=0x174) returned 1
	[0284.440] SetEvent (hEvent=0x124) returned 1
	[0284.440] SetEvent (hEvent=0x104) returned 1
	[0284.440] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.440] SetEvent (hEvent=0x104) returned 1
	[0284.442] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\ZRQK8ITXpYCj4zTc6UpV.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\zrqk8itxpycj4ztc6upv.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0284.444] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bd0 | out: lpMode=0x12422bd0) returned 0
	[0284.444] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422bc0, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422bc0*=0xfa000, lpOverlapped=0x0) returned 1
	[0284.467] CloseHandle (hObject=0x178) returned 1
	[0284.494] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\ZRQK8ITXpYCj4zTc6UpV.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\zrqk8itxpycj4ztc6upv.rtf")) returned 1
	[0284.508] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\cRamxOp.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\cramxop.pptx"), fInfoLevelId=0x0, lpFileInformation=0x124a6148 | out: lpFileInformation=0x124a6148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd977f120, ftCreationTime.dwHighDateTime=0x1d81b11, ftLastAccessTime.dwLowDateTime=0x58ecad40, ftLastAccessTime.dwHighDateTime=0x1d82820, ftLastWriteTime.dwLowDateTime=0x58ecad40, ftLastWriteTime.dwHighDateTime=0x1d82820, nFileSizeHigh=0x0, nFileSizeLow=0x8496)) returned 1
	[0284.508] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\cRamxOp.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\cramxop.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0284.508] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422ae4 | out: lpMode=0x12422ae4) returned 0
	[0284.508] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\cRamxOp.pptx.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\cramxop.pptx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0284.509] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422ae4 | out: lpMode=0x12422ae4) returned 0
	[0284.509] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc500 | out: pbBuffer=0x123cc500) returned 1
	[0284.509] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x12412220 | out: pbBuffer=0x12412220) returned 1
	[0284.509] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0284.509] WriteFile (in: hFile=0x17c, lpBuffer=0x1253d000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422ac0, lpOverlapped=0x0 | out: lpBuffer=0x1253d000*, lpNumberOfBytesWritten=0x12422ac0*=0x80, lpOverlapped=0x0) returned 1
	[0284.512] SetEvent (hEvent=0x124) returned 1
	[0284.512] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422ab0, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422ab0*=0x8496, lpOverlapped=0x0) returned 1
	[0284.514] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x8496, lpNumberOfBytesWritten=0x12422abc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422abc*=0x8496, lpOverlapped=0x0) returned 1
	[0284.517] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422ab0, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422ab0*=0x0, lpOverlapped=0x0) returned 1
	[0284.517] CloseHandle (hObject=0x17c) returned 1
	[0284.519] CloseHandle (hObject=0x178) returned 1
	[0284.520] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x125ce000*, nNumberOfCharsToWrite=0x60, lpNumberOfCharsWritten=0x12422774, lpReserved=0x0 | out: lpBuffer=0x125ce000*, lpNumberOfCharsWritten=0x12422774*=0x60) returned 1
	[0284.535] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.538] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\cRamxOp.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\cramxop.pptx")) returned 1
	[0284.549] SetEvent (hEvent=0x124) returned 1
	[0284.550] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0284.552] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.552] SetEvent (hEvent=0x124) returned 1
	[0284.552] SetEvent (hEvent=0x14c) returned 1
	[0284.552] SetEvent (hEvent=0x174) returned 1
	[0284.552] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.553] SetEvent (hEvent=0x168) returned 1
	[0284.553] SetEvent (hEvent=0x174) returned 1
	[0284.575] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0284.577] SetEvent (hEvent=0x174) returned 1
	[0284.579] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0284.580] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.580] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0284.581] SetEvent (hEvent=0x174) returned 1
	[0284.581] SetEvent (hEvent=0x14c) returned 1
	[0284.581] SetEvent (hEvent=0x124) returned 1
	[0284.581] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.581] SetEvent (hEvent=0x124) returned 1
	[0284.582] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\cRamxOp.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\cramxop.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0284.583] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bd0 | out: lpMode=0x12422bd0) returned 0
	[0284.584] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422bc0, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422bc0*=0xfa000, lpOverlapped=0x0) returned 1
	[0284.610] CloseHandle (hObject=0x178) returned 1
	[0284.636] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\vJv2RbfkMNDaXqowjBc\\TVGDzH\\cRamxOp.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\vjv2rbfkmndaxqowjbc\\tvgdzh\\cramxop.pptx")) returned 1
	[0284.650] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\xtaQYYC_Me3cfvNcxyDr.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\xtaqyyc_me3cfvncxydr.doc"), fInfoLevelId=0x0, lpFileInformation=0x124a6198 | out: lpFileInformation=0x124a6198*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91762470, ftCreationTime.dwHighDateTime=0x1d821d1, ftLastAccessTime.dwLowDateTime=0x9e13d9b0, ftLastAccessTime.dwHighDateTime=0x1d826a5, ftLastWriteTime.dwLowDateTime=0x9e13d9b0, ftLastWriteTime.dwHighDateTime=0x1d826a5, nFileSizeHigh=0x0, nFileSizeLow=0x18cb1)) returned 1
	[0284.650] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\xtaQYYC_Me3cfvNcxyDr.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\xtaqyyc_me3cfvncxydr.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0284.651] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0284.651] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\xtaQYYC_Me3cfvNcxyDr.doc.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\xtaqyyc_me3cfvncxydr.doc.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0284.651] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0284.651] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc500 | out: pbBuffer=0x123cc500) returned 1
	[0284.651] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c110 | out: pbBuffer=0x1251c110) returned 1
	[0284.651] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0284.651] WriteFile (in: hFile=0x17c, lpBuffer=0x1253f000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x1253f000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0284.654] SetEvent (hEvent=0x14c) returned 1
	[0284.654] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x18cb1, lpOverlapped=0x0) returned 1
	[0284.657] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x18cb1, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b84*=0x18cb1, lpOverlapped=0x0) returned 1
	[0284.661] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0284.661] CloseHandle (hObject=0x17c) returned 1
	[0284.666] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.672] CloseHandle (hObject=0x178) returned 1
	[0284.672] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1251a000*, nNumberOfCharsToWrite=0x51, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x1251a000*, lpNumberOfCharsWritten=0x1242283c*=0x51) returned 1
	[0284.688] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\xtaQYYC_Me3cfvNcxyDr.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\xtaqyyc_me3cfvncxydr.doc")) returned 1
	[0284.695] SetEvent (hEvent=0x14c) returned 1
	[0284.696] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0284.698] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.698] SetEvent (hEvent=0x14c) returned 1
	[0284.698] SetEvent (hEvent=0x104) returned 1
	[0284.698] SetEvent (hEvent=0x174) returned 1
	[0284.698] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.699] SetEvent (hEvent=0x174) returned 1
	[0284.724] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0284.724] SetEvent (hEvent=0x168) returned 1
	[0284.724] SetEvent (hEvent=0x174) returned 1
	[0284.728] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0284.728] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0284.728] SetEvent (hEvent=0x174) returned 1
	[0284.728] SetEvent (hEvent=0x104) returned 1
	[0284.729] SetEvent (hEvent=0x14c) returned 1
	[0284.729] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.729] SetEvent (hEvent=0x14c) returned 1
	[0284.730] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\xtaQYYC_Me3cfvNcxyDr.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\xtaqyyc_me3cfvncxydr.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0284.731] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0284.731] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0284.754] CloseHandle (hObject=0x178) returned 1
	[0284.779] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\l0xtaApata393X0pssf\\xtaQYYC_Me3cfvNcxyDr.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\l0xtaapata393x0pssf\\xtaqyyc_me3cfvncxydr.doc")) returned 1
	[0284.793] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lqYFgux47JTvr.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lqyfgux47jtvr.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x124a6058 | out: lpFileInformation=0x124a6058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc85a50b0, ftCreationTime.dwHighDateTime=0x1d7aadf, ftLastAccessTime.dwLowDateTime=0x2e5fd8c0, ftLastAccessTime.dwHighDateTime=0x1d7f56e, ftLastWriteTime.dwLowDateTime=0x2e5fd8c0, ftLastWriteTime.dwHighDateTime=0x1d7f56e, nFileSizeHigh=0x0, nFileSizeLow=0x4197)) returned 1
	[0284.793] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lqYFgux47JTvr.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lqyfgux47jtvr.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0284.794] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0284.794] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lqYFgux47JTvr.xlsx.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lqyfgux47jtvr.xlsx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0284.794] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0284.794] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc4c0 | out: pbBuffer=0x123cc4c0) returned 1
	[0284.794] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c110 | out: pbBuffer=0x1251c110) returned 1
	[0284.794] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0281 | out: pbBuffer=0x123c0281) returned 1
	[0284.794] WriteFile (in: hFile=0x17c, lpBuffer=0x1253b000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x1253b000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0284.797] SetEvent (hEvent=0x104) returned 1
	[0284.797] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x4197, lpOverlapped=0x0) returned 1
	[0284.798] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x4197, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0x4197, lpOverlapped=0x0) returned 1
	[0284.801] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0284.801] CloseHandle (hObject=0x17c) returned 1
	[0284.803] CloseHandle (hObject=0x178) returned 1
	[0284.803] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12428000*, nNumberOfCharsToWrite=0x37, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x12428000*, lpNumberOfCharsWritten=0x124228a0*=0x37) returned 1
	[0284.818] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.820] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lqYFgux47JTvr.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lqyfgux47jtvr.xlsx")) returned 1
	[0284.829] SetEvent (hEvent=0x104) returned 1
	[0284.831] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0284.836] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.836] SetEvent (hEvent=0x104) returned 1
	[0284.836] SetEvent (hEvent=0x124) returned 1
	[0284.836] SetEvent (hEvent=0x174) returned 1
	[0284.836] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.836] SetEvent (hEvent=0x168) returned 1
	[0284.836] SetEvent (hEvent=0x174) returned 1
	[0284.859] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0284.860] SetEvent (hEvent=0x174) returned 1
	[0284.863] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0284.863] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0284.863] SetEvent (hEvent=0x174) returned 1
	[0284.863] SetEvent (hEvent=0x124) returned 1
	[0284.863] SetEvent (hEvent=0x104) returned 1
	[0284.863] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.864] SetEvent (hEvent=0x104) returned 1
	[0284.864] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lqYFgux47JTvr.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lqyfgux47jtvr.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0284.866] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0284.866] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0284.890] CloseHandle (hObject=0x178) returned 1
	[0284.920] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lqYFgux47JTvr.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lqyfgux47jtvr.xlsx")) returned 1
	[0284.934] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\nZtB-SvOqljCAptbv.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\nztb-svoqljcaptbv.pptx"), fInfoLevelId=0x0, lpFileInformation=0x124a60a8 | out: lpFileInformation=0x124a60a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09c92a0, ftCreationTime.dwHighDateTime=0x1d7dc29, ftLastAccessTime.dwLowDateTime=0xe0b5b250, ftLastAccessTime.dwHighDateTime=0x1d81338, ftLastWriteTime.dwLowDateTime=0xe0b5b250, ftLastWriteTime.dwHighDateTime=0x1d81338, nFileSizeHigh=0x0, nFileSizeLow=0xd989)) returned 1
	[0284.934] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\nZtB-SvOqljCAptbv.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\nztb-svoqljcaptbv.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0284.935] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0284.935] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\nZtB-SvOqljCAptbv.pptx.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\nztb-svoqljcaptbv.pptx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0284.935] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0284.935] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc380 | out: pbBuffer=0x123cc380) returned 1
	[0284.935] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124121a0 | out: pbBuffer=0x124121a0) returned 1
	[0284.935] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0281 | out: pbBuffer=0x123c0281) returned 1
	[0284.936] WriteFile (in: hFile=0x17c, lpBuffer=0x1253b000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x1253b000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0284.975] SetEvent (hEvent=0x124) returned 1
	[0284.975] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0xd989, lpOverlapped=0x0) returned 1
	[0284.977] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0xd989, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0xd989, lpOverlapped=0x0) returned 1
	[0284.980] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0284.980] CloseHandle (hObject=0x17c) returned 1
	[0284.983] CloseHandle (hObject=0x178) returned 1
	[0284.983] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123fc080*, nNumberOfCharsToWrite=0x3b, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x123fc080*, lpNumberOfCharsWritten=0x124228a0*=0x3b) returned 1
	[0284.994] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.995] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\nZtB-SvOqljCAptbv.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\nztb-svoqljcaptbv.pptx")) returned 1
	[0285.002] SetEvent (hEvent=0x124) returned 1
	[0285.004] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0285.004] SetEvent (hEvent=0x124) returned 1
	[0285.004] SetEvent (hEvent=0x14c) returned 1
	[0285.004] SetEvent (hEvent=0x174) returned 1
	[0285.004] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.005] SetEvent (hEvent=0x168) returned 1
	[0285.005] SetEvent (hEvent=0x174) returned 1
	[0285.028] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0285.029] SetEvent (hEvent=0x174) returned 1
	[0285.033] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0285.033] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0285.033] SetEvent (hEvent=0x174) returned 1
	[0285.033] SetEvent (hEvent=0x14c) returned 1
	[0285.033] SetEvent (hEvent=0x124) returned 1
	[0285.033] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.034] SetEvent (hEvent=0x124) returned 1
	[0285.035] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\nZtB-SvOqljCAptbv.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\nztb-svoqljcaptbv.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0285.036] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0285.036] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0285.060] CloseHandle (hObject=0x178) returned 1
	[0285.092] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\nZtB-SvOqljCAptbv.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\nztb-svoqljcaptbv.pptx")) returned 1
	[0285.105] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pPFUnzZFOF 9YXG.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ppfunzzfof 9yxg.docx"), fInfoLevelId=0x0, lpFileInformation=0x124a6058 | out: lpFileInformation=0x124a6058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8dd59190, ftCreationTime.dwHighDateTime=0x1d7ccc0, ftLastAccessTime.dwLowDateTime=0x9723520, ftLastAccessTime.dwHighDateTime=0x1d7f8f3, ftLastWriteTime.dwLowDateTime=0x9723520, ftLastWriteTime.dwHighDateTime=0x1d7f8f3, nFileSizeHigh=0x0, nFileSizeLow=0xdba6)) returned 1
	[0285.105] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pPFUnzZFOF 9YXG.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ppfunzzfof 9yxg.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0285.105] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0285.105] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pPFUnzZFOF 9YXG.docx.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ppfunzzfof 9yxg.docx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0285.106] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0285.106] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc380 | out: pbBuffer=0x123cc380) returned 1
	[0285.106] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c110 | out: pbBuffer=0x1251c110) returned 1
	[0285.106] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc101 | out: pbBuffer=0x123fc101) returned 1
	[0285.106] WriteFile (in: hFile=0x17c, lpBuffer=0x12539000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12539000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0285.108] SetEvent (hEvent=0x14c) returned 1
	[0285.108] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0xdba6, lpOverlapped=0x0) returned 1
	[0285.111] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0xdba6, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0xdba6, lpOverlapped=0x0) returned 1
	[0285.114] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0285.114] CloseHandle (hObject=0x17c) returned 1
	[0285.116] CloseHandle (hObject=0x178) returned 1
	[0285.116] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123c0200*, nNumberOfCharsToWrite=0x39, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x123c0200*, lpNumberOfCharsWritten=0x124228a0*=0x39) returned 1
	[0285.129] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.174] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pPFUnzZFOF 9YXG.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ppfunzzfof 9yxg.docx")) returned 1
	[0285.180] SetEvent (hEvent=0x14c) returned 1
	[0285.182] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0285.183] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.183] SetEvent (hEvent=0x14c) returned 1
	[0285.183] SetEvent (hEvent=0x104) returned 1
	[0285.183] SetEvent (hEvent=0x174) returned 1
	[0285.183] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.185] SetEvent (hEvent=0x168) returned 1
	[0285.185] SetEvent (hEvent=0x174) returned 1
	[0285.204] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0285.205] SetEvent (hEvent=0x174) returned 1
	[0285.207] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0285.207] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0285.207] SetEvent (hEvent=0x174) returned 1
	[0285.207] SetEvent (hEvent=0x104) returned 1
	[0285.208] SetEvent (hEvent=0x14c) returned 1
	[0285.208] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.208] SetEvent (hEvent=0x14c) returned 1
	[0285.209] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pPFUnzZFOF 9YXG.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ppfunzzfof 9yxg.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0285.210] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0285.210] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0285.236] CloseHandle (hObject=0x178) returned 1
	[0285.262] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pPFUnzZFOF 9YXG.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ppfunzzfof 9yxg.docx")) returned 1
	[0285.274] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\qp2itemHgewbk.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\qp2itemhgewbk.docx"), fInfoLevelId=0x0, lpFileInformation=0x124a60a8 | out: lpFileInformation=0x124a60a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde07ccd0, ftCreationTime.dwHighDateTime=0x1d81f1f, ftLastAccessTime.dwLowDateTime=0x45827f00, ftLastAccessTime.dwHighDateTime=0x1d8208c, ftLastWriteTime.dwLowDateTime=0x45827f00, ftLastWriteTime.dwHighDateTime=0x1d8208c, nFileSizeHigh=0x0, nFileSizeLow=0x387e)) returned 1
	[0285.274] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\qp2itemHgewbk.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\qp2itemhgewbk.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0285.274] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0285.274] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\qp2itemHgewbk.docx.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\qp2itemhgewbk.docx.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0285.275] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0285.275] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc380 | out: pbBuffer=0x123cc380) returned 1
	[0285.275] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124121a0 | out: pbBuffer=0x124121a0) returned 1
	[0285.275] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0281 | out: pbBuffer=0x123c0281) returned 1
	[0285.275] WriteFile (in: hFile=0x17c, lpBuffer=0x1253b000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x1253b000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0285.277] SetEvent (hEvent=0x104) returned 1
	[0285.278] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x387e, lpOverlapped=0x0) returned 1
	[0285.279] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x387e, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0x387e, lpOverlapped=0x0) returned 1
	[0285.284] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0285.284] CloseHandle (hObject=0x17c) returned 1
	[0285.286] CloseHandle (hObject=0x178) returned 1
	[0285.286] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123d00e0*, nNumberOfCharsToWrite=0x37, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x123d00e0*, lpNumberOfCharsWritten=0x124228a0*=0x37) returned 1
	[0285.304] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.306] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\qp2itemHgewbk.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\qp2itemhgewbk.docx")) returned 1
	[0285.311] SetEvent (hEvent=0x104) returned 1
	[0285.313] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0285.313] SetEvent (hEvent=0x104) returned 1
	[0285.313] SetEvent (hEvent=0x124) returned 1
	[0285.313] SetEvent (hEvent=0x174) returned 1
	[0285.313] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.315] SetEvent (hEvent=0x168) returned 1
	[0285.315] SetEvent (hEvent=0x174) returned 1
	[0285.370] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0285.372] SetEvent (hEvent=0x174) returned 1
	[0285.375] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0285.375] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0285.375] SetEvent (hEvent=0x174) returned 1
	[0285.375] SetEvent (hEvent=0x124) returned 1
	[0285.375] SetEvent (hEvent=0x104) returned 1
	[0285.375] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.376] SetEvent (hEvent=0x104) returned 1
	[0285.377] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\qp2itemHgewbk.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\qp2itemhgewbk.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0285.378] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0285.378] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0285.404] CloseHandle (hObject=0x178) returned 1
	[0285.428] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\qp2itemHgewbk.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\qp2itemhgewbk.docx")) returned 1
	[0285.440] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Downloads" (normalized: "c:\\users\\rdhj0cnfevzx\\downloads"), fInfoLevelId=0x0, lpFileInformation=0x124a6058 | out: lpFileInformation=0x124a6058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0285.440] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Downloads" (normalized: "c:\\users\\rdhj0cnfevzx\\downloads"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0285.440] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Downloads\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9a8
	[0285.440] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0285.441] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x436bc315, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0285.441] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0285.441] FindClose (in: hFindFile=0x79f9a8 | out: hFindFile=0x79f9a8) returned 1
	[0285.441] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Downloads\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\downloads\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0285.441] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d94 | out: lpMode=0x12422d94) returned 0
	[0285.441] WriteFile (in: hFile=0x178, lpBuffer=0x12694000*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d84, lpOverlapped=0x0 | out: lpBuffer=0x12694000*, lpNumberOfBytesWritten=0x12422d84*=0xc85, lpOverlapped=0x0) returned 1
	[0285.442] CloseHandle (hObject=0x178) returned 1
	[0285.443] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123c0200*, nNumberOfCharsToWrite=0x3a, lpNumberOfCharsWritten=0x12422914, lpReserved=0x0 | out: lpBuffer=0x123c0200*, lpNumberOfCharsWritten=0x12422914*=0x3a) returned 1
	[0285.457] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Downloads\\desktop.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\downloads\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x124a6148 | out: lpFileInformation=0x124a6148*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x436bc315, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a)) returned 1
	[0285.457] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Favorites" (normalized: "c:\\users\\rdhj0cnfevzx\\favorites"), fInfoLevelId=0x0, lpFileInformation=0x124a6198 | out: lpFileInformation=0x124a6198*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0285.457] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Favorites" (normalized: "c:\\users\\rdhj0cnfevzx\\favorites"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0285.457] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Favorites\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fda8
	[0285.458] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0285.458] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43053b43, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43053b43, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43079e90, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bing.url", cAlternateFileName="")) returned 1
	[0285.458] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x436238c4, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0285.458] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43079e90, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43079e90, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1
	[0285.458] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0285.458] FindClose (in: hFindFile=0x79fda8 | out: hFindFile=0x79fda8) returned 1
	[0285.459] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Favorites\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\favorites\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0285.462] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d94 | out: lpMode=0x12422d94) returned 0
	[0285.463] WriteFile (in: hFile=0x178, lpBuffer=0x12694d80*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d84, lpOverlapped=0x0 | out: lpBuffer=0x12694d80*, lpNumberOfBytesWritten=0x12422d84*=0xc85, lpOverlapped=0x0) returned 1
	[0285.467] CloseHandle (hObject=0x178) returned 1
	[0285.469] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123c0280*, nNumberOfCharsToWrite=0x3a, lpNumberOfCharsWritten=0x12422914, lpReserved=0x0 | out: lpBuffer=0x123c0280*, lpNumberOfCharsWritten=0x12422914*=0x3a) returned 1
	[0285.483] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Favorites\\Bing.url" (normalized: "c:\\users\\rdhj0cnfevzx\\favorites\\bing.url"), fInfoLevelId=0x0, lpFileInformation=0x124a62d8 | out: lpFileInformation=0x124a62d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43053b43, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43053b43, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43079e90, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0xd0)) returned 1
	[0285.484] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Favorites\\Links" (normalized: "c:\\users\\rdhj0cnfevzx\\favorites\\links"), fInfoLevelId=0x0, lpFileInformation=0x124a6328 | out: lpFileInformation=0x124a6328*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43079e90, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43079e90, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0285.484] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Favorites\\Links" (normalized: "c:\\users\\rdhj0cnfevzx\\favorites\\links"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0285.484] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Favorites\\Links\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43079e90, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43079e90, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f968
	[0285.484] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43079e90, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43079e90, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0285.484] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x43079e90, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43079e90, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43079e90, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0285.484] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0285.484] FindClose (in: hFindFile=0x79f968 | out: hFindFile=0x79f968) returned 1
	[0285.485] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Favorites\\Links\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\favorites\\links\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0285.488] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d30 | out: lpMode=0x12422d30) returned 0
	[0285.488] WriteFile (in: hFile=0x178, lpBuffer=0x12696880*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d20, lpOverlapped=0x0 | out: lpBuffer=0x12696880*, lpNumberOfBytesWritten=0x12422d20*=0xc85, lpOverlapped=0x0) returned 1
	[0285.489] CloseHandle (hObject=0x178) returned 1
	[0285.490] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123c0300*, nNumberOfCharsToWrite=0x40, lpNumberOfCharsWritten=0x124228b0, lpReserved=0x0 | out: lpBuffer=0x123c0300*, lpNumberOfCharsWritten=0x124228b0*=0x40) returned 1
	[0285.504] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\favorites\\links\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x124a63c8 | out: lpFileInformation=0x124a63c8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x43079e90, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43079e90, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43079e90, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x50)) returned 1
	[0285.504] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Favorites\\desktop.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\favorites\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x124a6418 | out: lpFileInformation=0x124a6418*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x436238c4, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x192)) returned 1
	[0285.504] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Links" (normalized: "c:\\users\\rdhj0cnfevzx\\links"), fInfoLevelId=0x0, lpFileInformation=0x124a6468 | out: lpFileInformation=0x124a6468*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437c7194, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437ed538, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0285.504] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Links" (normalized: "c:\\users\\rdhj0cnfevzx\\links"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0285.504] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Links\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437c7194, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437ed538, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9e8
	[0285.505] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437c7194, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437ed538, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0285.505] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x43754b80, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43754b80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437ed538, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0285.505] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437c7194, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437c7194, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437c7194, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x207, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1
	[0285.505] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437c7194, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437c7194, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437c7194, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x3d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1
	[0285.505] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0285.505] FindClose (in: hFindFile=0x79f9e8 | out: hFindFile=0x79f9e8) returned 1
	[0285.505] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Links\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\links\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0285.505] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d94 | out: lpMode=0x12422d94) returned 0
	[0285.506] WriteFile (in: hFile=0x178, lpBuffer=0x12697600*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d84, lpOverlapped=0x0 | out: lpBuffer=0x12697600*, lpNumberOfBytesWritten=0x12422d84*=0xc85, lpOverlapped=0x0) returned 1
	[0285.507] CloseHandle (hObject=0x178) returned 1
	[0285.507] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123d02a0*, nNumberOfCharsToWrite=0x36, lpNumberOfCharsWritten=0x12422914, lpReserved=0x0 | out: lpBuffer=0x123d02a0*, lpNumberOfCharsWritten=0x12422914*=0x36) returned 1
	[0285.522] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Links\\Desktop.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\links\\desktop.lnk"), fInfoLevelId=0x0, lpFileInformation=0x124a65a8 | out: lpFileInformation=0x124a65a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437c7194, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437c7194, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437c7194, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x207)) returned 1
	[0285.523] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Links\\Downloads.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\links\\downloads.lnk"), fInfoLevelId=0x0, lpFileInformation=0x124a65f8 | out: lpFileInformation=0x124a65f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437c7194, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437c7194, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437c7194, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x3d0)) returned 1
	[0285.523] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Links\\desktop.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\links\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x124a6648 | out: lpFileInformation=0x124a6648*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x43754b80, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43754b80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437ed538, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x1f8)) returned 1
	[0285.523] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Local Settings" (normalized: "c:\\users\\rdhj0cnfevzx\\local settings"), fInfoLevelId=0x0, lpFileInformation=0x124a6698 | out: lpFileInformation=0x124a6698*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0285.524] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music" (normalized: "c:\\users\\rdhj0cnfevzx\\music"), fInfoLevelId=0x0, lpFileInformation=0x124a66e8 | out: lpFileInformation=0x124a66e8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf48bc745, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf48bc745, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1
	[0285.524] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music" (normalized: "c:\\users\\rdhj0cnfevzx\\music"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0285.524] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf48bc745, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf48bc745, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9a8
	[0285.524] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf48bc745, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf48bc745, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0285.524] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd4ac8b0, ftCreationTime.dwHighDateTime=0x1d81d4e, ftLastAccessTime.dwLowDateTime=0xa6a1c680, ftLastAccessTime.dwHighDateTime=0x1d81f59, ftLastWriteTime.dwLowDateTime=0xa6a1c680, ftLastWriteTime.dwHighDateTime=0x1d81f59, nFileSizeHigh=0x0, nFileSizeLow=0x10ce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="1Az3.m4a", cAlternateFileName="")) returned 1
	[0285.525] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b64d180, ftCreationTime.dwHighDateTime=0x1d81ded, ftLastAccessTime.dwLowDateTime=0xbccc8e80, ftLastAccessTime.dwHighDateTime=0x1d82865, ftLastWriteTime.dwLowDateTime=0xbccc8e80, ftLastWriteTime.dwHighDateTime=0x1d82865, nFileSizeHigh=0x0, nFileSizeLow=0x132fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="1xd7z.m4a", cAlternateFileName="")) returned 1
	[0285.525] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14ee59e0, ftCreationTime.dwHighDateTime=0x1d8253c, ftLastAccessTime.dwLowDateTime=0x7ed84980, ftLastAccessTime.dwHighDateTime=0x1d82878, ftLastWriteTime.dwLowDateTime=0x7ed84980, ftLastWriteTime.dwHighDateTime=0x1d82878, nFileSizeHigh=0x0, nFileSizeLow=0xd915, dwReserved0=0x0, dwReserved1=0x0, cFileName="7mWj_4UeifSg72HGe.mp3", cAlternateFileName="7MWJ_4~1.MP3")) returned 1
	[0285.525] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe249e610, ftCreationTime.dwHighDateTime=0x1d81d2c, ftLastAccessTime.dwLowDateTime=0x9aa8f410, ftLastAccessTime.dwHighDateTime=0x1d81f78, ftLastWriteTime.dwLowDateTime=0x9aa8f410, ftLastWriteTime.dwHighDateTime=0x1d81f78, nFileSizeHigh=0x0, nFileSizeLow=0xff66, dwReserved0=0x0, dwReserved1=0x0, cFileName="89UN7U8UcvWE0Pw.wav", cAlternateFileName="89UN7U~1.WAV")) returned 1
	[0285.525] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x813e8a90, ftCreationTime.dwHighDateTime=0x1d81ef5, ftLastAccessTime.dwLowDateTime=0x242f02b0, ftLastAccessTime.dwHighDateTime=0x1d8209b, ftLastWriteTime.dwLowDateTime=0x242f02b0, ftLastWriteTime.dwHighDateTime=0x1d8209b, nFileSizeHigh=0x0, nFileSizeLow=0x42a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="8FbWAE.wav", cAlternateFileName="")) returned 1
	[0285.525] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x997549d0, ftCreationTime.dwHighDateTime=0x1d8230c, ftLastAccessTime.dwLowDateTime=0x4f34bd80, ftLastAccessTime.dwHighDateTime=0x1d82918, ftLastWriteTime.dwLowDateTime=0x4f34bd80, ftLastWriteTime.dwHighDateTime=0x1d82918, nFileSizeHigh=0x0, nFileSizeLow=0x574e, dwReserved0=0x0, dwReserved1=0x0, cFileName="9DvsfF1.mp3", cAlternateFileName="")) returned 1
	[0285.525] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7892050, ftCreationTime.dwHighDateTime=0x1d81cc2, ftLastAccessTime.dwLowDateTime=0xad7cf830, ftLastAccessTime.dwHighDateTime=0x1d8251c, ftLastWriteTime.dwLowDateTime=0xad7cf830, ftLastWriteTime.dwHighDateTime=0x1d8251c, nFileSizeHigh=0x0, nFileSizeLow=0x188ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBxj.m4a", cAlternateFileName="")) returned 1
	[0285.525] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x861847f0, ftCreationTime.dwHighDateTime=0x1d8271e, ftLastAccessTime.dwLowDateTime=0x2d3a8a50, ftLastAccessTime.dwHighDateTime=0x1d827fd, ftLastWriteTime.dwLowDateTime=0x2d3a8a50, ftLastWriteTime.dwHighDateTime=0x1d827fd, nFileSizeHigh=0x0, nFileSizeLow=0x85ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="bmiYUjEBZe.m4a", cAlternateFileName="BMIYUJ~1.M4A")) returned 1
	[0285.525] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7586b080, ftCreationTime.dwHighDateTime=0x1d8275e, ftLastAccessTime.dwLowDateTime=0xd775fdb0, ftLastAccessTime.dwHighDateTime=0x1d82956, ftLastWriteTime.dwLowDateTime=0xd775fdb0, ftLastWriteTime.dwHighDateTime=0x1d82956, nFileSizeHigh=0x0, nFileSizeLow=0xf551, dwReserved0=0x0, dwReserved1=0x0, cFileName="B_jYrXtVn5ucpHO.mp3", cAlternateFileName="B_JYRX~1.MP3")) returned 1
	[0285.525] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x598f8f90, ftCreationTime.dwHighDateTime=0x1d81d41, ftLastAccessTime.dwLowDateTime=0x29af13c0, ftLastAccessTime.dwHighDateTime=0x1d821d5, ftLastWriteTime.dwLowDateTime=0x29af13c0, ftLastWriteTime.dwHighDateTime=0x1d821d5, nFileSizeHigh=0x0, nFileSizeLow=0x1357b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CBuit-0aOxX mu7.m4a", cAlternateFileName="CBUIT-~1.M4A")) returned 1
	[0285.525] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43649a85, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43649a85, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0285.525] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2629e0c0, ftCreationTime.dwHighDateTime=0x1d81b97, ftLastAccessTime.dwLowDateTime=0xfe78c960, ftLastAccessTime.dwHighDateTime=0x1d82708, ftLastWriteTime.dwLowDateTime=0xfe78c960, ftLastWriteTime.dwHighDateTime=0x1d82708, nFileSizeHigh=0x0, nFileSizeLow=0xbe89, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dh5LUhj8FtJW.wav", cAlternateFileName="DH5LUH~1.WAV")) returned 1
	[0285.525] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89504090, ftCreationTime.dwHighDateTime=0x1d82330, ftLastAccessTime.dwLowDateTime=0xa72e0ef0, ftLastAccessTime.dwHighDateTime=0x1d823a1, ftLastWriteTime.dwLowDateTime=0xa72e0ef0, ftLastWriteTime.dwHighDateTime=0x1d823a1, nFileSizeHigh=0x0, nFileSizeLow=0xe62e, dwReserved0=0x0, dwReserved1=0x0, cFileName="f_6TYxtCvn.wav", cAlternateFileName="F_6TYX~1.WAV")) returned 1
	[0285.525] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e825ac0, ftCreationTime.dwHighDateTime=0x1d8211f, ftLastAccessTime.dwLowDateTime=0x37d5ce20, ftLastAccessTime.dwHighDateTime=0x1d825a5, ftLastWriteTime.dwLowDateTime=0x37d5ce20, ftLastWriteTime.dwHighDateTime=0x1d825a5, nFileSizeHigh=0x0, nFileSizeLow=0x5d9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="g6S-SZO.m4a", cAlternateFileName="")) returned 1
	[0285.525] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91d42790, ftCreationTime.dwHighDateTime=0x1d82150, ftLastAccessTime.dwLowDateTime=0x93119c50, ftLastAccessTime.dwHighDateTime=0x1d82600, ftLastWriteTime.dwLowDateTime=0x93119c50, ftLastWriteTime.dwHighDateTime=0x1d82600, nFileSizeHigh=0x0, nFileSizeLow=0x648a, dwReserved0=0x0, dwReserved1=0x0, cFileName="iFgh6E2_tLRdo1ADper.wav", cAlternateFileName="IFGH6E~1.WAV")) returned 1
	[0285.525] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1d18e50, ftCreationTime.dwHighDateTime=0x1d821f9, ftLastAccessTime.dwLowDateTime=0x56b57d70, ftLastAccessTime.dwHighDateTime=0x1d824a8, ftLastWriteTime.dwLowDateTime=0x56b57d70, ftLastWriteTime.dwHighDateTime=0x1d824a8, nFileSizeHigh=0x0, nFileSizeLow=0x7998, dwReserved0=0x0, dwReserved1=0x0, cFileName="irILvbX.mp3", cAlternateFileName="")) returned 1
	[0285.525] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63794e80, ftCreationTime.dwHighDateTime=0x1d8204b, ftLastAccessTime.dwLowDateTime=0x114c9c30, ftLastAccessTime.dwHighDateTime=0x1d828d8, ftLastWriteTime.dwLowDateTime=0x114c9c30, ftLastWriteTime.dwHighDateTime=0x1d828d8, nFileSizeHigh=0x0, nFileSizeLow=0x91c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="j2iUu ERG0bmd.m4a", cAlternateFileName="J2IUUE~1.M4A")) returned 1
	[0285.525] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb309450, ftCreationTime.dwHighDateTime=0x1d81cb0, ftLastAccessTime.dwLowDateTime=0x9c6347b0, ftLastAccessTime.dwHighDateTime=0x1d8269e, ftLastWriteTime.dwLowDateTime=0x9c6347b0, ftLastWriteTime.dwHighDateTime=0x1d8269e, nFileSizeHigh=0x0, nFileSizeLow=0x13aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="n4Dd3.m4a", cAlternateFileName="")) returned 1
	[0285.525] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x443b5700, ftCreationTime.dwHighDateTime=0x1d81bc0, ftLastAccessTime.dwLowDateTime=0x6acec670, ftLastAccessTime.dwHighDateTime=0x1d825a4, ftLastWriteTime.dwLowDateTime=0x6acec670, ftLastWriteTime.dwHighDateTime=0x1d825a4, nFileSizeHigh=0x0, nFileSizeLow=0x6f4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="oM719AbRwy.wav", cAlternateFileName="OM719A~1.WAV")) returned 1
	[0285.525] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8f332c0, ftCreationTime.dwHighDateTime=0x1d826bb, ftLastAccessTime.dwLowDateTime=0x3ea61f30, ftLastAccessTime.dwHighDateTime=0x1d826da, ftLastWriteTime.dwLowDateTime=0x3ea61f30, ftLastWriteTime.dwHighDateTime=0x1d826da, nFileSizeHigh=0x0, nFileSizeLow=0x11b24, dwReserved0=0x0, dwReserved1=0x0, cFileName="OVNI4VExbL.mp3", cAlternateFileName="OVNI4V~1.MP3")) returned 1
	[0285.525] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x348c2e60, ftCreationTime.dwHighDateTime=0x1d82034, ftLastAccessTime.dwLowDateTime=0xa6cd16a0, ftLastAccessTime.dwHighDateTime=0x1d824c7, ftLastWriteTime.dwLowDateTime=0xa6cd16a0, ftLastWriteTime.dwHighDateTime=0x1d824c7, nFileSizeHigh=0x0, nFileSizeLow=0xd26e, dwReserved0=0x0, dwReserved1=0x0, cFileName="u-RQg0EKWE 9qH.m4a", cAlternateFileName="U-RQG0~1.M4A")) returned 1
	[0285.525] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe81e58d0, ftCreationTime.dwHighDateTime=0x1d826a2, ftLastAccessTime.dwLowDateTime=0x387198a0, ftLastAccessTime.dwHighDateTime=0x1d82708, ftLastWriteTime.dwLowDateTime=0x387198a0, ftLastWriteTime.dwHighDateTime=0x1d82708, nFileSizeHigh=0x0, nFileSizeLow=0xf6d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="u9Q3Ofxba-.wav", cAlternateFileName="U9Q3OF~1.WAV")) returned 1
	[0285.525] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba2040, ftCreationTime.dwHighDateTime=0x1d8257c, ftLastAccessTime.dwLowDateTime=0x4067d9c0, ftLastAccessTime.dwHighDateTime=0x1d82695, ftLastWriteTime.dwLowDateTime=0x4067d9c0, ftLastWriteTime.dwHighDateTime=0x1d82695, nFileSizeHigh=0x0, nFileSizeLow=0xdaf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="uMpJIKVYU.mp3", cAlternateFileName="UMPJIK~1.MP3")) returned 1
	[0285.525] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9129940, ftCreationTime.dwHighDateTime=0x1d824a6, ftLastAccessTime.dwLowDateTime=0xb815fc20, ftLastAccessTime.dwHighDateTime=0x1d82674, ftLastWriteTime.dwLowDateTime=0xb815fc20, ftLastWriteTime.dwHighDateTime=0x1d82674, nFileSizeHigh=0x0, nFileSizeLow=0x162eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="UmQfaBsq6MRToyGP3nkw.wav", cAlternateFileName="UMQFAB~1.WAV")) returned 1
	[0285.525] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad9710, ftCreationTime.dwHighDateTime=0x1d81cfb, ftLastAccessTime.dwLowDateTime=0xf70ca100, ftLastAccessTime.dwHighDateTime=0x1d82524, ftLastWriteTime.dwLowDateTime=0xf70ca100, ftLastWriteTime.dwHighDateTime=0x1d82524, nFileSizeHigh=0x0, nFileSizeLow=0x59d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="v_QBetNpRyLTlj.wav", cAlternateFileName="V_QBET~1.WAV")) returned 1
	[0285.525] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86695b10, ftCreationTime.dwHighDateTime=0x1d82753, ftLastAccessTime.dwLowDateTime=0xe6b21fb0, ftLastAccessTime.dwHighDateTime=0x1d82844, ftLastWriteTime.dwLowDateTime=0xe6b21fb0, ftLastWriteTime.dwHighDateTime=0x1d82844, nFileSizeHigh=0x0, nFileSizeLow=0xb31b, dwReserved0=0x0, dwReserved1=0x0, cFileName="WkJTMmRBO.mp3", cAlternateFileName="WKJTMM~1.MP3")) returned 1
	[0285.525] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47beb8d0, ftCreationTime.dwHighDateTime=0x1d824bd, ftLastAccessTime.dwLowDateTime=0x369df630, ftLastAccessTime.dwHighDateTime=0x1d8276d, ftLastWriteTime.dwLowDateTime=0x369df630, ftLastWriteTime.dwHighDateTime=0x1d8276d, nFileSizeHigh=0x0, nFileSizeLow=0xd0f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="x0nQ2_2Q.mp3", cAlternateFileName="")) returned 1
	[0285.526] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5877780, ftCreationTime.dwHighDateTime=0x1d822a2, ftLastAccessTime.dwLowDateTime=0xafa50020, ftLastAccessTime.dwHighDateTime=0x1d822de, ftLastWriteTime.dwLowDateTime=0xafa50020, ftLastWriteTime.dwHighDateTime=0x1d822de, nFileSizeHigh=0x0, nFileSizeLow=0x9d5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="xKR58gZ.mp3", cAlternateFileName="")) returned 1
	[0285.526] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ee51650, ftCreationTime.dwHighDateTime=0x1d826ad, ftLastAccessTime.dwLowDateTime=0xa5cce870, ftLastAccessTime.dwHighDateTime=0x1d82a1c, ftLastWriteTime.dwLowDateTime=0xa5cce870, ftLastWriteTime.dwHighDateTime=0x1d82a1c, nFileSizeHigh=0x0, nFileSizeLow=0x13651, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLnEoaOofsXUY.m4a", cAlternateFileName="XLNEOA~1.M4A")) returned 1
	[0285.526] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x614535c0, ftCreationTime.dwHighDateTime=0x1d82875, ftLastAccessTime.dwLowDateTime=0x63ea8930, ftLastAccessTime.dwHighDateTime=0x1d82896, ftLastWriteTime.dwLowDateTime=0x63ea8930, ftLastWriteTime.dwHighDateTime=0x1d82896, nFileSizeHigh=0x0, nFileSizeLow=0x4b51, dwReserved0=0x0, dwReserved1=0x0, cFileName="xMl1HGmN_CG.m4a", cAlternateFileName="XML1HG~1.M4A")) returned 1
	[0285.526] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbeb564b0, ftCreationTime.dwHighDateTime=0x1d829c3, ftLastAccessTime.dwLowDateTime=0x3dc36570, ftLastAccessTime.dwHighDateTime=0x1d829fd, ftLastWriteTime.dwLowDateTime=0x3dc36570, ftLastWriteTime.dwHighDateTime=0x1d829fd, nFileSizeHigh=0x0, nFileSizeLow=0xc7f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="xr3cPyGn7vjWvC52bVw.m4a", cAlternateFileName="XR3CPY~1.M4A")) returned 1
	[0285.526] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed819740, ftCreationTime.dwHighDateTime=0x1d81ba0, ftLastAccessTime.dwLowDateTime=0xb8627470, ftLastAccessTime.dwHighDateTime=0x1d81edf, ftLastWriteTime.dwLowDateTime=0xb8627470, ftLastWriteTime.dwHighDateTime=0x1d81edf, nFileSizeHigh=0x0, nFileSizeLow=0x2fe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="YFHDjYBjycFIwib.wav", cAlternateFileName="YFHDJY~1.WAV")) returned 1
	[0285.526] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4be1a830, ftCreationTime.dwHighDateTime=0x1d82244, ftLastAccessTime.dwLowDateTime=0x6b27f130, ftLastAccessTime.dwHighDateTime=0x1d8246b, ftLastWriteTime.dwLowDateTime=0x6b27f130, ftLastWriteTime.dwHighDateTime=0x1d8246b, nFileSizeHigh=0x0, nFileSizeLow=0x820, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZCNbC-F2.mp3", cAlternateFileName="")) returned 1
	[0285.526] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a954f20, ftCreationTime.dwHighDateTime=0x1d824ae, ftLastAccessTime.dwLowDateTime=0xe68ddd70, ftLastAccessTime.dwHighDateTime=0x1d824e4, ftLastWriteTime.dwLowDateTime=0xe68ddd70, ftLastWriteTime.dwHighDateTime=0x1d824e4, nFileSizeHigh=0x0, nFileSizeLow=0x1635d, dwReserved0=0x0, dwReserved1=0x0, cFileName="zGcdowqxu7RCr.m4a", cAlternateFileName="ZGCDOW~1.M4A")) returned 1
	[0285.526] FindNextFileW (in: hFindFile=0x79f9a8, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0285.526] FindClose (in: hFindFile=0x79f9a8 | out: hFindFile=0x79f9a8) returned 1
	[0285.526] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0285.527] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d94 | out: lpMode=0x12422d94) returned 0
	[0285.527] WriteFile (in: hFile=0x178, lpBuffer=0x12698380*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d84, lpOverlapped=0x0 | out: lpBuffer=0x12698380*, lpNumberOfBytesWritten=0x12422d84*=0xc85, lpOverlapped=0x0) returned 1
	[0285.530] CloseHandle (hObject=0x178) returned 1
	[0285.531] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123d0310*, nNumberOfCharsToWrite=0x36, lpNumberOfCharsWritten=0x12422914, lpReserved=0x0 | out: lpBuffer=0x123d0310*, lpNumberOfCharsWritten=0x12422914*=0x36) returned 1
	[0285.542] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\1Az3.m4a" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\1az3.m4a"), fInfoLevelId=0x0, lpFileInformation=0x124a71d8 | out: lpFileInformation=0x124a71d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd4ac8b0, ftCreationTime.dwHighDateTime=0x1d81d4e, ftLastAccessTime.dwLowDateTime=0xa6a1c680, ftLastAccessTime.dwHighDateTime=0x1d81f59, ftLastWriteTime.dwLowDateTime=0xa6a1c680, ftLastWriteTime.dwHighDateTime=0x1d81f59, nFileSizeHigh=0x0, nFileSizeLow=0x10ce8)) returned 1
	[0285.542] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\1xd7z.m4a" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\1xd7z.m4a"), fInfoLevelId=0x0, lpFileInformation=0x124a7228 | out: lpFileInformation=0x124a7228*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b64d180, ftCreationTime.dwHighDateTime=0x1d81ded, ftLastAccessTime.dwLowDateTime=0xbccc8e80, ftLastAccessTime.dwHighDateTime=0x1d82865, ftLastWriteTime.dwLowDateTime=0xbccc8e80, ftLastWriteTime.dwHighDateTime=0x1d82865, nFileSizeHigh=0x0, nFileSizeLow=0x132fb)) returned 1
	[0285.542] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7mWj_4UeifSg72HGe.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7mwj_4ueifsg72hge.mp3"), fInfoLevelId=0x0, lpFileInformation=0x124a7278 | out: lpFileInformation=0x124a7278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14ee59e0, ftCreationTime.dwHighDateTime=0x1d8253c, ftLastAccessTime.dwLowDateTime=0x7ed84980, ftLastAccessTime.dwHighDateTime=0x1d82878, ftLastWriteTime.dwLowDateTime=0x7ed84980, ftLastWriteTime.dwHighDateTime=0x1d82878, nFileSizeHigh=0x0, nFileSizeLow=0xd915)) returned 1
	[0285.543] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7mWj_4UeifSg72HGe.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7mwj_4ueifsg72hge.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0285.543] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0285.543] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7mWj_4UeifSg72HGe.mp3.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7mwj_4ueifsg72hge.mp3.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0285.543] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0285.543] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cdc80 | out: pbBuffer=0x123cdc80) returned 1
	[0285.543] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251d130 | out: pbBuffer=0x1251d130) returned 1
	[0285.543] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0401 | out: pbBuffer=0x123c0401) returned 1
	[0285.543] WriteFile (in: hFile=0x17c, lpBuffer=0x125cf000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x125cf000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0285.549] SetEvent (hEvent=0x124) returned 1
	[0285.549] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0xd915, lpOverlapped=0x0) returned 1
	[0285.553] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0xd915, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0xd915, lpOverlapped=0x0) returned 1
	[0285.557] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0285.558] CloseHandle (hObject=0x17c) returned 1
	[0285.566] CloseHandle (hObject=0x178) returned 1
	[0285.566] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12428000*, nNumberOfCharsToWrite=0x36, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x12428000*, lpNumberOfCharsWritten=0x124228a0*=0x36) returned 1
	[0285.585] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.587] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7mWj_4UeifSg72HGe.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7mwj_4ueifsg72hge.mp3")) returned 1
	[0285.600] SetEvent (hEvent=0x124) returned 1
	[0285.602] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0285.603] SetEvent (hEvent=0x124) returned 1
	[0285.603] SetEvent (hEvent=0x14c) returned 1
	[0285.603] SetEvent (hEvent=0x174) returned 1
	[0285.603] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.604] SetEvent (hEvent=0x168) returned 1
	[0285.604] SetEvent (hEvent=0x174) returned 1
	[0285.635] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0285.637] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.638] SetEvent (hEvent=0x174) returned 1
	[0285.641] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0285.643] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0285.644] SetEvent (hEvent=0x174) returned 1
	[0285.644] SetEvent (hEvent=0x14c) returned 1
	[0285.644] SetEvent (hEvent=0x124) returned 1
	[0285.644] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.644] SetEvent (hEvent=0x168) returned 1
	[0285.644] SetEvent (hEvent=0x124) returned 1
	[0285.645] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7mWj_4UeifSg72HGe.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7mwj_4ueifsg72hge.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0285.647] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0285.647] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0285.676] CloseHandle (hObject=0x178) returned 1
	[0285.710] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\7mWj_4UeifSg72HGe.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\7mwj_4ueifsg72hge.mp3")) returned 1
	[0285.724] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\89UN7U8UcvWE0Pw.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\89un7u8ucvwe0pw.wav"), fInfoLevelId=0x0, lpFileInformation=0x124a6008 | out: lpFileInformation=0x124a6008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe249e610, ftCreationTime.dwHighDateTime=0x1d81d2c, ftLastAccessTime.dwLowDateTime=0x9aa8f410, ftLastAccessTime.dwHighDateTime=0x1d81f78, ftLastWriteTime.dwLowDateTime=0x9aa8f410, ftLastWriteTime.dwHighDateTime=0x1d81f78, nFileSizeHigh=0x0, nFileSizeLow=0xff66)) returned 1
	[0285.724] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\89UN7U8UcvWE0Pw.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\89un7u8ucvwe0pw.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0285.724] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0285.724] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\89UN7U8UcvWE0Pw.wav.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\89un7u8ucvwe0pw.wav.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0285.724] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0285.725] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc240 | out: pbBuffer=0x123cc240) returned 1
	[0285.725] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124121a0 | out: pbBuffer=0x124121a0) returned 1
	[0285.725] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0285.725] WriteFile (in: hFile=0x17c, lpBuffer=0x1253b000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x1253b000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0285.727] SetEvent (hEvent=0x14c) returned 1
	[0285.727] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0xff66, lpOverlapped=0x0) returned 1
	[0285.730] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0xff66, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0xff66, lpOverlapped=0x0) returned 1
	[0285.733] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0285.734] CloseHandle (hObject=0x17c) returned 1
	[0285.736] CloseHandle (hObject=0x178) returned 1
	[0285.736] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123d00e0*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x123d00e0*, lpNumberOfCharsWritten=0x124228a0*=0x34) returned 1
	[0285.747] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.750] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\89UN7U8UcvWE0Pw.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\89un7u8ucvwe0pw.wav")) returned 1
	[0285.760] SetEvent (hEvent=0x14c) returned 1
	[0285.761] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0285.762] SetEvent (hEvent=0x14c) returned 1
	[0285.762] SetEvent (hEvent=0x104) returned 1
	[0285.762] SetEvent (hEvent=0x174) returned 1
	[0285.762] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.763] SetEvent (hEvent=0x174) returned 1
	[0285.786] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0285.787] SetEvent (hEvent=0x168) returned 1
	[0285.787] SetEvent (hEvent=0x174) returned 1
	[0285.789] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0285.790] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0285.790] SetEvent (hEvent=0x174) returned 1
	[0285.790] SetEvent (hEvent=0x104) returned 1
	[0285.790] SetEvent (hEvent=0x14c) returned 1
	[0285.790] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.790] SetEvent (hEvent=0x14c) returned 1
	[0285.791] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\89UN7U8UcvWE0Pw.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\89un7u8ucvwe0pw.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0285.792] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0285.792] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0285.814] CloseHandle (hObject=0x178) returned 1
	[0285.842] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\89UN7U8UcvWE0Pw.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\89un7u8ucvwe0pw.wav")) returned 1
	[0285.853] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\8FbWAE.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\8fbwae.wav"), fInfoLevelId=0x0, lpFileInformation=0x124a6058 | out: lpFileInformation=0x124a6058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x813e8a90, ftCreationTime.dwHighDateTime=0x1d81ef5, ftLastAccessTime.dwLowDateTime=0x242f02b0, ftLastAccessTime.dwHighDateTime=0x1d8209b, ftLastWriteTime.dwLowDateTime=0x242f02b0, ftLastWriteTime.dwHighDateTime=0x1d8209b, nFileSizeHigh=0x0, nFileSizeLow=0x42a7)) returned 1
	[0285.853] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\8FbWAE.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\8fbwae.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0285.853] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0285.854] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\8FbWAE.wav.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\8fbwae.wav.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0285.854] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0285.854] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc240 | out: pbBuffer=0x123cc240) returned 1
	[0285.854] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c110 | out: pbBuffer=0x1251c110) returned 1
	[0285.854] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0285.854] WriteFile (in: hFile=0x17c, lpBuffer=0x12537000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12537000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0285.857] SetEvent (hEvent=0x104) returned 1
	[0285.857] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x42a7, lpOverlapped=0x0) returned 1
	[0285.859] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x42a7, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0x42a7, lpOverlapped=0x0) returned 1
	[0285.861] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0285.861] CloseHandle (hObject=0x17c) returned 1
	[0285.863] CloseHandle (hObject=0x178) returned 1
	[0285.863] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x125d2000*, nNumberOfCharsToWrite=0x2b, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x125d2000*, lpNumberOfCharsWritten=0x124228a0*=0x2b) returned 1
	[0285.876] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.877] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\8FbWAE.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\8fbwae.wav")) returned 1
	[0285.883] SetEvent (hEvent=0x104) returned 1
	[0285.884] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0285.886] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.886] SetEvent (hEvent=0x104) returned 1
	[0285.886] SetEvent (hEvent=0x124) returned 1
	[0285.886] SetEvent (hEvent=0x174) returned 1
	[0285.886] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.887] SetEvent (hEvent=0x174) returned 1
	[0285.909] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0285.909] SetEvent (hEvent=0x168) returned 1
	[0285.910] SetEvent (hEvent=0x174) returned 1
	[0285.911] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0285.912] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0285.912] SetEvent (hEvent=0x174) returned 1
	[0285.912] SetEvent (hEvent=0x124) returned 1
	[0285.912] SetEvent (hEvent=0x104) returned 1
	[0285.912] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.913] SetEvent (hEvent=0x104) returned 1
	[0285.913] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\8FbWAE.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\8fbwae.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0285.914] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0285.914] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0285.936] CloseHandle (hObject=0x178) returned 1
	[0285.962] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\8FbWAE.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\8fbwae.wav")) returned 1
	[0285.974] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\9DvsfF1.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\9dvsff1.mp3"), fInfoLevelId=0x0, lpFileInformation=0x124a6008 | out: lpFileInformation=0x124a6008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x997549d0, ftCreationTime.dwHighDateTime=0x1d8230c, ftLastAccessTime.dwLowDateTime=0x4f34bd80, ftLastAccessTime.dwHighDateTime=0x1d82918, ftLastWriteTime.dwLowDateTime=0x4f34bd80, ftLastWriteTime.dwHighDateTime=0x1d82918, nFileSizeHigh=0x0, nFileSizeLow=0x574e)) returned 1
	[0285.974] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\9DvsfF1.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\9dvsff1.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0285.974] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0285.974] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\9DvsfF1.mp3.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\9dvsff1.mp3.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0285.974] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0285.975] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc240 | out: pbBuffer=0x123cc240) returned 1
	[0285.975] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124121a0 | out: pbBuffer=0x124121a0) returned 1
	[0285.975] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0285.975] WriteFile (in: hFile=0x17c, lpBuffer=0x12537000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12537000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0285.977] SetEvent (hEvent=0x124) returned 1
	[0285.977] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x574e, lpOverlapped=0x0) returned 1
	[0285.979] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x574e, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0x574e, lpOverlapped=0x0) returned 1
	[0285.981] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0285.981] CloseHandle (hObject=0x17c) returned 1
	[0285.983] CloseHandle (hObject=0x178) returned 1
	[0285.983] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x125d2000*, nNumberOfCharsToWrite=0x2c, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x125d2000*, lpNumberOfCharsWritten=0x124228a0*=0x2c) returned 1
	[0285.994] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.995] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\9DvsfF1.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\9dvsff1.mp3")) returned 1
	[0286.001] SetEvent (hEvent=0x124) returned 1
	[0286.005] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0286.006] SetEvent (hEvent=0x124) returned 1
	[0286.006] SetEvent (hEvent=0x14c) returned 1
	[0286.006] SetEvent (hEvent=0x174) returned 1
	[0286.006] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.008] SetEvent (hEvent=0x168) returned 1
	[0286.008] SetEvent (hEvent=0x174) returned 1
	[0286.028] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0286.030] SetEvent (hEvent=0x174) returned 1
	[0286.032] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0286.033] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0286.033] SetEvent (hEvent=0x174) returned 1
	[0286.033] SetEvent (hEvent=0x14c) returned 1
	[0286.033] SetEvent (hEvent=0x124) returned 1
	[0286.033] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.034] SetEvent (hEvent=0x168) returned 1
	[0286.034] SetEvent (hEvent=0x124) returned 1
	[0286.035] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\9DvsfF1.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\9dvsff1.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0286.037] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0286.037] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0286.069] CloseHandle (hObject=0x178) returned 1
	[0286.104] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\9DvsfF1.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\9dvsff1.mp3")) returned 1
	[0286.118] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\BBxj.m4a" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\bbxj.m4a"), fInfoLevelId=0x0, lpFileInformation=0x124a6058 | out: lpFileInformation=0x124a6058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7892050, ftCreationTime.dwHighDateTime=0x1d81cc2, ftLastAccessTime.dwLowDateTime=0xad7cf830, ftLastAccessTime.dwHighDateTime=0x1d8251c, ftLastWriteTime.dwLowDateTime=0xad7cf830, ftLastWriteTime.dwHighDateTime=0x1d8251c, nFileSizeHigh=0x0, nFileSizeLow=0x188ae)) returned 1
	[0286.119] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\B_jYrXtVn5ucpHO.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\b_jyrxtvn5ucpho.mp3"), fInfoLevelId=0x0, lpFileInformation=0x124a60a8 | out: lpFileInformation=0x124a60a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7586b080, ftCreationTime.dwHighDateTime=0x1d8275e, ftLastAccessTime.dwLowDateTime=0xd775fdb0, ftLastAccessTime.dwHighDateTime=0x1d82956, ftLastWriteTime.dwLowDateTime=0xd775fdb0, ftLastWriteTime.dwHighDateTime=0x1d82956, nFileSizeHigh=0x0, nFileSizeLow=0xf551)) returned 1
	[0286.119] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\B_jYrXtVn5ucpHO.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\b_jyrxtvn5ucpho.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0286.119] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0286.119] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\B_jYrXtVn5ucpHO.mp3.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\b_jyrxtvn5ucpho.mp3.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0286.120] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0286.120] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc280 | out: pbBuffer=0x123cc280) returned 1
	[0286.120] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c210 | out: pbBuffer=0x1251c210) returned 1
	[0286.120] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0286.120] WriteFile (in: hFile=0x17c, lpBuffer=0x12539000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12539000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0286.123] SetEvent (hEvent=0x14c) returned 1
	[0286.123] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0xf551, lpOverlapped=0x0) returned 1
	[0286.127] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0xf551, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0xf551, lpOverlapped=0x0) returned 1
	[0286.131] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0286.131] CloseHandle (hObject=0x17c) returned 1
	[0286.135] CloseHandle (hObject=0x178) returned 1
	[0286.135] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12428000*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x12428000*, lpNumberOfCharsWritten=0x124228a0*=0x34) returned 1
	[0286.152] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.154] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\B_jYrXtVn5ucpHO.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\b_jyrxtvn5ucpho.mp3")) returned 1
	[0286.165] SetEvent (hEvent=0x14c) returned 1
	[0286.170] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0286.171] SetEvent (hEvent=0x14c) returned 1
	[0286.171] SetEvent (hEvent=0x104) returned 1
	[0286.171] SetEvent (hEvent=0x174) returned 1
	[0286.171] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.172] SetEvent (hEvent=0x168) returned 1
	[0286.172] SetEvent (hEvent=0x174) returned 1
	[0286.209] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0286.212] SetEvent (hEvent=0x174) returned 1
	[0286.233] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0286.233] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0286.234] SetEvent (hEvent=0x174) returned 1
	[0286.234] SetEvent (hEvent=0x104) returned 1
	[0286.234] SetEvent (hEvent=0x14c) returned 1
	[0286.234] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.235] SetEvent (hEvent=0x168) returned 1
	[0286.235] SetEvent (hEvent=0x14c) returned 1
	[0286.235] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\B_jYrXtVn5ucpHO.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\b_jyrxtvn5ucpho.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0286.237] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0286.237] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0286.270] CloseHandle (hObject=0x178) returned 1
	[0286.364] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\B_jYrXtVn5ucpHO.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\b_jyrxtvn5ucpho.mp3")) returned 1
	[0286.380] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\CBuit-0aOxX mu7.m4a" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\cbuit-0aoxx mu7.m4a"), fInfoLevelId=0x0, lpFileInformation=0x124a6008 | out: lpFileInformation=0x124a6008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x598f8f90, ftCreationTime.dwHighDateTime=0x1d81d41, ftLastAccessTime.dwLowDateTime=0x29af13c0, ftLastAccessTime.dwHighDateTime=0x1d821d5, ftLastWriteTime.dwLowDateTime=0x29af13c0, ftLastWriteTime.dwHighDateTime=0x1d821d5, nFileSizeHigh=0x0, nFileSizeLow=0x1357b)) returned 1
	[0286.380] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\Dh5LUhj8FtJW.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\dh5luhj8ftjw.wav"), fInfoLevelId=0x0, lpFileInformation=0x124a6058 | out: lpFileInformation=0x124a6058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2629e0c0, ftCreationTime.dwHighDateTime=0x1d81b97, ftLastAccessTime.dwLowDateTime=0xfe78c960, ftLastAccessTime.dwHighDateTime=0x1d82708, ftLastWriteTime.dwLowDateTime=0xfe78c960, ftLastWriteTime.dwHighDateTime=0x1d82708, nFileSizeHigh=0x0, nFileSizeLow=0xbe89)) returned 1
	[0286.381] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\Dh5LUhj8FtJW.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\dh5luhj8ftjw.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0286.381] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0286.381] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\Dh5LUhj8FtJW.wav.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\dh5luhj8ftjw.wav.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0286.381] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0286.381] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc280 | out: pbBuffer=0x123cc280) returned 1
	[0286.381] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124122a0 | out: pbBuffer=0x124122a0) returned 1
	[0286.382] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0286.382] WriteFile (in: hFile=0x17c, lpBuffer=0x12539000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12539000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0286.384] SetEvent (hEvent=0x104) returned 1
	[0286.384] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0xbe89, lpOverlapped=0x0) returned 1
	[0286.388] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0xbe89, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0xbe89, lpOverlapped=0x0) returned 1
	[0286.391] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0286.391] CloseHandle (hObject=0x17c) returned 1
	[0286.394] CloseHandle (hObject=0x178) returned 1
	[0286.394] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123d00e0*, nNumberOfCharsToWrite=0x31, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x123d00e0*, lpNumberOfCharsWritten=0x124228a0*=0x31) returned 1
	[0286.418] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.425] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\Dh5LUhj8FtJW.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\dh5luhj8ftjw.wav")) returned 1
	[0286.435] SetEvent (hEvent=0x104) returned 1
	[0286.449] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0286.450] SetEvent (hEvent=0x104) returned 1
	[0286.450] SetEvent (hEvent=0x124) returned 1
	[0286.450] SetEvent (hEvent=0x174) returned 1
	[0286.450] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.451] SetEvent (hEvent=0x174) returned 1
	[0286.498] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0286.519] SetEvent (hEvent=0x168) returned 1
	[0286.519] SetEvent (hEvent=0x174) returned 1
	[0286.523] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0286.523] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0286.524] SetEvent (hEvent=0x174) returned 1
	[0286.524] SetEvent (hEvent=0x124) returned 1
	[0286.524] SetEvent (hEvent=0x104) returned 1
	[0286.524] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.524] SetEvent (hEvent=0x168) returned 1
	[0286.525] SetEvent (hEvent=0x104) returned 1
	[0286.526] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\Dh5LUhj8FtJW.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\dh5luhj8ftjw.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0286.527] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0286.528] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0286.555] CloseHandle (hObject=0x178) returned 1
	[0286.588] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\Dh5LUhj8FtJW.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\dh5luhj8ftjw.wav")) returned 1
	[0286.604] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\OVNI4VExbL.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ovni4vexbl.mp3"), fInfoLevelId=0x0, lpFileInformation=0x124a6008 | out: lpFileInformation=0x124a6008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8f332c0, ftCreationTime.dwHighDateTime=0x1d826bb, ftLastAccessTime.dwLowDateTime=0x3ea61f30, ftLastAccessTime.dwHighDateTime=0x1d826da, ftLastWriteTime.dwLowDateTime=0x3ea61f30, ftLastWriteTime.dwHighDateTime=0x1d826da, nFileSizeHigh=0x0, nFileSizeLow=0x11b24)) returned 1
	[0286.604] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\OVNI4VExbL.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ovni4vexbl.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0286.604] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0286.604] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\OVNI4VExbL.mp3.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ovni4vexbl.mp3.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0286.605] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0286.605] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc240 | out: pbBuffer=0x123cc240) returned 1
	[0286.605] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c110 | out: pbBuffer=0x1251c110) returned 1
	[0286.605] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0286.605] WriteFile (in: hFile=0x17c, lpBuffer=0x1253b000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x1253b000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0286.608] SetEvent (hEvent=0x124) returned 1
	[0286.608] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x11b24, lpOverlapped=0x0) returned 1
	[0286.612] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x11b24, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0x11b24, lpOverlapped=0x0) returned 1
	[0286.617] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0286.617] CloseHandle (hObject=0x17c) returned 1
	[0286.622] CloseHandle (hObject=0x178) returned 1
	[0286.622] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1253c000*, nNumberOfCharsToWrite=0x2f, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x1253c000*, lpNumberOfCharsWritten=0x124228a0*=0x2f) returned 1
	[0286.637] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.640] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\OVNI4VExbL.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ovni4vexbl.mp3")) returned 1
	[0286.656] SetEvent (hEvent=0x124) returned 1
	[0286.658] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0286.659] SetEvent (hEvent=0x124) returned 1
	[0286.659] SetEvent (hEvent=0x14c) returned 1
	[0286.659] SetEvent (hEvent=0x174) returned 1
	[0286.659] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.659] SetEvent (hEvent=0x174) returned 1
	[0286.688] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0286.688] SetEvent (hEvent=0x168) returned 1
	[0286.688] SetEvent (hEvent=0x174) returned 1
	[0286.690] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0286.692] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.692] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0286.692] SetEvent (hEvent=0x174) returned 1
	[0286.692] SetEvent (hEvent=0x14c) returned 1
	[0286.692] SetEvent (hEvent=0x124) returned 1
	[0286.692] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.692] SetEvent (hEvent=0x124) returned 1
	[0286.693] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\OVNI4VExbL.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ovni4vexbl.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0286.694] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0286.694] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0286.715] CloseHandle (hObject=0x178) returned 1
	[0286.740] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\OVNI4VExbL.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ovni4vexbl.mp3")) returned 1
	[0286.752] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\UmQfaBsq6MRToyGP3nkw.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\umqfabsq6mrtoygp3nkw.wav"), fInfoLevelId=0x0, lpFileInformation=0x124a6058 | out: lpFileInformation=0x124a6058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9129940, ftCreationTime.dwHighDateTime=0x1d824a6, ftLastAccessTime.dwLowDateTime=0xb815fc20, ftLastAccessTime.dwHighDateTime=0x1d82674, ftLastWriteTime.dwLowDateTime=0xb815fc20, ftLastWriteTime.dwHighDateTime=0x1d82674, nFileSizeHigh=0x0, nFileSizeLow=0x162eb)) returned 1
	[0286.752] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\UmQfaBsq6MRToyGP3nkw.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\umqfabsq6mrtoygp3nkw.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0286.752] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0286.752] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\UmQfaBsq6MRToyGP3nkw.wav.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\umqfabsq6mrtoygp3nkw.wav.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0286.753] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0286.753] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc240 | out: pbBuffer=0x123cc240) returned 1
	[0286.753] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124121a0 | out: pbBuffer=0x124121a0) returned 1
	[0286.753] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0281 | out: pbBuffer=0x123c0281) returned 1
	[0286.753] WriteFile (in: hFile=0x17c, lpBuffer=0x12539000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12539000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0286.755] SetEvent (hEvent=0x14c) returned 1
	[0286.756] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x162eb, lpOverlapped=0x0) returned 1
	[0286.759] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x162eb, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0x162eb, lpOverlapped=0x0) returned 1
	[0286.763] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0286.763] CloseHandle (hObject=0x17c) returned 1
	[0286.766] CloseHandle (hObject=0x178) returned 1
	[0286.766] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123fc080*, nNumberOfCharsToWrite=0x39, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x123fc080*, lpNumberOfCharsWritten=0x124228a0*=0x39) returned 1
	[0286.777] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.778] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\UmQfaBsq6MRToyGP3nkw.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\umqfabsq6mrtoygp3nkw.wav")) returned 1
	[0286.787] SetEvent (hEvent=0x14c) returned 1
	[0286.788] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0286.788] SetEvent (hEvent=0x14c) returned 1
	[0286.788] SetEvent (hEvent=0x104) returned 1
	[0286.789] SetEvent (hEvent=0x174) returned 1
	[0286.789] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.789] SetEvent (hEvent=0x174) returned 1
	[0286.811] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0286.815] SetEvent (hEvent=0x168) returned 1
	[0286.815] SetEvent (hEvent=0x174) returned 1
	[0286.817] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0286.817] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0286.817] SetEvent (hEvent=0x174) returned 1
	[0286.817] SetEvent (hEvent=0x104) returned 1
	[0286.817] SetEvent (hEvent=0x14c) returned 1
	[0286.817] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.818] SetEvent (hEvent=0x14c) returned 1
	[0286.818] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\UmQfaBsq6MRToyGP3nkw.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\umqfabsq6mrtoygp3nkw.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0286.819] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0286.820] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0286.847] CloseHandle (hObject=0x178) returned 1
	[0286.871] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\UmQfaBsq6MRToyGP3nkw.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\umqfabsq6mrtoygp3nkw.wav")) returned 1
	[0286.883] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\WkJTMmRBO.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\wkjtmmrbo.mp3"), fInfoLevelId=0x0, lpFileInformation=0x124a6008 | out: lpFileInformation=0x124a6008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86695b10, ftCreationTime.dwHighDateTime=0x1d82753, ftLastAccessTime.dwLowDateTime=0xe6b21fb0, ftLastAccessTime.dwHighDateTime=0x1d82844, ftLastWriteTime.dwLowDateTime=0xe6b21fb0, ftLastWriteTime.dwHighDateTime=0x1d82844, nFileSizeHigh=0x0, nFileSizeLow=0xb31b)) returned 1
	[0286.883] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\WkJTMmRBO.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\wkjtmmrbo.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0286.883] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0286.883] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\WkJTMmRBO.mp3.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\wkjtmmrbo.mp3.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0286.884] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0286.884] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc240 | out: pbBuffer=0x123cc240) returned 1
	[0286.884] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c110 | out: pbBuffer=0x1251c110) returned 1
	[0286.884] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc081 | out: pbBuffer=0x123fc081) returned 1
	[0286.884] WriteFile (in: hFile=0x17c, lpBuffer=0x1253b000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x1253b000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0286.886] SetEvent (hEvent=0x104) returned 1
	[0286.886] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0xb31b, lpOverlapped=0x0) returned 1
	[0286.888] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0xb31b, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0xb31b, lpOverlapped=0x0) returned 1
	[0286.891] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0286.891] CloseHandle (hObject=0x17c) returned 1
	[0286.893] CloseHandle (hObject=0x178) returned 1
	[0286.893] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1253c000*, nNumberOfCharsToWrite=0x2e, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x1253c000*, lpNumberOfCharsWritten=0x124228a0*=0x2e) returned 1
	[0286.906] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.908] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\WkJTMmRBO.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\wkjtmmrbo.mp3")) returned 1
	[0286.914] SetEvent (hEvent=0x104) returned 1
	[0286.916] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0286.916] SetEvent (hEvent=0x104) returned 1
	[0286.916] SetEvent (hEvent=0x124) returned 1
	[0286.916] SetEvent (hEvent=0x174) returned 1
	[0286.916] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.917] SetEvent (hEvent=0x174) returned 1
	[0286.939] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0286.940] SetEvent (hEvent=0x168) returned 1
	[0286.940] SetEvent (hEvent=0x174) returned 1
	[0286.943] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0286.944] SetEvent (hEvent=0x174) returned 1
	[0286.944] SetEvent (hEvent=0x124) returned 1
	[0286.944] SetEvent (hEvent=0x104) returned 1
	[0286.944] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.944] SetEvent (hEvent=0x104) returned 1
	[0286.945] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\WkJTMmRBO.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\wkjtmmrbo.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0286.946] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0286.946] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0286.974] CloseHandle (hObject=0x178) returned 1
	[0286.998] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\WkJTMmRBO.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\wkjtmmrbo.mp3")) returned 1
	[0287.013] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\XLnEoaOofsXUY.m4a" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\xlneoaoofsxuy.m4a"), fInfoLevelId=0x0, lpFileInformation=0x124a6058 | out: lpFileInformation=0x124a6058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ee51650, ftCreationTime.dwHighDateTime=0x1d826ad, ftLastAccessTime.dwLowDateTime=0xa5cce870, ftLastAccessTime.dwHighDateTime=0x1d82a1c, ftLastWriteTime.dwLowDateTime=0xa5cce870, ftLastWriteTime.dwHighDateTime=0x1d82a1c, nFileSizeHigh=0x0, nFileSizeLow=0x13651)) returned 1
	[0287.013] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\YFHDjYBjycFIwib.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\yfhdjybjycfiwib.wav"), fInfoLevelId=0x0, lpFileInformation=0x124a60a8 | out: lpFileInformation=0x124a60a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed819740, ftCreationTime.dwHighDateTime=0x1d81ba0, ftLastAccessTime.dwLowDateTime=0xb8627470, ftLastAccessTime.dwHighDateTime=0x1d81edf, ftLastWriteTime.dwLowDateTime=0xb8627470, ftLastWriteTime.dwHighDateTime=0x1d81edf, nFileSizeHigh=0x0, nFileSizeLow=0x2fe6)) returned 1
	[0287.013] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\YFHDjYBjycFIwib.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\yfhdjybjycfiwib.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0287.014] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0287.014] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\YFHDjYBjycFIwib.wav.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\yfhdjybjycfiwib.wav.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0287.014] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0287.014] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc280 | out: pbBuffer=0x123cc280) returned 1
	[0287.014] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124122a0 | out: pbBuffer=0x124122a0) returned 1
	[0287.014] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc081 | out: pbBuffer=0x123fc081) returned 1
	[0287.014] WriteFile (in: hFile=0x17c, lpBuffer=0x12539000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12539000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0287.017] SetEvent (hEvent=0x124) returned 1
	[0287.017] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x2fe6, lpOverlapped=0x0) returned 1
	[0287.018] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x2fe6, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0x2fe6, lpOverlapped=0x0) returned 1
	[0287.020] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0287.020] CloseHandle (hObject=0x17c) returned 1
	[0287.023] CloseHandle (hObject=0x178) returned 1
	[0287.023] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12428000*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x12428000*, lpNumberOfCharsWritten=0x124228a0*=0x34) returned 1
	[0287.041] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.043] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\YFHDjYBjycFIwib.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\yfhdjybjycfiwib.wav")) returned 1
	[0287.053] SetEvent (hEvent=0x124) returned 1
	[0287.057] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0287.059] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.059] SetEvent (hEvent=0x124) returned 1
	[0287.059] SetEvent (hEvent=0x14c) returned 1
	[0287.059] SetEvent (hEvent=0x174) returned 1
	[0287.059] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.060] SetEvent (hEvent=0x168) returned 1
	[0287.060] SetEvent (hEvent=0x174) returned 1
	[0287.082] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0287.082] SetEvent (hEvent=0x168) returned 1
	[0287.082] SetEvent (hEvent=0x174) returned 1
	[0287.084] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0287.085] SetEvent (hEvent=0x174) returned 1
	[0287.085] SetEvent (hEvent=0x14c) returned 1
	[0287.085] SetEvent (hEvent=0x124) returned 1
	[0287.085] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.085] SetEvent (hEvent=0x124) returned 1
	[0287.086] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\YFHDjYBjycFIwib.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\yfhdjybjycfiwib.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0287.087] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0287.087] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0287.109] CloseHandle (hObject=0x178) returned 1
	[0287.135] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\YFHDjYBjycFIwib.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\yfhdjybjycfiwib.wav")) returned 1
	[0287.150] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\ZCNbC-F2.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\zcnbc-f2.mp3"), fInfoLevelId=0x0, lpFileInformation=0x124a6008 | out: lpFileInformation=0x124a6008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4be1a830, ftCreationTime.dwHighDateTime=0x1d82244, ftLastAccessTime.dwLowDateTime=0x6b27f130, ftLastAccessTime.dwHighDateTime=0x1d8246b, ftLastWriteTime.dwLowDateTime=0x6b27f130, ftLastWriteTime.dwHighDateTime=0x1d8246b, nFileSizeHigh=0x0, nFileSizeLow=0x820)) returned 1
	[0287.150] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\ZCNbC-F2.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\zcnbc-f2.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0287.150] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0287.150] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\ZCNbC-F2.mp3.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\zcnbc-f2.mp3.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0287.151] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0287.151] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc240 | out: pbBuffer=0x123cc240) returned 1
	[0287.151] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c110 | out: pbBuffer=0x1251c110) returned 1
	[0287.151] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc081 | out: pbBuffer=0x123fc081) returned 1
	[0287.151] WriteFile (in: hFile=0x17c, lpBuffer=0x12537000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12537000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0287.153] SetEvent (hEvent=0x14c) returned 1
	[0287.153] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x820, lpOverlapped=0x0) returned 1
	[0287.154] WriteFile (in: hFile=0x17c, lpBuffer=0x12537000*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12537000*, lpNumberOfBytesWritten=0x12422bec*=0x820, lpOverlapped=0x0) returned 1
	[0287.156] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0287.156] CloseHandle (hObject=0x17c) returned 1
	[0287.158] CloseHandle (hObject=0x178) returned 1
	[0287.158] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12538000*, nNumberOfCharsToWrite=0x2d, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x12538000*, lpNumberOfCharsWritten=0x124228a0*=0x2d) returned 1
	[0287.169] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.170] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\ZCNbC-F2.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\zcnbc-f2.mp3")) returned 1
	[0287.176] SetEvent (hEvent=0x14c) returned 1
	[0287.177] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0287.177] SetEvent (hEvent=0x14c) returned 1
	[0287.177] SetEvent (hEvent=0x104) returned 1
	[0287.177] SetEvent (hEvent=0x174) returned 1
	[0287.178] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.178] SetEvent (hEvent=0x168) returned 1
	[0287.178] SetEvent (hEvent=0x174) returned 1
	[0287.203] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0287.204] SetEvent (hEvent=0x168) returned 1
	[0287.204] SetEvent (hEvent=0x174) returned 1
	[0287.205] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0287.206] SetEvent (hEvent=0x174) returned 1
	[0287.206] SetEvent (hEvent=0x104) returned 1
	[0287.206] SetEvent (hEvent=0x14c) returned 1
	[0287.206] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.206] SetEvent (hEvent=0x14c) returned 1
	[0287.207] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\ZCNbC-F2.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\zcnbc-f2.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0287.209] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0287.209] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0287.237] CloseHandle (hObject=0x178) returned 1
	[0287.262] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\ZCNbC-F2.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\zcnbc-f2.mp3")) returned 1
	[0287.278] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\bmiYUjEBZe.m4a" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\bmiyujebze.m4a"), fInfoLevelId=0x0, lpFileInformation=0x124a6058 | out: lpFileInformation=0x124a6058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x861847f0, ftCreationTime.dwHighDateTime=0x1d8271e, ftLastAccessTime.dwLowDateTime=0x2d3a8a50, ftLastAccessTime.dwHighDateTime=0x1d827fd, ftLastWriteTime.dwLowDateTime=0x2d3a8a50, ftLastWriteTime.dwHighDateTime=0x1d827fd, nFileSizeHigh=0x0, nFileSizeLow=0x85ea)) returned 1
	[0287.278] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\desktop.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x124a60a8 | out: lpFileInformation=0x124a60a8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43649a85, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43649a85, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x1f8)) returned 1
	[0287.278] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\f_6TYxtCvn.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\f_6tyxtcvn.wav"), fInfoLevelId=0x0, lpFileInformation=0x124a60f8 | out: lpFileInformation=0x124a60f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89504090, ftCreationTime.dwHighDateTime=0x1d82330, ftLastAccessTime.dwLowDateTime=0xa72e0ef0, ftLastAccessTime.dwHighDateTime=0x1d823a1, ftLastWriteTime.dwLowDateTime=0xa72e0ef0, ftLastWriteTime.dwHighDateTime=0x1d823a1, nFileSizeHigh=0x0, nFileSizeLow=0xe62e)) returned 1
	[0287.278] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\f_6TYxtCvn.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\f_6tyxtcvn.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0287.278] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0287.278] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\f_6TYxtCvn.wav.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\f_6tyxtcvn.wav.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0287.279] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0287.279] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc280 | out: pbBuffer=0x123cc280) returned 1
	[0287.279] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x12412360 | out: pbBuffer=0x12412360) returned 1
	[0287.279] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc081 | out: pbBuffer=0x123fc081) returned 1
	[0287.279] WriteFile (in: hFile=0x17c, lpBuffer=0x12537000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12537000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0287.281] SetEvent (hEvent=0x104) returned 1
	[0287.281] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0xe62e, lpOverlapped=0x0) returned 1
	[0287.284] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0xe62e, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0xe62e, lpOverlapped=0x0) returned 1
	[0287.287] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0287.287] CloseHandle (hObject=0x17c) returned 1
	[0287.289] CloseHandle (hObject=0x178) returned 1
	[0287.289] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12538000*, nNumberOfCharsToWrite=0x2f, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x12538000*, lpNumberOfCharsWritten=0x124228a0*=0x2f) returned 1
	[0287.306] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.308] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\f_6TYxtCvn.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\f_6tyxtcvn.wav")) returned 1
	[0287.314] SetEvent (hEvent=0x104) returned 1
	[0287.350] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0287.353] SetEvent (hEvent=0x104) returned 1
	[0287.353] SetEvent (hEvent=0x124) returned 1
	[0287.353] SetEvent (hEvent=0x174) returned 1
	[0287.353] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.354] SetEvent (hEvent=0x168) returned 1
	[0287.354] SetEvent (hEvent=0x174) returned 1
	[0287.375] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0287.375] SetEvent (hEvent=0x168) returned 1
	[0287.375] SetEvent (hEvent=0x174) returned 1
	[0287.377] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0287.378] SetEvent (hEvent=0x174) returned 1
	[0287.378] SetEvent (hEvent=0x124) returned 1
	[0287.378] SetEvent (hEvent=0x104) returned 1
	[0287.378] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.378] SetEvent (hEvent=0x104) returned 1
	[0287.380] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\f_6TYxtCvn.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\f_6tyxtcvn.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0287.383] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0287.384] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0287.404] CloseHandle (hObject=0x178) returned 1
	[0287.429] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\f_6TYxtCvn.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\f_6tyxtcvn.wav")) returned 1
	[0287.445] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\g6S-SZO.m4a" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\g6s-szo.m4a"), fInfoLevelId=0x0, lpFileInformation=0x124a6008 | out: lpFileInformation=0x124a6008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e825ac0, ftCreationTime.dwHighDateTime=0x1d8211f, ftLastAccessTime.dwLowDateTime=0x37d5ce20, ftLastAccessTime.dwHighDateTime=0x1d825a5, ftLastWriteTime.dwLowDateTime=0x37d5ce20, ftLastWriteTime.dwHighDateTime=0x1d825a5, nFileSizeHigh=0x0, nFileSizeLow=0x5d9a)) returned 1
	[0287.445] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\iFgh6E2_tLRdo1ADper.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ifgh6e2_tlrdo1adper.wav"), fInfoLevelId=0x0, lpFileInformation=0x124a6058 | out: lpFileInformation=0x124a6058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91d42790, ftCreationTime.dwHighDateTime=0x1d82150, ftLastAccessTime.dwLowDateTime=0x93119c50, ftLastAccessTime.dwHighDateTime=0x1d82600, ftLastWriteTime.dwLowDateTime=0x93119c50, ftLastWriteTime.dwHighDateTime=0x1d82600, nFileSizeHigh=0x0, nFileSizeLow=0x648a)) returned 1
	[0287.446] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\iFgh6E2_tLRdo1ADper.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ifgh6e2_tlrdo1adper.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0287.446] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0287.446] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\iFgh6E2_tLRdo1ADper.wav.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ifgh6e2_tlrdo1adper.wav.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0287.446] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0287.446] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc280 | out: pbBuffer=0x123cc280) returned 1
	[0287.446] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c210 | out: pbBuffer=0x1251c210) returned 1
	[0287.446] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc101 | out: pbBuffer=0x123fc101) returned 1
	[0287.447] WriteFile (in: hFile=0x17c, lpBuffer=0x12537000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12537000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0287.449] SetEvent (hEvent=0x124) returned 1
	[0287.449] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x648a, lpOverlapped=0x0) returned 1
	[0287.450] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x648a, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0x648a, lpOverlapped=0x0) returned 1
	[0287.452] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0287.453] CloseHandle (hObject=0x17c) returned 1
	[0287.455] CloseHandle (hObject=0x178) returned 1
	[0287.455] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123d00e0*, nNumberOfCharsToWrite=0x38, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x123d00e0*, lpNumberOfCharsWritten=0x124228a0*=0x38) returned 1
	[0287.470] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.471] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\iFgh6E2_tLRdo1ADper.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ifgh6e2_tlrdo1adper.wav")) returned 1
	[0287.497] SetEvent (hEvent=0x124) returned 1
	[0287.498] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0287.498] SetEvent (hEvent=0x124) returned 1
	[0287.498] SetEvent (hEvent=0x14c) returned 1
	[0287.498] SetEvent (hEvent=0x174) returned 1
	[0287.499] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.499] SetEvent (hEvent=0x174) returned 1
	[0287.519] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0287.519] SetEvent (hEvent=0x174) returned 1
	[0287.522] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0287.522] SetEvent (hEvent=0x174) returned 1
	[0287.522] SetEvent (hEvent=0x14c) returned 1
	[0287.522] SetEvent (hEvent=0x124) returned 1
	[0287.523] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.523] SetEvent (hEvent=0x124) returned 1
	[0287.524] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\iFgh6E2_tLRdo1ADper.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ifgh6e2_tlrdo1adper.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0287.525] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0287.525] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0287.547] CloseHandle (hObject=0x178) returned 1
	[0287.571] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\iFgh6E2_tLRdo1ADper.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\ifgh6e2_tlrdo1adper.wav")) returned 1
	[0287.585] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\irILvbX.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\irilvbx.mp3"), fInfoLevelId=0x0, lpFileInformation=0x124a6008 | out: lpFileInformation=0x124a6008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1d18e50, ftCreationTime.dwHighDateTime=0x1d821f9, ftLastAccessTime.dwLowDateTime=0x56b57d70, ftLastAccessTime.dwHighDateTime=0x1d824a8, ftLastWriteTime.dwLowDateTime=0x56b57d70, ftLastWriteTime.dwHighDateTime=0x1d824a8, nFileSizeHigh=0x0, nFileSizeLow=0x7998)) returned 1
	[0287.585] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\irILvbX.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\irilvbx.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0287.586] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0287.586] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\irILvbX.mp3.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\irilvbx.mp3.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0287.586] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0287.586] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc240 | out: pbBuffer=0x123cc240) returned 1
	[0287.586] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124121a0 | out: pbBuffer=0x124121a0) returned 1
	[0287.586] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc081 | out: pbBuffer=0x123fc081) returned 1
	[0287.586] WriteFile (in: hFile=0x17c, lpBuffer=0x12537000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12537000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0287.589] SetEvent (hEvent=0x14c) returned 1
	[0287.589] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x7998, lpOverlapped=0x0) returned 1
	[0287.591] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x7998, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0x7998, lpOverlapped=0x0) returned 1
	[0287.593] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0287.593] CloseHandle (hObject=0x17c) returned 1
	[0287.666] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.668] CloseHandle (hObject=0x178) returned 1
	[0287.668] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12504000*, nNumberOfCharsToWrite=0x2c, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x12504000*, lpNumberOfCharsWritten=0x124228a0*=0x2c) returned 1
	[0287.678] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\irILvbX.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\irilvbx.mp3")) returned 1
	[0287.685] SetEvent (hEvent=0x14c) returned 1
	[0287.686] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0287.687] SetEvent (hEvent=0x14c) returned 1
	[0287.689] SetEvent (hEvent=0x104) returned 1
	[0287.689] SetEvent (hEvent=0x174) returned 1
	[0287.689] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.690] SetEvent (hEvent=0x168) returned 1
	[0287.690] SetEvent (hEvent=0x174) returned 1
	[0287.712] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0287.712] SetEvent (hEvent=0x174) returned 1
	[0287.714] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0287.714] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0287.715] SetEvent (hEvent=0x174) returned 1
	[0287.715] SetEvent (hEvent=0x104) returned 1
	[0287.715] SetEvent (hEvent=0x14c) returned 1
	[0287.715] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.715] SetEvent (hEvent=0x168) returned 1
	[0287.715] SetEvent (hEvent=0x14c) returned 1
	[0287.716] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\irILvbX.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\irilvbx.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0287.718] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0287.718] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0287.731] CloseHandle (hObject=0x178) returned 1
	[0287.756] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\irILvbX.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\irilvbx.mp3")) returned 1
	[0287.776] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\j2iUu ERG0bmd.m4a" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\j2iuu erg0bmd.m4a"), fInfoLevelId=0x0, lpFileInformation=0x124a6058 | out: lpFileInformation=0x124a6058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63794e80, ftCreationTime.dwHighDateTime=0x1d8204b, ftLastAccessTime.dwLowDateTime=0x114c9c30, ftLastAccessTime.dwHighDateTime=0x1d828d8, ftLastWriteTime.dwLowDateTime=0x114c9c30, ftLastWriteTime.dwHighDateTime=0x1d828d8, nFileSizeHigh=0x0, nFileSizeLow=0x91c6)) returned 1
	[0287.777] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\n4Dd3.m4a" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\n4dd3.m4a"), fInfoLevelId=0x0, lpFileInformation=0x124a60a8 | out: lpFileInformation=0x124a60a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb309450, ftCreationTime.dwHighDateTime=0x1d81cb0, ftLastAccessTime.dwLowDateTime=0x9c6347b0, ftLastAccessTime.dwHighDateTime=0x1d8269e, ftLastWriteTime.dwLowDateTime=0x9c6347b0, ftLastWriteTime.dwHighDateTime=0x1d8269e, nFileSizeHigh=0x0, nFileSizeLow=0x13aa8)) returned 1
	[0287.777] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\oM719AbRwy.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\om719abrwy.wav"), fInfoLevelId=0x0, lpFileInformation=0x124a60f8 | out: lpFileInformation=0x124a60f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x443b5700, ftCreationTime.dwHighDateTime=0x1d81bc0, ftLastAccessTime.dwLowDateTime=0x6acec670, ftLastAccessTime.dwHighDateTime=0x1d825a4, ftLastWriteTime.dwLowDateTime=0x6acec670, ftLastWriteTime.dwHighDateTime=0x1d825a4, nFileSizeHigh=0x0, nFileSizeLow=0x6f4d)) returned 1
	[0287.777] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\oM719AbRwy.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\om719abrwy.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0287.777] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0287.777] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\oM719AbRwy.wav.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\om719abrwy.wav.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0287.780] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0287.780] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc2c0 | out: pbBuffer=0x123cc2c0) returned 1
	[0287.780] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124123a0 | out: pbBuffer=0x124123a0) returned 1
	[0287.780] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc081 | out: pbBuffer=0x123fc081) returned 1
	[0287.780] WriteFile (in: hFile=0x17c, lpBuffer=0x1253b000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x1253b000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0287.782] SetEvent (hEvent=0x104) returned 1
	[0287.782] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x6f4d, lpOverlapped=0x0) returned 1
	[0287.784] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x6f4d, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0x6f4d, lpOverlapped=0x0) returned 1
	[0287.785] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0287.785] CloseHandle (hObject=0x17c) returned 1
	[0287.787] CloseHandle (hObject=0x178) returned 1
	[0287.788] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1253c000*, nNumberOfCharsToWrite=0x2f, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x1253c000*, lpNumberOfCharsWritten=0x124228a0*=0x2f) returned 1
	[0287.805] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.807] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\oM719AbRwy.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\om719abrwy.wav")) returned 1
	[0287.814] SetEvent (hEvent=0x104) returned 1
	[0287.815] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0287.816] SetEvent (hEvent=0x104) returned 1
	[0287.816] SetEvent (hEvent=0x124) returned 1
	[0287.816] SetEvent (hEvent=0x174) returned 1
	[0287.816] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.816] SetEvent (hEvent=0x174) returned 1
	[0287.843] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0287.847] SetEvent (hEvent=0x168) returned 1
	[0287.847] SetEvent (hEvent=0x174) returned 1
	[0287.850] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0287.851] SetEvent (hEvent=0x174) returned 1
	[0287.851] SetEvent (hEvent=0x124) returned 1
	[0287.851] SetEvent (hEvent=0x104) returned 1
	[0287.851] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.870] SetEvent (hEvent=0x168) returned 1
	[0287.870] SetEvent (hEvent=0x104) returned 1
	[0287.871] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\oM719AbRwy.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\om719abrwy.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0287.872] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0287.872] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0287.894] CloseHandle (hObject=0x178) returned 1
	[0287.963] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\oM719AbRwy.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\om719abrwy.wav")) returned 1
	[0287.976] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\u-RQg0EKWE 9qH.m4a" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\u-rqg0ekwe 9qh.m4a"), fInfoLevelId=0x0, lpFileInformation=0x124a6008 | out: lpFileInformation=0x124a6008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x348c2e60, ftCreationTime.dwHighDateTime=0x1d82034, ftLastAccessTime.dwLowDateTime=0xa6cd16a0, ftLastAccessTime.dwHighDateTime=0x1d824c7, ftLastWriteTime.dwLowDateTime=0xa6cd16a0, ftLastWriteTime.dwHighDateTime=0x1d824c7, nFileSizeHigh=0x0, nFileSizeLow=0xd26e)) returned 1
	[0287.977] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\u9Q3Ofxba-.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\u9q3ofxba-.wav"), fInfoLevelId=0x0, lpFileInformation=0x124a6058 | out: lpFileInformation=0x124a6058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe81e58d0, ftCreationTime.dwHighDateTime=0x1d826a2, ftLastAccessTime.dwLowDateTime=0x387198a0, ftLastAccessTime.dwHighDateTime=0x1d82708, ftLastWriteTime.dwLowDateTime=0x387198a0, ftLastWriteTime.dwHighDateTime=0x1d82708, nFileSizeHigh=0x0, nFileSizeLow=0xf6d0)) returned 1
	[0287.977] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\u9Q3Ofxba-.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\u9q3ofxba-.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0287.977] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0287.977] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\u9Q3Ofxba-.wav.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\u9q3ofxba-.wav.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0287.977] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0287.978] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc280 | out: pbBuffer=0x123cc280) returned 1
	[0287.978] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c210 | out: pbBuffer=0x1251c210) returned 1
	[0287.978] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc081 | out: pbBuffer=0x123fc081) returned 1
	[0287.978] WriteFile (in: hFile=0x17c, lpBuffer=0x12539000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12539000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0287.980] SetEvent (hEvent=0x124) returned 1
	[0287.980] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0xf6d0, lpOverlapped=0x0) returned 1
	[0287.983] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0xf6d0, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0xf6d0, lpOverlapped=0x0) returned 1
	[0288.016] SetEvent (hEvent=0x168) returned 1
	[0288.017] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0288.017] CloseHandle (hObject=0x17c) returned 1
	[0288.017] CloseHandle (hObject=0x178) returned 1
	[0288.017] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12504000*, nNumberOfCharsToWrite=0x2f, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x12504000*, lpNumberOfCharsWritten=0x124228a0*=0x2f) returned 1
	[0288.028] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\u9Q3Ofxba-.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\u9q3ofxba-.wav")) returned 1
	[0288.036] SetEvent (hEvent=0x14c) returned 1
	[0288.038] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0288.038] SetEvent (hEvent=0x14c) returned 1
	[0288.038] SetEvent (hEvent=0x124) returned 1
	[0288.038] SetEvent (hEvent=0x174) returned 1
	[0288.038] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.039] SetEvent (hEvent=0x174) returned 1
	[0288.067] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0288.068] SetEvent (hEvent=0x168) returned 1
	[0288.068] SetEvent (hEvent=0x174) returned 1
	[0288.070] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0288.071] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.071] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0288.072] SetEvent (hEvent=0x174) returned 1
	[0288.072] SetEvent (hEvent=0x124) returned 1
	[0288.072] SetEvent (hEvent=0x14c) returned 1
	[0288.072] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.072] SetEvent (hEvent=0x14c) returned 1
	[0288.073] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\u9Q3Ofxba-.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\u9q3ofxba-.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0288.074] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0288.074] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0288.094] CloseHandle (hObject=0x178) returned 1
	[0288.095] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\u9Q3Ofxba-.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\u9q3ofxba-.wav")) returned 1
	[0288.099] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\uMpJIKVYU.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\umpjikvyu.mp3"), fInfoLevelId=0x0, lpFileInformation=0x124a6008 | out: lpFileInformation=0x124a6008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba2040, ftCreationTime.dwHighDateTime=0x1d8257c, ftLastAccessTime.dwLowDateTime=0x4067d9c0, ftLastAccessTime.dwHighDateTime=0x1d82695, ftLastWriteTime.dwLowDateTime=0x4067d9c0, ftLastWriteTime.dwHighDateTime=0x1d82695, nFileSizeHigh=0x0, nFileSizeLow=0xdaf2)) returned 1
	[0288.099] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\uMpJIKVYU.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\umpjikvyu.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0288.099] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0288.099] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\uMpJIKVYU.mp3.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\umpjikvyu.mp3.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0288.100] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0288.100] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc240 | out: pbBuffer=0x123cc240) returned 1
	[0288.100] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c110 | out: pbBuffer=0x1251c110) returned 1
	[0288.100] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc081 | out: pbBuffer=0x123fc081) returned 1
	[0288.100] WriteFile (in: hFile=0x17c, lpBuffer=0x12539000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12539000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0288.102] SetEvent (hEvent=0x124) returned 1
	[0288.102] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0xdaf2, lpOverlapped=0x0) returned 1
	[0288.105] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0xdaf2, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0xdaf2, lpOverlapped=0x0) returned 1
	[0288.107] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0288.107] CloseHandle (hObject=0x17c) returned 1
	[0288.108] CloseHandle (hObject=0x178) returned 1
	[0288.108] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1253a000*, nNumberOfCharsToWrite=0x2e, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x1253a000*, lpNumberOfCharsWritten=0x124228a0*=0x2e) returned 1
	[0288.121] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.125] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\uMpJIKVYU.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\umpjikvyu.mp3")) returned 1
	[0288.134] SetEvent (hEvent=0x124) returned 1
	[0288.139] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0288.140] SetEvent (hEvent=0x124) returned 1
	[0288.140] SetEvent (hEvent=0x104) returned 1
	[0288.140] SetEvent (hEvent=0x174) returned 1
	[0288.140] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.141] SetEvent (hEvent=0x168) returned 1
	[0288.141] SetEvent (hEvent=0x174) returned 1
	[0288.172] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0288.173] SetEvent (hEvent=0x174) returned 1
	[0288.177] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0288.178] SetEvent (hEvent=0x174) returned 1
	[0288.178] SetEvent (hEvent=0x104) returned 1
	[0288.178] SetEvent (hEvent=0x124) returned 1
	[0288.178] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.179] SetEvent (hEvent=0x168) returned 1
	[0288.179] SetEvent (hEvent=0x124) returned 1
	[0288.180] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\uMpJIKVYU.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\umpjikvyu.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0288.181] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0288.182] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0288.206] CloseHandle (hObject=0x178) returned 1
	[0288.206] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\uMpJIKVYU.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\umpjikvyu.mp3")) returned 1
	[0288.232] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\v_QBetNpRyLTlj.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\v_qbetnpryltlj.wav"), fInfoLevelId=0x0, lpFileInformation=0x124a6058 | out: lpFileInformation=0x124a6058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad9710, ftCreationTime.dwHighDateTime=0x1d81cfb, ftLastAccessTime.dwLowDateTime=0xf70ca100, ftLastAccessTime.dwHighDateTime=0x1d82524, ftLastWriteTime.dwLowDateTime=0xf70ca100, ftLastWriteTime.dwHighDateTime=0x1d82524, nFileSizeHigh=0x0, nFileSizeLow=0x59d5)) returned 1
	[0288.233] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\v_QBetNpRyLTlj.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\v_qbetnpryltlj.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0288.234] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0288.234] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\v_QBetNpRyLTlj.wav.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\v_qbetnpryltlj.wav.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0288.235] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0288.235] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc240 | out: pbBuffer=0x123cc240) returned 1
	[0288.235] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124121a0 | out: pbBuffer=0x124121a0) returned 1
	[0288.235] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc081 | out: pbBuffer=0x123fc081) returned 1
	[0288.235] WriteFile (in: hFile=0x17c, lpBuffer=0x12539000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12539000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0288.239] SetEvent (hEvent=0x104) returned 1
	[0288.239] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x59d5, lpOverlapped=0x0) returned 1
	[0288.240] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x59d5, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0x59d5, lpOverlapped=0x0) returned 1
	[0288.244] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0288.244] CloseHandle (hObject=0x17c) returned 1
	[0288.244] CloseHandle (hObject=0x178) returned 1
	[0288.245] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123d01c0*, nNumberOfCharsToWrite=0x33, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x123d01c0*, lpNumberOfCharsWritten=0x124228a0*=0x33) returned 1
	[0288.260] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.261] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\v_QBetNpRyLTlj.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\v_qbetnpryltlj.wav")) returned 1
	[0288.271] SetEvent (hEvent=0x104) returned 1
	[0288.274] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0288.274] SetEvent (hEvent=0x104) returned 1
	[0288.274] SetEvent (hEvent=0x14c) returned 1
	[0288.274] SetEvent (hEvent=0x174) returned 1
	[0288.274] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.275] SetEvent (hEvent=0x174) returned 1
	[0288.304] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0288.305] SetEvent (hEvent=0x168) returned 1
	[0288.306] SetEvent (hEvent=0x174) returned 1
	[0288.307] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0288.308] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0288.308] SetEvent (hEvent=0x174) returned 1
	[0288.308] SetEvent (hEvent=0x14c) returned 1
	[0288.308] SetEvent (hEvent=0x104) returned 1
	[0288.308] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.308] SetEvent (hEvent=0x104) returned 1
	[0288.309] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\v_QBetNpRyLTlj.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\v_qbetnpryltlj.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0288.310] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0288.311] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0288.324] CloseHandle (hObject=0x178) returned 1
	[0288.324] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\v_QBetNpRyLTlj.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\v_qbetnpryltlj.wav")) returned 1
	[0288.332] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\x0nQ2_2Q.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\x0nq2_2q.mp3"), fInfoLevelId=0x0, lpFileInformation=0x124a6008 | out: lpFileInformation=0x124a6008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47beb8d0, ftCreationTime.dwHighDateTime=0x1d824bd, ftLastAccessTime.dwLowDateTime=0x369df630, ftLastAccessTime.dwHighDateTime=0x1d8276d, ftLastWriteTime.dwLowDateTime=0x369df630, ftLastWriteTime.dwHighDateTime=0x1d8276d, nFileSizeHigh=0x0, nFileSizeLow=0xd0f5)) returned 1
	[0288.332] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\x0nQ2_2Q.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\x0nq2_2q.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0288.333] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0288.333] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\x0nQ2_2Q.mp3.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\x0nq2_2q.mp3.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0288.333] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0288.333] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc240 | out: pbBuffer=0x123cc240) returned 1
	[0288.333] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124121a0 | out: pbBuffer=0x124121a0) returned 1
	[0288.333] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc081 | out: pbBuffer=0x123fc081) returned 1
	[0288.334] WriteFile (in: hFile=0x17c, lpBuffer=0x12539000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12539000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0288.336] SetEvent (hEvent=0x14c) returned 1
	[0288.336] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0xd0f5, lpOverlapped=0x0) returned 1
	[0288.338] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0xd0f5, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0xd0f5, lpOverlapped=0x0) returned 1
	[0288.356] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0288.356] CloseHandle (hObject=0x17c) returned 1
	[0288.356] CloseHandle (hObject=0x178) returned 1
	[0288.356] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1253a000*, nNumberOfCharsToWrite=0x2d, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x1253a000*, lpNumberOfCharsWritten=0x124228a0*=0x2d) returned 1
	[0288.367] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.401] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\x0nQ2_2Q.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\x0nq2_2q.mp3")) returned 1
	[0288.435] SetEvent (hEvent=0x14c) returned 1
	[0288.436] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0288.452] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.452] SetEvent (hEvent=0x14c) returned 1
	[0288.452] SetEvent (hEvent=0x124) returned 1
	[0288.453] SetEvent (hEvent=0x174) returned 1
	[0288.453] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.458] SetEvent (hEvent=0x168) returned 1
	[0288.458] SetEvent (hEvent=0x174) returned 1
	[0288.478] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0288.480] SetEvent (hEvent=0x174) returned 1
	[0288.482] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0288.485] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0288.486] SetEvent (hEvent=0x174) returned 1
	[0288.486] SetEvent (hEvent=0x124) returned 1
	[0288.486] SetEvent (hEvent=0x14c) returned 1
	[0288.486] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.489] SetEvent (hEvent=0x168) returned 1
	[0288.489] SetEvent (hEvent=0x14c) returned 1
	[0288.491] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\x0nQ2_2Q.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\x0nq2_2q.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0288.493] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0288.493] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0288.509] CloseHandle (hObject=0x178) returned 1
	[0288.510] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\x0nQ2_2Q.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\x0nq2_2q.mp3")) returned 1
	[0288.515] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\xKR58gZ.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\xkr58gz.mp3"), fInfoLevelId=0x0, lpFileInformation=0x124a6058 | out: lpFileInformation=0x124a6058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5877780, ftCreationTime.dwHighDateTime=0x1d822a2, ftLastAccessTime.dwLowDateTime=0xafa50020, ftLastAccessTime.dwHighDateTime=0x1d822de, ftLastWriteTime.dwLowDateTime=0xafa50020, ftLastWriteTime.dwHighDateTime=0x1d822de, nFileSizeHigh=0x0, nFileSizeLow=0x9d5a)) returned 1
	[0288.515] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\xKR58gZ.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\xkr58gz.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0288.515] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0288.515] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\xKR58gZ.mp3.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\xkr58gz.mp3.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0288.516] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0288.516] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc240 | out: pbBuffer=0x123cc240) returned 1
	[0288.516] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c110 | out: pbBuffer=0x1251c110) returned 1
	[0288.516] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc081 | out: pbBuffer=0x123fc081) returned 1
	[0288.516] WriteFile (in: hFile=0x17c, lpBuffer=0x12539000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12539000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0288.519] SetEvent (hEvent=0x124) returned 1
	[0288.519] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x9d5a, lpOverlapped=0x0) returned 1
	[0288.521] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x9d5a, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0x9d5a, lpOverlapped=0x0) returned 1
	[0288.584] SetEvent (hEvent=0x168) returned 1
	[0288.584] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0288.584] CloseHandle (hObject=0x17c) returned 1
	[0288.585] CloseHandle (hObject=0x178) returned 1
	[0288.585] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12504000*, nNumberOfCharsToWrite=0x2c, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x12504000*, lpNumberOfCharsWritten=0x124228a0*=0x2c) returned 1
	[0288.595] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\xKR58gZ.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\xkr58gz.mp3")) returned 1
	[0288.601] SetEvent (hEvent=0x104) returned 1
	[0288.602] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0288.605] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.605] SetEvent (hEvent=0x104) returned 1
	[0288.605] SetEvent (hEvent=0x124) returned 1
	[0288.606] SetEvent (hEvent=0x174) returned 1
	[0288.606] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.606] SetEvent (hEvent=0x174) returned 1
	[0288.626] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0288.628] SetEvent (hEvent=0x168) returned 1
	[0288.628] SetEvent (hEvent=0x174) returned 1
	[0288.630] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0288.632] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.632] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0288.632] SetEvent (hEvent=0x174) returned 1
	[0288.632] SetEvent (hEvent=0x124) returned 1
	[0288.632] SetEvent (hEvent=0x104) returned 1
	[0288.632] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.633] SetEvent (hEvent=0x104) returned 1
	[0288.633] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\xKR58gZ.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\xkr58gz.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0288.634] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0288.634] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0288.654] CloseHandle (hObject=0x178) returned 1
	[0288.655] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\xKR58gZ.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\xkr58gz.mp3")) returned 1
	[0288.694] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\xMl1HGmN_CG.m4a" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\xml1hgmn_cg.m4a"), fInfoLevelId=0x0, lpFileInformation=0x124a6008 | out: lpFileInformation=0x124a6008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x614535c0, ftCreationTime.dwHighDateTime=0x1d82875, ftLastAccessTime.dwLowDateTime=0x63ea8930, ftLastAccessTime.dwHighDateTime=0x1d82896, ftLastWriteTime.dwLowDateTime=0x63ea8930, ftLastWriteTime.dwHighDateTime=0x1d82896, nFileSizeHigh=0x0, nFileSizeLow=0x4b51)) returned 1
	[0288.694] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\xr3cPyGn7vjWvC52bVw.m4a" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\xr3cpygn7vjwvc52bvw.m4a"), fInfoLevelId=0x0, lpFileInformation=0x124a60a8 | out: lpFileInformation=0x124a60a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbeb564b0, ftCreationTime.dwHighDateTime=0x1d829c3, ftLastAccessTime.dwLowDateTime=0x3dc36570, ftLastAccessTime.dwHighDateTime=0x1d829fd, ftLastWriteTime.dwLowDateTime=0x3dc36570, ftLastWriteTime.dwHighDateTime=0x1d829fd, nFileSizeHigh=0x0, nFileSizeLow=0xc7f3)) returned 1
	[0288.694] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\zGcdowqxu7RCr.m4a" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\zgcdowqxu7rcr.m4a"), fInfoLevelId=0x0, lpFileInformation=0x124a60f8 | out: lpFileInformation=0x124a60f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a954f20, ftCreationTime.dwHighDateTime=0x1d824ae, ftLastAccessTime.dwLowDateTime=0xe68ddd70, ftLastAccessTime.dwHighDateTime=0x1d824e4, ftLastWriteTime.dwLowDateTime=0xe68ddd70, ftLastWriteTime.dwHighDateTime=0x1d824e4, nFileSizeHigh=0x0, nFileSizeLow=0x1635d)) returned 1
	[0288.694] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\My Documents" (normalized: "c:\\users\\rdhj0cnfevzx\\my documents"), fInfoLevelId=0x0, lpFileInformation=0x124a6148 | out: lpFileInformation=0x124a6148*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d374e80, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d374e80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d374e80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0288.694] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\NTUSER.DAT" (normalized: "c:\\users\\rdhj0cnfevzx\\ntuser.dat"), fInfoLevelId=0x0, lpFileInformation=0x124a6198 | out: lpFileInformation=0x124a6198*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x3ce3dbd0, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6b125138, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0x6b125138, ftLastWriteTime.dwHighDateTime=0x1d82a22, nFileSizeHigh=0x0, nFileSizeLow=0x180000)) returned 1
	[0288.695] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\NTUSER.DAT{62e13464-7ee5-11e5-80c4-a4badb40df56}.TM.blf" (normalized: "c:\\users\\rdhj0cnfevzx\\ntuser.dat{62e13464-7ee5-11e5-80c4-a4badb40df56}.tm.blf"), fInfoLevelId=0x0, lpFileInformation=0x124a61e8 | out: lpFileInformation=0x124a61e8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3d2dc444, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d2dc444, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x63434853, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1
	[0288.695] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\NTUSER.DAT{62e13464-7ee5-11e5-80c4-a4badb40df56}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\rdhj0cnfevzx\\ntuser.dat{62e13464-7ee5-11e5-80c4-a4badb40df56}.tmcontainer00000000000000000001.regtrans-ms"), fInfoLevelId=0x0, lpFileInformation=0x124a6238 | out: lpFileInformation=0x124a6238*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3d3026e1, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d3026e1, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6340e659, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x80000)) returned 1
	[0288.695] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\NTUSER.DAT{62e13464-7ee5-11e5-80c4-a4badb40df56}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\rdhj0cnfevzx\\ntuser.dat{62e13464-7ee5-11e5-80c4-a4badb40df56}.tmcontainer00000000000000000002.regtrans-ms"), fInfoLevelId=0x0, lpFileInformation=0x124a6288 | out: lpFileInformation=0x124a6288*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3d3026e1, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d3026e1, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6340e659, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x80000)) returned 1
	[0288.695] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\NetHood" (normalized: "c:\\users\\rdhj0cnfevzx\\nethood"), fInfoLevelId=0x0, lpFileInformation=0x124a62d8 | out: lpFileInformation=0x124a62d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0288.695] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\OneDrive" (normalized: "c:\\users\\rdhj0cnfevzx\\onedrive"), fInfoLevelId=0x0, lpFileInformation=0x124a6328 | out: lpFileInformation=0x124a6328*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x84ac775d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x84aeda3c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84aeda3c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0288.695] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\OneDrive" (normalized: "c:\\users\\rdhj0cnfevzx\\onedrive"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0288.696] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\OneDrive\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x84ac775d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x84aeda3c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84aeda3c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fb68
	[0288.696] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x84ac775d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x84aeda3c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84aeda3c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0288.696] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x84aeda3c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x84aeda3c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84aeda3c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x67, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0288.696] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0288.696] FindClose (in: hFindFile=0x79fb68 | out: hFindFile=0x79fb68) returned 1
	[0288.696] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\OneDrive\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\onedrive\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0288.697] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d94 | out: lpMode=0x12422d94) returned 0
	[0288.697] WriteFile (in: hFile=0x178, lpBuffer=0x12694000*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d84, lpOverlapped=0x0 | out: lpBuffer=0x12694000*, lpNumberOfBytesWritten=0x12422d84*=0xc85, lpOverlapped=0x0) returned 1
	[0288.698] CloseHandle (hObject=0x178) returned 1
	[0288.698] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123c0880*, nNumberOfCharsToWrite=0x39, lpNumberOfCharsWritten=0x12422914, lpReserved=0x0 | out: lpBuffer=0x123c0880*, lpNumberOfCharsWritten=0x12422914*=0x39) returned 1
	[0288.725] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\OneDrive\\desktop.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\onedrive\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x124a63c8 | out: lpFileInformation=0x124a63c8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x84aeda3c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x84aeda3c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84aeda3c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x67)) returned 1
	[0288.726] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures"), fInfoLevelId=0x0, lpFileInformation=0x124a6418 | out: lpFileInformation=0x124a6418*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf4af2a94, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf4af2a94, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0288.726] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0288.726] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\*", lpFindFileData=0x1242397c | out: lpFindFileData=0x1242397c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf4af2a94, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf4af2a94, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fb68
	[0288.726] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf4af2a94, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xf4af2a94, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0288.726] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x597f83c0, ftCreationTime.dwHighDateTime=0x1d82093, ftLastAccessTime.dwLowDateTime=0x271f9c60, ftLastAccessTime.dwHighDateTime=0x1d8222f, ftLastWriteTime.dwLowDateTime=0x271f9c60, ftLastWriteTime.dwHighDateTime=0x1d8222f, nFileSizeHigh=0x0, nFileSizeLow=0x3b8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="c64LwMsBO30WRGVpkLy.png", cAlternateFileName="C64LWM~1.PNG")) returned 1
	[0288.726] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b0e752d, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1
	[0288.726] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0288.726] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11c44860, ftCreationTime.dwHighDateTime=0x1d82613, ftLastAccessTime.dwLowDateTime=0xff9c2a60, ftLastAccessTime.dwHighDateTime=0x1d829df, ftLastWriteTime.dwLowDateTime=0xff9c2a60, ftLastWriteTime.dwHighDateTime=0x1d829df, nFileSizeHigh=0x0, nFileSizeLow=0x10b35, dwReserved0=0x0, dwReserved1=0x0, cFileName="ebWY.png", cAlternateFileName="")) returned 1
	[0288.726] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6210bf00, ftCreationTime.dwHighDateTime=0x1d81df4, ftLastAccessTime.dwLowDateTime=0xf410d10, ftLastAccessTime.dwHighDateTime=0x1d822eb, ftLastWriteTime.dwLowDateTime=0xf410d10, ftLastWriteTime.dwHighDateTime=0x1d822eb, nFileSizeHigh=0x0, nFileSizeLow=0x14509, dwReserved0=0x0, dwReserved1=0x0, cFileName="LzKUQ FxJzSJ.gif", cAlternateFileName="LZKUQF~1.GIF")) returned 1
	[0288.726] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d722d70, ftCreationTime.dwHighDateTime=0x1d822ab, ftLastAccessTime.dwLowDateTime=0x195c7c40, ftLastAccessTime.dwHighDateTime=0x1d82335, ftLastWriteTime.dwLowDateTime=0x195c7c40, ftLastWriteTime.dwHighDateTime=0x1d82335, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="obQ_cDa0HsewFXG1Fqa", cAlternateFileName="OBQ_CD~1")) returned 1
	[0288.726] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1a6533, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1
	[0288.727] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x432a3e50, ftCreationTime.dwHighDateTime=0x1d82546, ftLastAccessTime.dwLowDateTime=0xcd0fc1e0, ftLastAccessTime.dwHighDateTime=0x1d82964, ftLastWriteTime.dwLowDateTime=0xcd0fc1e0, ftLastWriteTime.dwHighDateTime=0x1d82964, nFileSizeHigh=0x0, nFileSizeLow=0x12325, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ty yBqBqotltJ9rLD.gif", cAlternateFileName="TYYBQB~1.GIF")) returned 1
	[0288.727] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x1242399c | out: lpFindFileData=0x1242399c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0288.727] FindClose (in: hFindFile=0x79fb68 | out: hFindFile=0x79fb68) returned 1
	[0288.727] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0288.727] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d94 | out: lpMode=0x12422d94) returned 0
	[0288.727] WriteFile (in: hFile=0x178, lpBuffer=0x12694d80*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d84, lpOverlapped=0x0 | out: lpBuffer=0x12694d80*, lpNumberOfBytesWritten=0x12422d84*=0xc85, lpOverlapped=0x0) returned 1
	[0288.728] CloseHandle (hObject=0x178) returned 1
	[0288.729] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123c0900*, nNumberOfCharsToWrite=0x39, lpNumberOfCharsWritten=0x12422914, lpReserved=0x0 | out: lpBuffer=0x123c0900*, lpNumberOfCharsWritten=0x12422914*=0x39) returned 1
	[0288.743] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\camera roll"), fInfoLevelId=0x0, lpFileInformation=0x124a6738 | out: lpFileInformation=0x124a6738*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b0e752d, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0288.744] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\camera roll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0288.744] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b0e752d, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fc68
	[0288.744] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b0e752d, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0288.744] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x2b10dbc5, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0288.744] FindNextFileW (in: hFindFile=0x79fc68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0288.744] FindClose (in: hFindFile=0x79fc68 | out: hFindFile=0x79fc68) returned 1
	[0288.744] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\camera roll\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0288.745] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d30 | out: lpMode=0x12422d30) returned 0
	[0288.745] WriteFile (in: hFile=0x178, lpBuffer=0x12696880*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d20, lpOverlapped=0x0 | out: lpBuffer=0x12696880*, lpNumberOfBytesWritten=0x12422d20*=0xc85, lpOverlapped=0x0) returned 1
	[0288.746] CloseHandle (hObject=0x178) returned 1
	[0288.746] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12642240*, nNumberOfCharsToWrite=0x45, lpNumberOfCharsWritten=0x124228b0, lpReserved=0x0 | out: lpBuffer=0x12642240*, lpNumberOfCharsWritten=0x124228b0*=0x45) returned 1
	[0288.758] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll\\desktop.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\camera roll\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x124a67d8 | out: lpFileInformation=0x124a67d8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x2b10dbc5, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0xbe)) returned 1
	[0288.759] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\LzKUQ FxJzSJ.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\lzkuq fxjzsj.gif"), fInfoLevelId=0x0, lpFileInformation=0x124a6828 | out: lpFileInformation=0x124a6828*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6210bf00, ftCreationTime.dwHighDateTime=0x1d81df4, ftLastAccessTime.dwLowDateTime=0xf410d10, ftLastAccessTime.dwHighDateTime=0x1d822eb, ftLastWriteTime.dwLowDateTime=0xf410d10, ftLastWriteTime.dwHighDateTime=0x1d822eb, nFileSizeHigh=0x0, nFileSizeLow=0x14509)) returned 1
	[0288.759] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\LzKUQ FxJzSJ.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\lzkuq fxjzsj.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0288.759] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0288.759] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\LzKUQ FxJzSJ.gif.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\lzkuq fxjzsj.gif.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0288.760] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0288.760] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cdb20 | out: pbBuffer=0x123cdb20) returned 1
	[0288.760] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251d050 | out: pbBuffer=0x1251d050) returned 1
	[0288.760] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0981 | out: pbBuffer=0x123c0981) returned 1
	[0288.760] WriteFile (in: hFile=0x17c, lpBuffer=0x125d3000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x125d3000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0288.762] SetEvent (hEvent=0x124) returned 1
	[0288.762] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x14509, lpOverlapped=0x0) returned 1
	[0288.768] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x14509, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0x14509, lpOverlapped=0x0) returned 1
	[0288.866] SetEvent (hEvent=0x168) returned 1
	[0288.867] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0288.867] CloseHandle (hObject=0x17c) returned 1
	[0288.867] CloseHandle (hObject=0x178) returned 1
	[0288.867] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123d00e0*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x123d00e0*, lpNumberOfCharsWritten=0x124228a0*=0x34) returned 1
	[0288.910] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\LzKUQ FxJzSJ.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\lzkuq fxjzsj.gif")) returned 1
	[0288.947] SetEvent (hEvent=0x14c) returned 1
	[0288.949] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0288.951] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.951] SetEvent (hEvent=0x14c) returned 1
	[0288.951] SetEvent (hEvent=0x124) returned 1
	[0288.951] SetEvent (hEvent=0x174) returned 1
	[0288.951] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.953] SetEvent (hEvent=0x168) returned 1
	[0288.954] SetEvent (hEvent=0x174) returned 1
	[0288.988] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0288.991] SetEvent (hEvent=0x174) returned 1
	[0288.994] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0288.997] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.997] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0289.000] SetEvent (hEvent=0x174) returned 1
	[0289.000] SetEvent (hEvent=0x124) returned 1
	[0289.000] SetEvent (hEvent=0x14c) returned 1
	[0289.000] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.002] SetEvent (hEvent=0x168) returned 1
	[0289.003] SetEvent (hEvent=0x14c) returned 1
	[0289.003] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\LzKUQ FxJzSJ.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\lzkuq fxjzsj.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0289.008] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0289.008] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0289.035] CloseHandle (hObject=0x178) returned 1
	[0289.036] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\LzKUQ FxJzSJ.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\lzkuq fxjzsj.gif")) returned 1
	[0289.042] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\saved pictures"), fInfoLevelId=0x0, lpFileInformation=0x124a6008 | out: lpFileInformation=0x124a6008*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1a6533, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0289.042] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\saved pictures"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0289.042] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1a6533, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fee8
	[0289.042] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1a6533, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0289.043] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1a6533, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0289.043] FindNextFileW (in: hFindFile=0x79fee8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0289.043] FindClose (in: hFindFile=0x79fee8 | out: hFindFile=0x79fee8) returned 1
	[0289.043] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\saved pictures\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0289.043] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d30 | out: lpMode=0x12422d30) returned 0
	[0289.043] WriteFile (in: hFile=0x178, lpBuffer=0x12694000*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d20, lpOverlapped=0x0 | out: lpBuffer=0x12694000*, lpNumberOfBytesWritten=0x12422d20*=0xc85, lpOverlapped=0x0) returned 1
	[0289.045] CloseHandle (hObject=0x178) returned 1
	[0289.045] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12642000*, nNumberOfCharsToWrite=0x48, lpNumberOfCharsWritten=0x124228b0, lpReserved=0x0 | out: lpBuffer=0x12642000*, lpNumberOfCharsWritten=0x124228b0*=0x48) returned 1
	[0289.063] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures\\desktop.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\saved pictures\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x124a60a8 | out: lpFileInformation=0x124a60a8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1a6533, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0xbe)) returned 1
	[0289.063] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Ty yBqBqotltJ9rLD.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\ty ybqbqotltj9rld.gif"), fInfoLevelId=0x0, lpFileInformation=0x124a60f8 | out: lpFileInformation=0x124a60f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x432a3e50, ftCreationTime.dwHighDateTime=0x1d82546, ftLastAccessTime.dwLowDateTime=0xcd0fc1e0, ftLastAccessTime.dwHighDateTime=0x1d82964, ftLastWriteTime.dwLowDateTime=0xcd0fc1e0, ftLastWriteTime.dwHighDateTime=0x1d82964, nFileSizeHigh=0x0, nFileSizeLow=0x12325)) returned 1
	[0289.064] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Ty yBqBqotltJ9rLD.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\ty ybqbqotltj9rld.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0289.064] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0289.064] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Ty yBqBqotltJ9rLD.gif.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\ty ybqbqotltj9rld.gif.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0289.064] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0289.065] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc280 | out: pbBuffer=0x123cc280) returned 1
	[0289.065] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c310 | out: pbBuffer=0x1251c310) returned 1
	[0289.065] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc281 | out: pbBuffer=0x123fc281) returned 1
	[0289.065] WriteFile (in: hFile=0x17c, lpBuffer=0x1253d000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x1253d000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0289.068] SetEvent (hEvent=0x124) returned 1
	[0289.068] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x12325, lpOverlapped=0x0) returned 1
	[0289.072] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x12325, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0x12325, lpOverlapped=0x0) returned 1
	[0289.098] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0289.098] CloseHandle (hObject=0x17c) returned 1
	[0289.099] CloseHandle (hObject=0x178) returned 1
	[0289.099] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123fc380*, nNumberOfCharsToWrite=0x39, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x123fc380*, lpNumberOfCharsWritten=0x124228a0*=0x39) returned 1
	[0289.114] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.119] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Ty yBqBqotltJ9rLD.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\ty ybqbqotltj9rld.gif")) returned 1
	[0289.133] SetEvent (hEvent=0x124) returned 1
	[0289.135] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0289.135] SetEvent (hEvent=0x124) returned 1
	[0289.135] SetEvent (hEvent=0x104) returned 1
	[0289.135] SetEvent (hEvent=0x174) returned 1
	[0289.135] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.136] SetEvent (hEvent=0x174) returned 1
	[0289.170] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0289.172] SetEvent (hEvent=0x168) returned 1
	[0289.172] SetEvent (hEvent=0x174) returned 1
	[0289.175] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0289.176] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0289.176] SetEvent (hEvent=0x174) returned 1
	[0289.176] SetEvent (hEvent=0x104) returned 1
	[0289.176] SetEvent (hEvent=0x124) returned 1
	[0289.176] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.177] SetEvent (hEvent=0x168) returned 1
	[0289.177] SetEvent (hEvent=0x124) returned 1
	[0289.178] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Ty yBqBqotltJ9rLD.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\ty ybqbqotltj9rld.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0289.180] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0289.180] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0289.206] CloseHandle (hObject=0x178) returned 1
	[0289.207] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Ty yBqBqotltJ9rLD.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\ty ybqbqotltj9rld.gif")) returned 1
	[0289.212] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\c64LwMsBO30WRGVpkLy.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\c64lwmsbo30wrgvpkly.png"), fInfoLevelId=0x0, lpFileInformation=0x124a6008 | out: lpFileInformation=0x124a6008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x597f83c0, ftCreationTime.dwHighDateTime=0x1d82093, ftLastAccessTime.dwLowDateTime=0x271f9c60, ftLastAccessTime.dwHighDateTime=0x1d8222f, ftLastWriteTime.dwLowDateTime=0x271f9c60, ftLastWriteTime.dwHighDateTime=0x1d8222f, nFileSizeHigh=0x0, nFileSizeLow=0x3b8a)) returned 1
	[0289.213] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\c64LwMsBO30WRGVpkLy.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\c64lwmsbo30wrgvpkly.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0289.213] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0289.231] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\c64LwMsBO30WRGVpkLy.png.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\c64lwmsbo30wrgvpkly.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0289.231] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0289.231] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc240 | out: pbBuffer=0x123cc240) returned 1
	[0289.231] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c110 | out: pbBuffer=0x1251c110) returned 1
	[0289.231] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc101 | out: pbBuffer=0x123fc101) returned 1
	[0289.231] WriteFile (in: hFile=0x17c, lpBuffer=0x12537000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12537000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0289.234] SetEvent (hEvent=0x104) returned 1
	[0289.234] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x3b8a, lpOverlapped=0x0) returned 1
	[0289.235] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x3b8a, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0x3b8a, lpOverlapped=0x0) returned 1
	[0289.251] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0289.251] CloseHandle (hObject=0x17c) returned 1
	[0289.251] CloseHandle (hObject=0x178) returned 1
	[0289.251] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x123c0200*, nNumberOfCharsToWrite=0x3b, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x123c0200*, lpNumberOfCharsWritten=0x124228a0*=0x3b) returned 1
	[0289.262] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.264] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\c64LwMsBO30WRGVpkLy.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\c64lwmsbo30wrgvpkly.png")) returned 1
	[0289.270] SetEvent (hEvent=0x104) returned 1
	[0289.271] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0289.271] SetEvent (hEvent=0x104) returned 1
	[0289.271] SetEvent (hEvent=0x14c) returned 1
	[0289.271] SetEvent (hEvent=0x174) returned 1
	[0289.271] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.272] SetEvent (hEvent=0x174) returned 1
	[0289.303] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0289.304] SetEvent (hEvent=0x168) returned 1
	[0289.304] SetEvent (hEvent=0x174) returned 1
	[0289.306] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0289.307] SetEvent (hEvent=0x174) returned 1
	[0289.307] SetEvent (hEvent=0x14c) returned 1
	[0289.307] SetEvent (hEvent=0x104) returned 1
	[0289.307] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.307] SetEvent (hEvent=0x104) returned 1
	[0289.308] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\c64LwMsBO30WRGVpkLy.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\c64lwmsbo30wrgvpkly.png"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0289.309] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0289.309] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0289.326] CloseHandle (hObject=0x178) returned 1
	[0289.327] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\c64LwMsBO30WRGVpkLy.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\c64lwmsbo30wrgvpkly.png")) returned 1
	[0289.331] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\desktop.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\desktop.ini"), fInfoLevelId=0x0, lpFileInformation=0x124a6058 | out: lpFileInformation=0x124a6058*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x1f8)) returned 1
	[0289.331] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ebWY.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\ebwy.png"), fInfoLevelId=0x0, lpFileInformation=0x124a60a8 | out: lpFileInformation=0x124a60a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11c44860, ftCreationTime.dwHighDateTime=0x1d82613, ftLastAccessTime.dwLowDateTime=0xff9c2a60, ftLastAccessTime.dwHighDateTime=0x1d829df, ftLastWriteTime.dwLowDateTime=0xff9c2a60, ftLastWriteTime.dwHighDateTime=0x1d829df, nFileSizeHigh=0x0, nFileSizeLow=0x10b35)) returned 1
	[0289.331] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ebWY.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\ebwy.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0289.332] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0289.332] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ebWY.png.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\ebwy.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0289.332] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422c10 | out: lpMode=0x12422c10) returned 0
	[0289.332] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc240 | out: pbBuffer=0x123cc240) returned 1
	[0289.332] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x12412260 | out: pbBuffer=0x12412260) returned 1
	[0289.332] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0289.332] WriteFile (in: hFile=0x17c, lpBuffer=0x12539000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422bec, lpOverlapped=0x0 | out: lpBuffer=0x12539000*, lpNumberOfBytesWritten=0x12422bec*=0x80, lpOverlapped=0x0) returned 1
	[0289.335] SetEvent (hEvent=0x14c) returned 1
	[0289.335] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x10b35, lpOverlapped=0x0) returned 1
	[0289.338] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x10b35, lpNumberOfBytesWritten=0x12422be8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422be8*=0x10b35, lpOverlapped=0x0) returned 1
	[0289.365] SetEvent (hEvent=0x168) returned 1
	[0289.365] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422bdc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422bdc*=0x0, lpOverlapped=0x0) returned 1
	[0289.365] CloseHandle (hObject=0x17c) returned 1
	[0289.366] CloseHandle (hObject=0x178) returned 1
	[0289.366] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12504000*, nNumberOfCharsToWrite=0x2c, lpNumberOfCharsWritten=0x124228a0, lpReserved=0x0 | out: lpBuffer=0x12504000*, lpNumberOfCharsWritten=0x124228a0*=0x2c) returned 1
	[0289.376] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ebWY.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\ebwy.png")) returned 1
	[0289.382] SetEvent (hEvent=0x124) returned 1
	[0289.383] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0289.384] SetEvent (hEvent=0x124) returned 1
	[0289.384] SetEvent (hEvent=0x14c) returned 1
	[0289.384] SetEvent (hEvent=0x174) returned 1
	[0289.384] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.384] SetEvent (hEvent=0x174) returned 1
	[0289.407] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0289.408] SetEvent (hEvent=0x168) returned 1
	[0289.409] SetEvent (hEvent=0x174) returned 1
	[0289.446] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0289.447] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0289.447] SetEvent (hEvent=0x174) returned 1
	[0289.447] SetEvent (hEvent=0x14c) returned 1
	[0289.447] SetEvent (hEvent=0x124) returned 1
	[0289.447] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.448] SetEvent (hEvent=0x124) returned 1
	[0289.449] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ebWY.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\ebwy.png"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0289.449] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422cfc | out: lpMode=0x12422cfc) returned 0
	[0289.450] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422cec, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422cec*=0xfa000, lpOverlapped=0x0) returned 1
	[0289.471] CloseHandle (hObject=0x178) returned 1
	[0289.471] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ebWY.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\ebwy.png")) returned 1
	[0289.476] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa"), fInfoLevelId=0x0, lpFileInformation=0x124a6008 | out: lpFileInformation=0x124a6008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d722d70, ftCreationTime.dwHighDateTime=0x1d822ab, ftLastAccessTime.dwLowDateTime=0x195c7c40, ftLastAccessTime.dwHighDateTime=0x1d82335, ftLastWriteTime.dwLowDateTime=0x195c7c40, ftLastWriteTime.dwHighDateTime=0x1d82335, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0289.476] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0289.477] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d722d70, ftCreationTime.dwHighDateTime=0x1d822ab, ftLastAccessTime.dwLowDateTime=0x195c7c40, ftLastAccessTime.dwHighDateTime=0x1d82335, ftLastWriteTime.dwLowDateTime=0x195c7c40, ftLastWriteTime.dwHighDateTime=0x1d82335, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9e8
	[0289.477] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d722d70, ftCreationTime.dwHighDateTime=0x1d822ab, ftLastAccessTime.dwLowDateTime=0x195c7c40, ftLastAccessTime.dwHighDateTime=0x1d82335, ftLastWriteTime.dwLowDateTime=0x195c7c40, ftLastWriteTime.dwHighDateTime=0x1d82335, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0289.477] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1909e0, ftCreationTime.dwHighDateTime=0x1d82737, ftLastAccessTime.dwLowDateTime=0xc055eb20, ftLastAccessTime.dwHighDateTime=0x1d82a0c, ftLastWriteTime.dwLowDateTime=0xc055eb20, ftLastWriteTime.dwHighDateTime=0x1d82a0c, nFileSizeHigh=0x0, nFileSizeLow=0x1181f, dwReserved0=0x0, dwReserved1=0x0, cFileName="7Xj4TkpbbZ.jpg", cAlternateFileName="7XJ4TK~1.JPG")) returned 1
	[0289.477] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x914d5750, ftCreationTime.dwHighDateTime=0x1d81b9d, ftLastAccessTime.dwLowDateTime=0x7c5f1e20, ftLastAccessTime.dwHighDateTime=0x1d827b2, ftLastWriteTime.dwLowDateTime=0x7c5f1e20, ftLastWriteTime.dwHighDateTime=0x1d827b2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9_G_fS", cAlternateFileName="")) returned 1
	[0289.477] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadc5a380, ftCreationTime.dwHighDateTime=0x1d82046, ftLastAccessTime.dwLowDateTime=0xa27059e0, ftLastAccessTime.dwHighDateTime=0x1d820ae, ftLastWriteTime.dwLowDateTime=0xa27059e0, ftLastWriteTime.dwHighDateTime=0x1d820ae, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="E41Dj3poiaXO2R", cAlternateFileName="E41DJ3~1")) returned 1
	[0289.477] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40b823a0, ftCreationTime.dwHighDateTime=0x1d823d7, ftLastAccessTime.dwLowDateTime=0x87c49b40, ftLastAccessTime.dwHighDateTime=0x1d82614, ftLastWriteTime.dwLowDateTime=0x87c49b40, ftLastWriteTime.dwHighDateTime=0x1d82614, nFileSizeHigh=0x0, nFileSizeLow=0xae46, dwReserved0=0x0, dwReserved1=0x0, cFileName="ees 2RjARK.jpg", cAlternateFileName="EES2RJ~1.JPG")) returned 1
	[0289.477] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23403d10, ftCreationTime.dwHighDateTime=0x1d81b91, ftLastAccessTime.dwLowDateTime=0x604e63c0, ftLastAccessTime.dwHighDateTime=0x1d828a3, ftLastWriteTime.dwLowDateTime=0x604e63c0, ftLastWriteTime.dwHighDateTime=0x1d828a3, nFileSizeHigh=0x0, nFileSizeLow=0x7785, dwReserved0=0x0, dwReserved1=0x0, cFileName="KPjc0osAaE6A.bmp", cAlternateFileName="KPJC0O~1.BMP")) returned 1
	[0289.477] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc5507350, ftCreationTime.dwHighDateTime=0x1d828e7, ftLastAccessTime.dwLowDateTime=0x96405580, ftLastAccessTime.dwHighDateTime=0x1d8290a, ftLastWriteTime.dwLowDateTime=0x96405580, ftLastWriteTime.dwHighDateTime=0x1d8290a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wjPJRAmkGskYdShvUdd", cAlternateFileName="WJPJRA~1")) returned 1
	[0289.477] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e316b80, ftCreationTime.dwHighDateTime=0x1d82839, ftLastAccessTime.dwLowDateTime=0x7aea72e0, ftLastAccessTime.dwHighDateTime=0x1d8288b, ftLastWriteTime.dwLowDateTime=0x7aea72e0, ftLastWriteTime.dwHighDateTime=0x1d8288b, nFileSizeHigh=0x0, nFileSizeLow=0x14677, dwReserved0=0x0, dwReserved1=0x0, cFileName="YFXG0jjPN7Y.png", cAlternateFileName="YFXG0J~1.PNG")) returned 1
	[0289.477] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9b87a40, ftCreationTime.dwHighDateTime=0x1d81cb1, ftLastAccessTime.dwLowDateTime=0x3c3a050, ftLastAccessTime.dwHighDateTime=0x1d82477, ftLastWriteTime.dwLowDateTime=0x3c3a050, ftLastWriteTime.dwHighDateTime=0x1d82477, nFileSizeHigh=0x0, nFileSizeLow=0x7418, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZC2EzW b.png", cAlternateFileName="ZC2EZW~1.PNG")) returned 1
	[0289.477] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0289.477] FindClose (in: hFindFile=0x79f9e8 | out: hFindFile=0x79f9e8) returned 1
	[0289.477] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0289.478] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422d30 | out: lpMode=0x12422d30) returned 0
	[0289.478] WriteFile (in: hFile=0x178, lpBuffer=0x12694000*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422d20, lpOverlapped=0x0 | out: lpBuffer=0x12694000*, lpNumberOfBytesWritten=0x12422d20*=0xc85, lpOverlapped=0x0) returned 1
	[0289.479] CloseHandle (hObject=0x178) returned 1
	[0289.479] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12644140*, nNumberOfCharsToWrite=0x4d, lpNumberOfCharsWritten=0x124228b0, lpReserved=0x0 | out: lpBuffer=0x12644140*, lpNumberOfCharsWritten=0x124228b0*=0x4d) returned 1
	[0289.489] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\7Xj4TkpbbZ.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\7xj4tkpbbz.jpg"), fInfoLevelId=0x0, lpFileInformation=0x124a6328 | out: lpFileInformation=0x124a6328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1909e0, ftCreationTime.dwHighDateTime=0x1d82737, ftLastAccessTime.dwLowDateTime=0xc055eb20, ftLastAccessTime.dwHighDateTime=0x1d82a0c, ftLastWriteTime.dwLowDateTime=0xc055eb20, ftLastWriteTime.dwHighDateTime=0x1d82a0c, nFileSizeHigh=0x0, nFileSizeLow=0x1181f)) returned 1
	[0289.490] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\7Xj4TkpbbZ.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\7xj4tkpbbz.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0289.490] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0289.490] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\7Xj4TkpbbZ.jpg.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\7xj4tkpbbz.jpg.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0289.490] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0289.490] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc360 | out: pbBuffer=0x123cc360) returned 1
	[0289.490] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124122f0 | out: pbBuffer=0x124122f0) returned 1
	[0289.490] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0301 | out: pbBuffer=0x123c0301) returned 1
	[0289.491] WriteFile (in: hFile=0x17c, lpBuffer=0x1253f000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x1253f000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0289.495] SetEvent (hEvent=0x14c) returned 1
	[0289.495] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x1181f, lpOverlapped=0x0) returned 1
	[0289.498] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x1181f, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b84*=0x1181f, lpOverlapped=0x0) returned 1
	[0289.533] SetEvent (hEvent=0x168) returned 1
	[0289.533] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0289.534] CloseHandle (hObject=0x17c) returned 1
	[0289.534] CloseHandle (hObject=0x178) returned 1
	[0289.534] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12642000*, nNumberOfCharsToWrite=0x46, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x12642000*, lpNumberOfCharsWritten=0x1242283c*=0x46) returned 1
	[0289.545] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\7Xj4TkpbbZ.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\7xj4tkpbbz.jpg")) returned 1
	[0289.551] SetEvent (hEvent=0x104) returned 1
	[0289.552] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0289.552] SetEvent (hEvent=0x104) returned 1
	[0289.553] SetEvent (hEvent=0x14c) returned 1
	[0289.553] SetEvent (hEvent=0x174) returned 1
	[0289.553] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.553] SetEvent (hEvent=0x174) returned 1
	[0289.578] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0289.579] SetEvent (hEvent=0x168) returned 1
	[0289.579] SetEvent (hEvent=0x174) returned 1
	[0289.581] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0289.582] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0289.582] SetEvent (hEvent=0x174) returned 1
	[0289.582] SetEvent (hEvent=0x14c) returned 1
	[0289.582] SetEvent (hEvent=0x104) returned 1
	[0289.582] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.582] SetEvent (hEvent=0x104) returned 1
	[0289.583] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\7Xj4TkpbbZ.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\7xj4tkpbbz.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0289.584] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0289.584] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0289.604] CloseHandle (hObject=0x178) returned 1
	[0289.605] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\7Xj4TkpbbZ.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\7xj4tkpbbz.jpg")) returned 1
	[0289.609] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs"), fInfoLevelId=0x0, lpFileInformation=0x124a6058 | out: lpFileInformation=0x124a6058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x914d5750, ftCreationTime.dwHighDateTime=0x1d81b9d, ftLastAccessTime.dwLowDateTime=0x7c5f1e20, ftLastAccessTime.dwHighDateTime=0x1d827b2, ftLastWriteTime.dwLowDateTime=0x7c5f1e20, ftLastWriteTime.dwHighDateTime=0x1d827b2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0289.609] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0289.610] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x914d5750, ftCreationTime.dwHighDateTime=0x1d81b9d, ftLastAccessTime.dwLowDateTime=0x7c5f1e20, ftLastAccessTime.dwHighDateTime=0x1d827b2, ftLastWriteTime.dwLowDateTime=0x7c5f1e20, ftLastWriteTime.dwHighDateTime=0x1d827b2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fb28
	[0289.610] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x914d5750, ftCreationTime.dwHighDateTime=0x1d81b9d, ftLastAccessTime.dwLowDateTime=0x7c5f1e20, ftLastAccessTime.dwHighDateTime=0x1d827b2, ftLastWriteTime.dwLowDateTime=0x7c5f1e20, ftLastWriteTime.dwHighDateTime=0x1d827b2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0289.610] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b0e2370, ftCreationTime.dwHighDateTime=0x1d8297b, ftLastAccessTime.dwLowDateTime=0x505492e0, ftLastAccessTime.dwHighDateTime=0x1d829bc, ftLastWriteTime.dwLowDateTime=0x505492e0, ftLastWriteTime.dwHighDateTime=0x1d829bc, nFileSizeHigh=0x0, nFileSizeLow=0x2874, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCBj.bmp", cAlternateFileName="")) returned 1
	[0289.610] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a63600, ftCreationTime.dwHighDateTime=0x1d82351, ftLastAccessTime.dwLowDateTime=0x316abdb0, ftLastAccessTime.dwHighDateTime=0x1d82885, ftLastWriteTime.dwLowDateTime=0x316abdb0, ftLastWriteTime.dwHighDateTime=0x1d82885, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LwwYEKAS1DSwHRtiI9", cAlternateFileName="LWWYEK~1")) returned 1
	[0289.610] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3265ed0, ftCreationTime.dwHighDateTime=0x1d82611, ftLastAccessTime.dwLowDateTime=0x8b2a49b0, ftLastAccessTime.dwHighDateTime=0x1d82970, ftLastWriteTime.dwLowDateTime=0x8b2a49b0, ftLastWriteTime.dwHighDateTime=0x1d82970, nFileSizeHigh=0x0, nFileSizeLow=0xa361, dwReserved0=0x0, dwReserved1=0x0, cFileName="T26SrzDK.jpg", cAlternateFileName="")) returned 1
	[0289.610] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e325cf0, ftCreationTime.dwHighDateTime=0x1d82999, ftLastAccessTime.dwLowDateTime=0x5113f800, ftLastAccessTime.dwHighDateTime=0x1d829cc, ftLastWriteTime.dwLowDateTime=0x5113f800, ftLastWriteTime.dwHighDateTime=0x1d829cc, nFileSizeHigh=0x0, nFileSizeLow=0xdf60, dwReserved0=0x0, dwReserved1=0x0, cFileName="_3za2f0R.jpg", cAlternateFileName="")) returned 1
	[0289.610] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0289.610] FindClose (in: hFindFile=0x79fb28 | out: hFindFile=0x79fb28) returned 1
	[0289.610] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0289.676] SetEvent (hEvent=0x168) returned 1
	[0289.676] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422ccc | out: lpMode=0x12422ccc) returned 0
	[0289.676] WriteFile (in: hFile=0x178, lpBuffer=0x12694000*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422cbc, lpOverlapped=0x0 | out: lpBuffer=0x12694000*, lpNumberOfBytesWritten=0x12422cbc*=0xc85, lpOverlapped=0x0) returned 1
	[0289.677] CloseHandle (hObject=0x178) returned 1
	[0289.677] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12516000*, nNumberOfCharsToWrite=0x54, lpNumberOfCharsWritten=0x1242284c, lpReserved=0x0 | out: lpBuffer=0x12516000*, lpNumberOfCharsWritten=0x1242284c*=0x54) returned 1
	[0289.687] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\BCBj.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\bcbj.bmp"), fInfoLevelId=0x0, lpFileInformation=0x124a61e8 | out: lpFileInformation=0x124a61e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b0e2370, ftCreationTime.dwHighDateTime=0x1d8297b, ftLastAccessTime.dwLowDateTime=0x505492e0, ftLastAccessTime.dwHighDateTime=0x1d829bc, ftLastWriteTime.dwLowDateTime=0x505492e0, ftLastWriteTime.dwHighDateTime=0x1d829bc, nFileSizeHigh=0x0, nFileSizeLow=0x2874)) returned 1
	[0289.687] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\BCBj.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\bcbj.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0289.688] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b48 | out: lpMode=0x12422b48) returned 0
	[0289.688] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\BCBj.bmp.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\bcbj.bmp.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0289.688] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422b48 | out: lpMode=0x12422b48) returned 0
	[0289.688] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc380 | out: pbBuffer=0x123cc380) returned 1
	[0289.688] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x12412320 | out: pbBuffer=0x12412320) returned 1
	[0289.689] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0381 | out: pbBuffer=0x123c0381) returned 1
	[0289.689] WriteFile (in: hFile=0x17c, lpBuffer=0x1253d000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b24, lpOverlapped=0x0 | out: lpBuffer=0x1253d000*, lpNumberOfBytesWritten=0x12422b24*=0x80, lpOverlapped=0x0) returned 1
	[0289.691] SetEvent (hEvent=0x14c) returned 1
	[0289.691] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b14, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b14*=0x2874, lpOverlapped=0x0) returned 1
	[0289.693] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x2874, lpNumberOfBytesWritten=0x12422b20, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b20*=0x2874, lpOverlapped=0x0) returned 1
	[0289.697] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b14, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b14*=0x0, lpOverlapped=0x0) returned 1
	[0289.697] CloseHandle (hObject=0x17c) returned 1
	[0289.697] CloseHandle (hObject=0x178) returned 1
	[0289.697] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12510000*, nNumberOfCharsToWrite=0x47, lpNumberOfCharsWritten=0x124227d8, lpReserved=0x0 | out: lpBuffer=0x12510000*, lpNumberOfCharsWritten=0x124227d8*=0x47) returned 1
	[0289.711] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.712] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\BCBj.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\bcbj.bmp")) returned 1
	[0289.723] SetEvent (hEvent=0x14c) returned 1
	[0289.724] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0289.725] SetEvent (hEvent=0x14c) returned 1
	[0289.726] SetEvent (hEvent=0x124) returned 1
	[0289.726] SetEvent (hEvent=0x174) returned 1
	[0289.726] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.726] SetEvent (hEvent=0x168) returned 1
	[0289.726] SetEvent (hEvent=0x174) returned 1
	[0289.750] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0289.752] SetEvent (hEvent=0x174) returned 1
	[0289.754] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0289.754] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0289.755] SetEvent (hEvent=0x174) returned 1
	[0289.755] SetEvent (hEvent=0x124) returned 1
	[0289.755] SetEvent (hEvent=0x14c) returned 1
	[0289.755] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.755] SetEvent (hEvent=0x14c) returned 1
	[0289.756] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\BCBj.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\bcbj.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0289.757] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c34 | out: lpMode=0x12422c34) returned 0
	[0289.757] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c24, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c24*=0xfa000, lpOverlapped=0x0) returned 1
	[0289.776] CloseHandle (hObject=0x178) returned 1
	[0289.779] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\BCBj.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\bcbj.bmp")) returned 1
	[0289.785] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9"), fInfoLevelId=0x0, lpFileInformation=0x124a60a8 | out: lpFileInformation=0x124a60a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a63600, ftCreationTime.dwHighDateTime=0x1d82351, ftLastAccessTime.dwLowDateTime=0x316abdb0, ftLastAccessTime.dwHighDateTime=0x1d82885, ftLastWriteTime.dwLowDateTime=0x316abdb0, ftLastWriteTime.dwHighDateTime=0x1d82885, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0289.785] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0289.785] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a63600, ftCreationTime.dwHighDateTime=0x1d82351, ftLastAccessTime.dwLowDateTime=0x316abdb0, ftLastAccessTime.dwHighDateTime=0x1d82885, ftLastWriteTime.dwLowDateTime=0x316abdb0, ftLastWriteTime.dwHighDateTime=0x1d82885, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0068
	[0289.786] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a63600, ftCreationTime.dwHighDateTime=0x1d82351, ftLastAccessTime.dwLowDateTime=0x316abdb0, ftLastAccessTime.dwHighDateTime=0x1d82885, ftLastWriteTime.dwLowDateTime=0x316abdb0, ftLastWriteTime.dwHighDateTime=0x1d82885, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0289.786] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x242c4c90, ftCreationTime.dwHighDateTime=0x1d8251a, ftLastAccessTime.dwLowDateTime=0x4cbef260, ftLastAccessTime.dwHighDateTime=0x1d82732, ftLastWriteTime.dwLowDateTime=0x4cbef260, ftLastWriteTime.dwHighDateTime=0x1d82732, nFileSizeHigh=0x0, nFileSizeLow=0xf7e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="GkKtl.jpg", cAlternateFileName="")) returned 1
	[0289.786] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8351630, ftCreationTime.dwHighDateTime=0x1d820a3, ftLastAccessTime.dwLowDateTime=0x21e1ac40, ftLastAccessTime.dwHighDateTime=0x1d82449, ftLastWriteTime.dwLowDateTime=0x21e1ac40, ftLastWriteTime.dwHighDateTime=0x1d82449, nFileSizeHigh=0x0, nFileSizeLow=0xb7c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="HPF6txjjI-Z6F.jpg", cAlternateFileName="HPF6TX~1.JPG")) returned 1
	[0289.786] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13fd8590, ftCreationTime.dwHighDateTime=0x1d81d0a, ftLastAccessTime.dwLowDateTime=0x48f73b70, ftLastAccessTime.dwHighDateTime=0x1d82934, ftLastWriteTime.dwLowDateTime=0x48f73b70, ftLastWriteTime.dwHighDateTime=0x1d82934, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SwyjcRMf2zHY2hAT", cAlternateFileName="SWYJCR~1")) returned 1
	[0289.786] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd44fcff0, ftCreationTime.dwHighDateTime=0x1d81d4c, ftLastAccessTime.dwLowDateTime=0xac420490, ftLastAccessTime.dwHighDateTime=0x1d82587, ftLastWriteTime.dwLowDateTime=0xac420490, ftLastWriteTime.dwHighDateTime=0x1d82587, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="szOEK-", cAlternateFileName="")) returned 1
	[0289.786] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ac2e2f0, ftCreationTime.dwHighDateTime=0x1d8209d, ftLastAccessTime.dwLowDateTime=0xd8a8b0, ftLastAccessTime.dwHighDateTime=0x1d82614, ftLastWriteTime.dwLowDateTime=0xd8a8b0, ftLastWriteTime.dwHighDateTime=0x1d82614, nFileSizeHigh=0x0, nFileSizeLow=0x35d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZTQJHTAJ0x.png", cAlternateFileName="ZTQJHT~1.PNG")) returned 1
	[0289.786] FindNextFileW (in: hFindFile=0x7a0068, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0289.786] FindClose (in: hFindFile=0x7a0068 | out: hFindFile=0x7a0068) returned 1
	[0289.786] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0289.787] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c68 | out: lpMode=0x12422c68) returned 0
	[0289.787] WriteFile (in: hFile=0x178, lpBuffer=0x12694000*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422c58, lpOverlapped=0x0 | out: lpBuffer=0x12694000*, lpNumberOfBytesWritten=0x12422c58*=0xc85, lpOverlapped=0x0) returned 1
	[0289.788] CloseHandle (hObject=0x178) returned 1
	[0289.788] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12538000*, nNumberOfCharsToWrite=0x67, lpNumberOfCharsWritten=0x124227e8, lpReserved=0x0 | out: lpBuffer=0x12538000*, lpNumberOfCharsWritten=0x124227e8*=0x67) returned 1
	[0289.799] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\GkKtl.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\gkktl.jpg"), fInfoLevelId=0x0, lpFileInformation=0x124a62d8 | out: lpFileInformation=0x124a62d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x242c4c90, ftCreationTime.dwHighDateTime=0x1d8251a, ftLastAccessTime.dwLowDateTime=0x4cbef260, ftLastAccessTime.dwHighDateTime=0x1d82732, ftLastWriteTime.dwLowDateTime=0x4cbef260, ftLastWriteTime.dwHighDateTime=0x1d82732, nFileSizeHigh=0x0, nFileSizeLow=0xf7e9)) returned 1
	[0289.800] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\GkKtl.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\gkktl.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0289.800] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422ae4 | out: lpMode=0x12422ae4) returned 0
	[0289.800] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\GkKtl.jpg.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\gkktl.jpg.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0289.800] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422ae4 | out: lpMode=0x12422ae4) returned 0
	[0289.800] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc3e0 | out: pbBuffer=0x123cc3e0) returned 1
	[0289.800] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c260 | out: pbBuffer=0x1251c260) returned 1
	[0289.800] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0289.801] WriteFile (in: hFile=0x17c, lpBuffer=0x12509000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422ac0, lpOverlapped=0x0 | out: lpBuffer=0x12509000*, lpNumberOfBytesWritten=0x12422ac0*=0x80, lpOverlapped=0x0) returned 1
	[0289.803] SetEvent (hEvent=0x124) returned 1
	[0289.803] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422ab0, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422ab0*=0xf7e9, lpOverlapped=0x0) returned 1
	[0289.806] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0xf7e9, lpNumberOfBytesWritten=0x12422abc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422abc*=0xf7e9, lpOverlapped=0x0) returned 1
	[0289.853] SetEvent (hEvent=0x168) returned 1
	[0289.853] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422ab0, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422ab0*=0x0, lpOverlapped=0x0) returned 1
	[0289.854] CloseHandle (hObject=0x17c) returned 1
	[0289.854] CloseHandle (hObject=0x178) returned 1
	[0289.854] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12426000*, nNumberOfCharsToWrite=0x5b, lpNumberOfCharsWritten=0x12422774, lpReserved=0x0 | out: lpBuffer=0x12426000*, lpNumberOfCharsWritten=0x12422774*=0x5b) returned 1
	[0289.866] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\GkKtl.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\gkktl.jpg")) returned 1
	[0289.874] SetEvent (hEvent=0x104) returned 1
	[0289.875] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0289.876] SetEvent (hEvent=0x104) returned 1
	[0289.876] SetEvent (hEvent=0x124) returned 1
	[0289.876] SetEvent (hEvent=0x174) returned 1
	[0289.876] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.879] SetEvent (hEvent=0x174) returned 1
	[0289.900] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0289.901] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.901] SetEvent (hEvent=0x168) returned 1
	[0289.901] SetEvent (hEvent=0x174) returned 1
	[0289.903] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0289.904] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0289.904] SetEvent (hEvent=0x174) returned 1
	[0289.904] SetEvent (hEvent=0x124) returned 1
	[0289.904] SetEvent (hEvent=0x104) returned 1
	[0289.904] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.905] SetEvent (hEvent=0x104) returned 1
	[0289.905] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\GkKtl.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\gkktl.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0289.907] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bd0 | out: lpMode=0x12422bd0) returned 0
	[0289.907] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422bc0, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422bc0*=0xfa000, lpOverlapped=0x0) returned 1
	[0289.926] CloseHandle (hObject=0x178) returned 1
	[0289.926] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\GkKtl.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\gkktl.jpg")) returned 1
	[0289.932] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\HPF6txjjI-Z6F.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\hpf6txjji-z6f.jpg"), fInfoLevelId=0x0, lpFileInformation=0x124a60f8 | out: lpFileInformation=0x124a60f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8351630, ftCreationTime.dwHighDateTime=0x1d820a3, ftLastAccessTime.dwLowDateTime=0x21e1ac40, ftLastAccessTime.dwHighDateTime=0x1d82449, ftLastWriteTime.dwLowDateTime=0x21e1ac40, ftLastWriteTime.dwHighDateTime=0x1d82449, nFileSizeHigh=0x0, nFileSizeLow=0xb7c7)) returned 1
	[0289.932] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\HPF6txjjI-Z6F.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\hpf6txjji-z6f.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0289.932] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422ae4 | out: lpMode=0x12422ae4) returned 0
	[0289.932] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\HPF6txjjI-Z6F.jpg.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\hpf6txjji-z6f.jpg.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0289.933] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422ae4 | out: lpMode=0x12422ae4) returned 0
	[0289.933] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc380 | out: pbBuffer=0x123cc380) returned 1
	[0289.933] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c130 | out: pbBuffer=0x1251c130) returned 1
	[0289.933] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0201 | out: pbBuffer=0x123c0201) returned 1
	[0289.933] WriteFile (in: hFile=0x17c, lpBuffer=0x1253d000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422ac0, lpOverlapped=0x0 | out: lpBuffer=0x1253d000*, lpNumberOfBytesWritten=0x12422ac0*=0x80, lpOverlapped=0x0) returned 1
	[0289.936] SetEvent (hEvent=0x124) returned 1
	[0289.936] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422ab0, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422ab0*=0xb7c7, lpOverlapped=0x0) returned 1
	[0289.938] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0xb7c7, lpNumberOfBytesWritten=0x12422abc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422abc*=0xb7c7, lpOverlapped=0x0) returned 1
	[0290.133] SetEvent (hEvent=0x168) returned 1
	[0290.133] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422ab0, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422ab0*=0x0, lpOverlapped=0x0) returned 1
	[0290.133] CloseHandle (hObject=0x17c) returned 1
	[0290.133] CloseHandle (hObject=0x178) returned 1
	[0290.133] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12426000*, nNumberOfCharsToWrite=0x63, lpNumberOfCharsWritten=0x12422774, lpReserved=0x0 | out: lpBuffer=0x12426000*, lpNumberOfCharsWritten=0x12422774*=0x63) returned 1
	[0290.143] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\HPF6txjjI-Z6F.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\hpf6txjji-z6f.jpg")) returned 1
	[0290.149] SetEvent (hEvent=0x14c) returned 1
	[0290.151] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0290.154] SetEvent (hEvent=0x14c) returned 1
	[0290.154] SetEvent (hEvent=0x124) returned 1
	[0290.154] SetEvent (hEvent=0x174) returned 1
	[0290.154] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.155] SetEvent (hEvent=0x168) returned 1
	[0290.155] SetEvent (hEvent=0x174) returned 1
	[0290.178] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0290.180] SetEvent (hEvent=0x174) returned 1
	[0290.182] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0290.183] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0290.183] SetEvent (hEvent=0x174) returned 1
	[0290.183] SetEvent (hEvent=0x124) returned 1
	[0290.183] SetEvent (hEvent=0x14c) returned 1
	[0290.183] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.183] SetEvent (hEvent=0x14c) returned 1
	[0290.184] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\HPF6txjjI-Z6F.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\hpf6txjji-z6f.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0290.185] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bd0 | out: lpMode=0x12422bd0) returned 0
	[0290.185] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422bc0, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422bc0*=0xfa000, lpOverlapped=0x0) returned 1
	[0290.206] CloseHandle (hObject=0x178) returned 1
	[0290.207] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\HPF6txjjI-Z6F.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\hpf6txjji-z6f.jpg")) returned 1
	[0290.211] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\SwyjcRMf2zHY2hAT" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\swyjcrmf2zhy2hat"), fInfoLevelId=0x0, lpFileInformation=0x124a6148 | out: lpFileInformation=0x124a6148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13fd8590, ftCreationTime.dwHighDateTime=0x1d81d0a, ftLastAccessTime.dwLowDateTime=0x48f73b70, ftLastAccessTime.dwHighDateTime=0x1d82934, ftLastWriteTime.dwLowDateTime=0x48f73b70, ftLastWriteTime.dwHighDateTime=0x1d82934, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0290.212] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\SwyjcRMf2zHY2hAT" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\swyjcrmf2zhy2hat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0290.212] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\SwyjcRMf2zHY2hAT\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13fd8590, ftCreationTime.dwHighDateTime=0x1d81d0a, ftLastAccessTime.dwLowDateTime=0x48f73b70, ftLastAccessTime.dwHighDateTime=0x1d82934, ftLastWriteTime.dwLowDateTime=0x48f73b70, ftLastWriteTime.dwHighDateTime=0x1d82934, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffe8
	[0290.212] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13fd8590, ftCreationTime.dwHighDateTime=0x1d81d0a, ftLastAccessTime.dwLowDateTime=0x48f73b70, ftLastAccessTime.dwHighDateTime=0x1d82934, ftLastWriteTime.dwLowDateTime=0x48f73b70, ftLastWriteTime.dwHighDateTime=0x1d82934, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0290.212] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52a94730, ftCreationTime.dwHighDateTime=0x1d8223b, ftLastAccessTime.dwLowDateTime=0x691f5f90, ftLastAccessTime.dwHighDateTime=0x1d82371, ftLastWriteTime.dwLowDateTime=0x691f5f90, ftLastWriteTime.dwHighDateTime=0x1d82371, nFileSizeHigh=0x0, nFileSizeLow=0x82bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="0JJfoMS6Vlru.bmp", cAlternateFileName="0JJFOM~1.BMP")) returned 1
	[0290.212] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x25991e10, ftCreationTime.dwHighDateTime=0x1d8248d, ftLastAccessTime.dwLowDateTime=0x23178660, ftLastAccessTime.dwHighDateTime=0x1d829ea, ftLastWriteTime.dwLowDateTime=0x23178660, ftLastWriteTime.dwHighDateTime=0x1d829ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MXbhihnZMc_3GTZt", cAlternateFileName="MXBHIH~1")) returned 1
	[0290.212] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0290.212] FindClose (in: hFindFile=0x79ffe8 | out: hFindFile=0x79ffe8) returned 1
	[0290.212] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\SwyjcRMf2zHY2hAT\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\swyjcrmf2zhy2hat\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0290.257] SetEvent (hEvent=0x168) returned 1
	[0290.257] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c04 | out: lpMode=0x12422c04) returned 0
	[0290.257] WriteFile (in: hFile=0x178, lpBuffer=0x12694000*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422bf4, lpOverlapped=0x0 | out: lpBuffer=0x12694000*, lpNumberOfBytesWritten=0x12422bf4*=0xc85, lpOverlapped=0x0) returned 1
	[0290.259] CloseHandle (hObject=0x178) returned 1
	[0290.259] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12538000*, nNumberOfCharsToWrite=0x78, lpNumberOfCharsWritten=0x12422784, lpReserved=0x0 | out: lpBuffer=0x12538000*, lpNumberOfCharsWritten=0x12422784*=0x78) returned 1
	[0290.271] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\SwyjcRMf2zHY2hAT\\0JJfoMS6Vlru.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\swyjcrmf2zhy2hat\\0jjfoms6vlru.bmp"), fInfoLevelId=0x0, lpFileInformation=0x124a6238 | out: lpFileInformation=0x124a6238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52a94730, ftCreationTime.dwHighDateTime=0x1d8223b, ftLastAccessTime.dwLowDateTime=0x691f5f90, ftLastAccessTime.dwHighDateTime=0x1d82371, ftLastWriteTime.dwLowDateTime=0x691f5f90, ftLastWriteTime.dwHighDateTime=0x1d82371, nFileSizeHigh=0x0, nFileSizeLow=0x82bb)) returned 1
	[0290.271] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\SwyjcRMf2zHY2hAT\\0JJfoMS6Vlru.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\swyjcrmf2zhy2hat\\0jjfoms6vlru.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0290.271] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0290.271] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\SwyjcRMf2zHY2hAT\\0JJfoMS6Vlru.bmp.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\swyjcrmf2zhy2hat\\0jjfoms6vlru.bmp.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0290.272] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0290.272] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc400 | out: pbBuffer=0x123cc400) returned 1
	[0290.272] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c260 | out: pbBuffer=0x1251c260) returned 1
	[0290.272] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123c0301 | out: pbBuffer=0x123c0301) returned 1
	[0290.272] WriteFile (in: hFile=0x17c, lpBuffer=0x12509000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422a5c, lpOverlapped=0x0 | out: lpBuffer=0x12509000*, lpNumberOfBytesWritten=0x12422a5c*=0x80, lpOverlapped=0x0) returned 1
	[0290.275] SetEvent (hEvent=0x124) returned 1
	[0290.275] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422a4c*=0x82bb, lpOverlapped=0x0) returned 1
	[0290.276] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x82bb, lpNumberOfBytesWritten=0x12422a58, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422a58*=0x82bb, lpOverlapped=0x0) returned 1
	[0290.278] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422a4c*=0x0, lpOverlapped=0x0) returned 1
	[0290.279] CloseHandle (hObject=0x17c) returned 1
	[0290.279] CloseHandle (hObject=0x178) returned 1
	[0290.279] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x125d2000*, nNumberOfCharsToWrite=0x73, lpNumberOfCharsWritten=0x12422710, lpReserved=0x0 | out: lpBuffer=0x125d2000*, lpNumberOfCharsWritten=0x12422710*=0x73) returned 1
	[0290.292] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.295] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\SwyjcRMf2zHY2hAT\\0JJfoMS6Vlru.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\swyjcrmf2zhy2hat\\0jjfoms6vlru.bmp")) returned 1
	[0290.312] SetEvent (hEvent=0x124) returned 1
	[0290.314] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0290.315] SetEvent (hEvent=0x124) returned 1
	[0290.315] SetEvent (hEvent=0x104) returned 1
	[0290.315] SetEvent (hEvent=0x174) returned 1
	[0290.315] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.316] SetEvent (hEvent=0x174) returned 1
	[0290.336] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0290.336] SetEvent (hEvent=0x168) returned 1
	[0290.336] SetEvent (hEvent=0x174) returned 1
	[0290.338] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0290.339] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0290.339] SetEvent (hEvent=0x174) returned 1
	[0290.339] SetEvent (hEvent=0x104) returned 1
	[0290.339] SetEvent (hEvent=0x124) returned 1
	[0290.339] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.340] SetEvent (hEvent=0x124) returned 1
	[0290.340] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\SwyjcRMf2zHY2hAT\\0JJfoMS6Vlru.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\swyjcrmf2zhy2hat\\0jjfoms6vlru.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0290.341] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b6c | out: lpMode=0x12422b6c) returned 0
	[0290.341] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422b5c, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422b5c*=0xfa000, lpOverlapped=0x0) returned 1
	[0290.361] CloseHandle (hObject=0x178) returned 1
	[0290.361] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\SwyjcRMf2zHY2hAT\\0JJfoMS6Vlru.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\swyjcrmf2zhy2hat\\0jjfoms6vlru.bmp")) returned 1
	[0290.366] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\SwyjcRMf2zHY2hAT\\MXbhihnZMc_3GTZt" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\swyjcrmf2zhy2hat\\mxbhihnzmc_3gtzt"), fInfoLevelId=0x0, lpFileInformation=0x124a60f8 | out: lpFileInformation=0x124a60f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x25991e10, ftCreationTime.dwHighDateTime=0x1d8248d, ftLastAccessTime.dwLowDateTime=0x23178660, ftLastAccessTime.dwHighDateTime=0x1d829ea, ftLastWriteTime.dwLowDateTime=0x23178660, ftLastWriteTime.dwHighDateTime=0x1d829ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0290.367] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\SwyjcRMf2zHY2hAT\\MXbhihnZMc_3GTZt" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\swyjcrmf2zhy2hat\\mxbhihnzmc_3gtzt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0290.367] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\SwyjcRMf2zHY2hAT\\MXbhihnZMc_3GTZt\\*", lpFindFileData=0x12423788 | out: lpFindFileData=0x12423788*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x25991e10, ftCreationTime.dwHighDateTime=0x1d8248d, ftLastAccessTime.dwLowDateTime=0x23178660, ftLastAccessTime.dwHighDateTime=0x1d829ea, ftLastWriteTime.dwLowDateTime=0x23178660, ftLastWriteTime.dwHighDateTime=0x1d829ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f928
	[0290.367] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x25991e10, ftCreationTime.dwHighDateTime=0x1d8248d, ftLastAccessTime.dwLowDateTime=0x23178660, ftLastAccessTime.dwHighDateTime=0x1d829ea, ftLastWriteTime.dwLowDateTime=0x23178660, ftLastWriteTime.dwHighDateTime=0x1d829ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0290.367] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5365a150, ftCreationTime.dwHighDateTime=0x1d82407, ftLastAccessTime.dwLowDateTime=0x1d3c5960, ftLastAccessTime.dwHighDateTime=0x1d82444, ftLastWriteTime.dwLowDateTime=0x1d3c5960, ftLastWriteTime.dwHighDateTime=0x1d82444, nFileSizeHigh=0x0, nFileSizeLow=0x6cb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="3gE yTqz1tP.jpg", cAlternateFileName="3GEYTQ~1.JPG")) returned 1
	[0290.367] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd885ac0, ftCreationTime.dwHighDateTime=0x1d824ff, ftLastAccessTime.dwLowDateTime=0x4394b600, ftLastAccessTime.dwHighDateTime=0x1d82761, ftLastWriteTime.dwLowDateTime=0x4394b600, ftLastWriteTime.dwHighDateTime=0x1d82761, nFileSizeHigh=0x0, nFileSizeLow=0x11aa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="4uR-okZ_KnAWKkK.bmp", cAlternateFileName="4UR-OK~1.BMP")) returned 1
	[0290.367] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa53bf6c0, ftCreationTime.dwHighDateTime=0x1d8218f, ftLastAccessTime.dwLowDateTime=0xac218180, ftLastAccessTime.dwHighDateTime=0x1d829eb, ftLastWriteTime.dwLowDateTime=0xac218180, ftLastWriteTime.dwHighDateTime=0x1d829eb, nFileSizeHigh=0x0, nFileSizeLow=0x6959, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENHF.png", cAlternateFileName="")) returned 1
	[0290.367] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x875acf90, ftCreationTime.dwHighDateTime=0x1d828ca, ftLastAccessTime.dwLowDateTime=0x31153bb0, ftLastAccessTime.dwHighDateTime=0x1d8292a, ftLastWriteTime.dwLowDateTime=0x31153bb0, ftLastWriteTime.dwHighDateTime=0x1d8292a, nFileSizeHigh=0x0, nFileSizeLow=0xfa5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="zwl7b4WWRpJy.gif", cAlternateFileName="ZWL7B4~1.GIF")) returned 1
	[0290.367] FindNextFileW (in: hFindFile=0x79f928, lpFindFileData=0x124237a8 | out: lpFindFileData=0x124237a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0290.367] FindClose (in: hFindFile=0x79f928 | out: hFindFile=0x79f928) returned 1
	[0290.368] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\SwyjcRMf2zHY2hAT\\MXbhihnZMc_3GTZt\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\swyjcrmf2zhy2hat\\mxbhihnzmc_3gtzt\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0290.368] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422ba0 | out: lpMode=0x12422ba0) returned 0
	[0290.368] WriteFile (in: hFile=0x178, lpBuffer=0x12694000*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422b90, lpOverlapped=0x0 | out: lpBuffer=0x12694000*, lpNumberOfBytesWritten=0x12422b90*=0xc85, lpOverlapped=0x0) returned 1
	[0290.369] CloseHandle (hObject=0x178) returned 1
	[0290.369] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1253c000*, nNumberOfCharsToWrite=0x89, lpNumberOfCharsWritten=0x12422720, lpReserved=0x0 | out: lpBuffer=0x1253c000*, lpNumberOfCharsWritten=0x12422720*=0x89) returned 1
	[0290.381] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\SwyjcRMf2zHY2hAT\\MXbhihnZMc_3GTZt\\3gE yTqz1tP.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\swyjcrmf2zhy2hat\\mxbhihnzmc_3gtzt\\3ge ytqz1tp.jpg"), fInfoLevelId=0x0, lpFileInformation=0x124a6328 | out: lpFileInformation=0x124a6328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5365a150, ftCreationTime.dwHighDateTime=0x1d82407, ftLastAccessTime.dwLowDateTime=0x1d3c5960, ftLastAccessTime.dwHighDateTime=0x1d82444, ftLastWriteTime.dwLowDateTime=0x1d3c5960, ftLastWriteTime.dwHighDateTime=0x1d82444, nFileSizeHigh=0x0, nFileSizeLow=0x6cb9)) returned 1
	[0290.381] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\SwyjcRMf2zHY2hAT\\MXbhihnZMc_3GTZt\\3gE yTqz1tP.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\swyjcrmf2zhy2hat\\mxbhihnzmc_3gtzt\\3ge ytqz1tp.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0290.381] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422a1c | out: lpMode=0x12422a1c) returned 0
	[0290.381] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\SwyjcRMf2zHY2hAT\\MXbhihnZMc_3GTZt\\3gE yTqz1tP.jpg.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\swyjcrmf2zhy2hat\\mxbhihnzmc_3gtzt\\3ge ytqz1tp.jpg.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0290.381] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422a1c | out: lpMode=0x12422a1c) returned 0
	[0290.381] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc480 | out: pbBuffer=0x123cc480) returned 1
	[0290.382] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x12412330 | out: pbBuffer=0x12412330) returned 1
	[0290.382] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fd601 | out: pbBuffer=0x123fd601) returned 1
	[0290.382] WriteFile (in: hFile=0x17c, lpBuffer=0x125d1000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x124229f8, lpOverlapped=0x0 | out: lpBuffer=0x125d1000*, lpNumberOfBytesWritten=0x124229f8*=0x80, lpOverlapped=0x0) returned 1
	[0290.384] SetEvent (hEvent=0x104) returned 1
	[0290.384] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x124229e8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x124229e8*=0x6cb9, lpOverlapped=0x0) returned 1
	[0290.385] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x6cb9, lpNumberOfBytesWritten=0x124229f4, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x124229f4*=0x6cb9, lpOverlapped=0x0) returned 1
	[0290.408] SetEvent (hEvent=0x168) returned 1
	[0290.408] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x124229e8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x124229e8*=0x0, lpOverlapped=0x0) returned 1
	[0290.408] CloseHandle (hObject=0x17c) returned 1
	[0290.408] CloseHandle (hObject=0x178) returned 1
	[0290.408] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12426000*, nNumberOfCharsToWrite=0x83, lpNumberOfCharsWritten=0x124226ac, lpReserved=0x0 | out: lpBuffer=0x12426000*, lpNumberOfCharsWritten=0x124226ac*=0x83) returned 1
	[0290.451] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\SwyjcRMf2zHY2hAT\\MXbhihnZMc_3GTZt\\3gE yTqz1tP.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\swyjcrmf2zhy2hat\\mxbhihnzmc_3gtzt\\3ge ytqz1tp.jpg")) returned 1
	[0290.467] SetEvent (hEvent=0x14c) returned 1
	[0290.469] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0290.470] SetEvent (hEvent=0x14c) returned 1
	[0290.470] SetEvent (hEvent=0x104) returned 1
	[0290.470] SetEvent (hEvent=0x174) returned 1
	[0290.470] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.470] SetEvent (hEvent=0x174) returned 1
	[0290.492] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0290.493] SetEvent (hEvent=0x168) returned 1
	[0290.493] SetEvent (hEvent=0x174) returned 1
	[0290.496] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0290.496] SetEvent (hEvent=0x174) returned 1
	[0290.496] SetEvent (hEvent=0x104) returned 1
	[0290.496] SetEvent (hEvent=0x14c) returned 1
	[0290.496] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.497] SetEvent (hEvent=0x14c) returned 1
	[0290.498] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\SwyjcRMf2zHY2hAT\\MXbhihnZMc_3GTZt\\3gE yTqz1tP.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\swyjcrmf2zhy2hat\\mxbhihnzmc_3gtzt\\3ge ytqz1tp.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0290.499] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b08 | out: lpMode=0x12422b08) returned 0
	[0290.499] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422af8, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422af8*=0xfa000, lpOverlapped=0x0) returned 1
	[0290.519] CloseHandle (hObject=0x178) returned 1
	[0290.519] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\SwyjcRMf2zHY2hAT\\MXbhihnZMc_3GTZt\\3gE yTqz1tP.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\swyjcrmf2zhy2hat\\mxbhihnzmc_3gtzt\\3ge ytqz1tp.jpg")) returned 1
	[0290.524] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\SwyjcRMf2zHY2hAT\\MXbhihnZMc_3GTZt\\4uR-okZ_KnAWKkK.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\swyjcrmf2zhy2hat\\mxbhihnzmc_3gtzt\\4ur-okz_knawkkk.bmp"), fInfoLevelId=0x0, lpFileInformation=0x124a6198 | out: lpFileInformation=0x124a6198*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd885ac0, ftCreationTime.dwHighDateTime=0x1d824ff, ftLastAccessTime.dwLowDateTime=0x4394b600, ftLastAccessTime.dwHighDateTime=0x1d82761, ftLastWriteTime.dwLowDateTime=0x4394b600, ftLastWriteTime.dwHighDateTime=0x1d82761, nFileSizeHigh=0x0, nFileSizeLow=0x11aa5)) returned 1
	[0290.524] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\SwyjcRMf2zHY2hAT\\MXbhihnZMc_3GTZt\\4uR-okZ_KnAWKkK.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\swyjcrmf2zhy2hat\\mxbhihnzmc_3gtzt\\4ur-okz_knawkkk.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0290.525] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422a1c | out: lpMode=0x12422a1c) returned 0
	[0290.525] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\SwyjcRMf2zHY2hAT\\MXbhihnZMc_3GTZt\\4uR-okZ_KnAWKkK.bmp.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\swyjcrmf2zhy2hat\\mxbhihnzmc_3gtzt\\4ur-okz_knawkkk.bmp.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0290.525] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422a1c | out: lpMode=0x12422a1c) returned 0
	[0290.525] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc420 | out: pbBuffer=0x123cc420) returned 1
	[0290.525] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x12412200 | out: pbBuffer=0x12412200) returned 1
	[0290.525] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc181 | out: pbBuffer=0x123fc181) returned 1
	[0290.526] WriteFile (in: hFile=0x17c, lpBuffer=0x12537000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x124229f8, lpOverlapped=0x0 | out: lpBuffer=0x12537000*, lpNumberOfBytesWritten=0x124229f8*=0x80, lpOverlapped=0x0) returned 1
	[0290.529] SetEvent (hEvent=0x104) returned 1
	[0290.529] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x124229e8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x124229e8*=0x11aa5, lpOverlapped=0x0) returned 1
	[0290.531] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x11aa5, lpNumberOfBytesWritten=0x124229f4, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x124229f4*=0x11aa5, lpOverlapped=0x0) returned 1
	[0290.649] SetEvent (hEvent=0x168) returned 1
	[0290.649] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x124229e8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x124229e8*=0x0, lpOverlapped=0x0) returned 1
	[0290.649] CloseHandle (hObject=0x17c) returned 1
	[0290.650] CloseHandle (hObject=0x178) returned 1
	[0290.650] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1240e000*, nNumberOfCharsToWrite=0x87, lpNumberOfCharsWritten=0x124226ac, lpReserved=0x0 | out: lpBuffer=0x1240e000*, lpNumberOfCharsWritten=0x124226ac*=0x87) returned 1
	[0290.661] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\SwyjcRMf2zHY2hAT\\MXbhihnZMc_3GTZt\\4uR-okZ_KnAWKkK.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\swyjcrmf2zhy2hat\\mxbhihnzmc_3gtzt\\4ur-okz_knawkkk.bmp")) returned 1
	[0290.669] SetEvent (hEvent=0x124) returned 1
	[0290.670] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0290.670] SetEvent (hEvent=0x124) returned 1
	[0290.670] SetEvent (hEvent=0x104) returned 1
	[0290.670] SetEvent (hEvent=0x174) returned 1
	[0290.671] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.671] SetEvent (hEvent=0x174) returned 1
	[0290.693] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0290.694] SetEvent (hEvent=0x168) returned 1
	[0290.694] SetEvent (hEvent=0x174) returned 1
	[0290.696] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0290.697] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0290.697] SetEvent (hEvent=0x174) returned 1
	[0290.697] SetEvent (hEvent=0x104) returned 1
	[0290.697] SetEvent (hEvent=0x124) returned 1
	[0290.697] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.697] SetEvent (hEvent=0x124) returned 1
	[0290.698] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\SwyjcRMf2zHY2hAT\\MXbhihnZMc_3GTZt\\4uR-okZ_KnAWKkK.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\swyjcrmf2zhy2hat\\mxbhihnzmc_3gtzt\\4ur-okz_knawkkk.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0290.699] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b08 | out: lpMode=0x12422b08) returned 0
	[0290.699] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422af8, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422af8*=0xfa000, lpOverlapped=0x0) returned 1
	[0290.722] CloseHandle (hObject=0x178) returned 1
	[0290.722] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\SwyjcRMf2zHY2hAT\\MXbhihnZMc_3GTZt\\4uR-okZ_KnAWKkK.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\swyjcrmf2zhy2hat\\mxbhihnzmc_3gtzt\\4ur-okz_knawkkk.bmp")) returned 1
	[0290.726] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\SwyjcRMf2zHY2hAT\\MXbhihnZMc_3GTZt\\ENHF.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\swyjcrmf2zhy2hat\\mxbhihnzmc_3gtzt\\enhf.png"), fInfoLevelId=0x0, lpFileInformation=0x124a61e8 | out: lpFileInformation=0x124a61e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa53bf6c0, ftCreationTime.dwHighDateTime=0x1d8218f, ftLastAccessTime.dwLowDateTime=0xac218180, ftLastAccessTime.dwHighDateTime=0x1d829eb, ftLastWriteTime.dwLowDateTime=0xac218180, ftLastWriteTime.dwHighDateTime=0x1d829eb, nFileSizeHigh=0x0, nFileSizeLow=0x6959)) returned 1
	[0290.727] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\SwyjcRMf2zHY2hAT\\MXbhihnZMc_3GTZt\\ENHF.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\swyjcrmf2zhy2hat\\mxbhihnzmc_3gtzt\\enhf.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0290.727] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422a1c | out: lpMode=0x12422a1c) returned 0
	[0290.727] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\SwyjcRMf2zHY2hAT\\MXbhihnZMc_3GTZt\\ENHF.png.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\swyjcrmf2zhy2hat\\mxbhihnzmc_3gtzt\\enhf.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0290.727] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422a1c | out: lpMode=0x12422a1c) returned 0
	[0290.727] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc420 | out: pbBuffer=0x123cc420) returned 1
	[0290.727] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x12412200 | out: pbBuffer=0x12412200) returned 1
	[0290.727] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fd501 | out: pbBuffer=0x123fd501) returned 1
	[0290.728] WriteFile (in: hFile=0x17c, lpBuffer=0x1253b000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x124229f8, lpOverlapped=0x0 | out: lpBuffer=0x1253b000*, lpNumberOfBytesWritten=0x124229f8*=0x80, lpOverlapped=0x0) returned 1
	[0290.730] SetEvent (hEvent=0x104) returned 1
	[0290.730] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x124229e8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x124229e8*=0x6959, lpOverlapped=0x0) returned 1
	[0290.732] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x6959, lpNumberOfBytesWritten=0x124229f4, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x124229f4*=0x6959, lpOverlapped=0x0) returned 1
	[0290.787] SetEvent (hEvent=0x168) returned 1
	[0290.787] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x124229e8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x124229e8*=0x0, lpOverlapped=0x0) returned 1
	[0290.787] CloseHandle (hObject=0x17c) returned 1
	[0290.788] CloseHandle (hObject=0x178) returned 1
	[0290.788] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1240e000*, nNumberOfCharsToWrite=0x7c, lpNumberOfCharsWritten=0x124226ac, lpReserved=0x0 | out: lpBuffer=0x1240e000*, lpNumberOfCharsWritten=0x124226ac*=0x7c) returned 1
	[0290.806] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\SwyjcRMf2zHY2hAT\\MXbhihnZMc_3GTZt\\ENHF.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\swyjcrmf2zhy2hat\\mxbhihnzmc_3gtzt\\enhf.png")) returned 1
	[0290.815] SetEvent (hEvent=0x14c) returned 1
	[0290.816] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0290.820] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.820] SetEvent (hEvent=0x14c) returned 1
	[0290.820] SetEvent (hEvent=0x104) returned 1
	[0290.820] SetEvent (hEvent=0x174) returned 1
	[0290.820] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.821] SetEvent (hEvent=0x168) returned 1
	[0290.821] SetEvent (hEvent=0x174) returned 1
	[0290.845] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0290.846] SetEvent (hEvent=0x174) returned 1
	[0290.847] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0290.848] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0290.848] SetEvent (hEvent=0x174) returned 1
	[0290.848] SetEvent (hEvent=0x104) returned 1
	[0290.848] SetEvent (hEvent=0x14c) returned 1
	[0290.848] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.849] SetEvent (hEvent=0x14c) returned 1
	[0290.849] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\SwyjcRMf2zHY2hAT\\MXbhihnZMc_3GTZt\\ENHF.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\swyjcrmf2zhy2hat\\mxbhihnzmc_3gtzt\\enhf.png"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0290.850] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b08 | out: lpMode=0x12422b08) returned 0
	[0290.850] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422af8, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422af8*=0xfa000, lpOverlapped=0x0) returned 1
	[0290.871] CloseHandle (hObject=0x178) returned 1
	[0290.871] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\SwyjcRMf2zHY2hAT\\MXbhihnZMc_3GTZt\\ENHF.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\swyjcrmf2zhy2hat\\mxbhihnzmc_3gtzt\\enhf.png")) returned 1
	[0290.877] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\SwyjcRMf2zHY2hAT\\MXbhihnZMc_3GTZt\\zwl7b4WWRpJy.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\swyjcrmf2zhy2hat\\mxbhihnzmc_3gtzt\\zwl7b4wwrpjy.gif"), fInfoLevelId=0x0, lpFileInformation=0x124a6198 | out: lpFileInformation=0x124a6198*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x875acf90, ftCreationTime.dwHighDateTime=0x1d828ca, ftLastAccessTime.dwLowDateTime=0x31153bb0, ftLastAccessTime.dwHighDateTime=0x1d8292a, ftLastWriteTime.dwLowDateTime=0x31153bb0, ftLastWriteTime.dwHighDateTime=0x1d8292a, nFileSizeHigh=0x0, nFileSizeLow=0xfa5a)) returned 1
	[0290.877] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\SwyjcRMf2zHY2hAT\\MXbhihnZMc_3GTZt\\zwl7b4WWRpJy.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\swyjcrmf2zhy2hat\\mxbhihnzmc_3gtzt\\zwl7b4wwrpjy.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0290.877] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422a1c | out: lpMode=0x12422a1c) returned 0
	[0290.877] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\SwyjcRMf2zHY2hAT\\MXbhihnZMc_3GTZt\\zwl7b4WWRpJy.gif.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\swyjcrmf2zhy2hat\\mxbhihnzmc_3gtzt\\zwl7b4wwrpjy.gif.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0290.877] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422a1c | out: lpMode=0x12422a1c) returned 0
	[0290.877] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc420 | out: pbBuffer=0x123cc420) returned 1
	[0290.877] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x12412200 | out: pbBuffer=0x12412200) returned 1
	[0290.877] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fd581 | out: pbBuffer=0x123fd581) returned 1
	[0290.878] WriteFile (in: hFile=0x17c, lpBuffer=0x1253b000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x124229f8, lpOverlapped=0x0 | out: lpBuffer=0x1253b000*, lpNumberOfBytesWritten=0x124229f8*=0x80, lpOverlapped=0x0) returned 1
	[0290.880] SetEvent (hEvent=0x104) returned 1
	[0290.880] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x124229e8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x124229e8*=0xfa5a, lpOverlapped=0x0) returned 1
	[0290.883] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0xfa5a, lpNumberOfBytesWritten=0x124229f4, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x124229f4*=0xfa5a, lpOverlapped=0x0) returned 1
	[0290.903] SetEvent (hEvent=0x168) returned 1
	[0290.903] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x124229e8, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x124229e8*=0x0, lpOverlapped=0x0) returned 1
	[0290.903] CloseHandle (hObject=0x17c) returned 1
	[0290.903] CloseHandle (hObject=0x178) returned 1
	[0290.903] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1240e000*, nNumberOfCharsToWrite=0x84, lpNumberOfCharsWritten=0x124226ac, lpReserved=0x0 | out: lpBuffer=0x1240e000*, lpNumberOfCharsWritten=0x124226ac*=0x84) returned 1
	[0290.915] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\SwyjcRMf2zHY2hAT\\MXbhihnZMc_3GTZt\\zwl7b4WWRpJy.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\swyjcrmf2zhy2hat\\mxbhihnzmc_3gtzt\\zwl7b4wwrpjy.gif")) returned 1
	[0290.922] SetEvent (hEvent=0x124) returned 1
	[0290.923] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0290.925] SetEvent (hEvent=0x124) returned 1
	[0290.925] SetEvent (hEvent=0x104) returned 1
	[0290.925] SetEvent (hEvent=0x174) returned 1
	[0290.925] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.926] SetEvent (hEvent=0x168) returned 1
	[0290.926] SetEvent (hEvent=0x174) returned 1
	[0290.948] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0290.949] SetEvent (hEvent=0x174) returned 1
	[0290.951] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0290.951] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0290.951] SetEvent (hEvent=0x174) returned 1
	[0290.951] SetEvent (hEvent=0x104) returned 1
	[0290.951] SetEvent (hEvent=0x124) returned 1
	[0290.951] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.952] SetEvent (hEvent=0x124) returned 1
	[0290.952] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\SwyjcRMf2zHY2hAT\\MXbhihnZMc_3GTZt\\zwl7b4WWRpJy.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\swyjcrmf2zhy2hat\\mxbhihnzmc_3gtzt\\zwl7b4wwrpjy.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0290.954] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b08 | out: lpMode=0x12422b08) returned 0
	[0290.954] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422af8, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422af8*=0xfa000, lpOverlapped=0x0) returned 1
	[0290.975] CloseHandle (hObject=0x178) returned 1
	[0290.976] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\SwyjcRMf2zHY2hAT\\MXbhihnZMc_3GTZt\\zwl7b4WWRpJy.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\swyjcrmf2zhy2hat\\mxbhihnzmc_3gtzt\\zwl7b4wwrpjy.gif")) returned 1
	[0290.981] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\ZTQJHTAJ0x.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\ztqjhtaj0x.png"), fInfoLevelId=0x0, lpFileInformation=0x124a61e8 | out: lpFileInformation=0x124a61e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ac2e2f0, ftCreationTime.dwHighDateTime=0x1d8209d, ftLastAccessTime.dwLowDateTime=0xd8a8b0, ftLastAccessTime.dwHighDateTime=0x1d82614, ftLastWriteTime.dwLowDateTime=0xd8a8b0, ftLastWriteTime.dwHighDateTime=0x1d82614, nFileSizeHigh=0x0, nFileSizeLow=0x35d0)) returned 1
	[0290.981] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\ZTQJHTAJ0x.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\ztqjhtaj0x.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0290.981] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422ae4 | out: lpMode=0x12422ae4) returned 0
	[0290.982] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\ZTQJHTAJ0x.png.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\ztqjhtaj0x.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0290.982] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422ae4 | out: lpMode=0x12422ae4) returned 0
	[0290.982] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc420 | out: pbBuffer=0x123cc420) returned 1
	[0290.982] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x12412200 | out: pbBuffer=0x12412200) returned 1
	[0290.982] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc181 | out: pbBuffer=0x123fc181) returned 1
	[0290.982] WriteFile (in: hFile=0x17c, lpBuffer=0x1253d000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422ac0, lpOverlapped=0x0 | out: lpBuffer=0x1253d000*, lpNumberOfBytesWritten=0x12422ac0*=0x80, lpOverlapped=0x0) returned 1
	[0290.985] SetEvent (hEvent=0x104) returned 1
	[0290.985] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422ab0, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422ab0*=0x35d0, lpOverlapped=0x0) returned 1
	[0290.986] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x35d0, lpNumberOfBytesWritten=0x12422abc, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422abc*=0x35d0, lpOverlapped=0x0) returned 1
	[0291.062] SetEvent (hEvent=0x168) returned 1
	[0291.062] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422ab0, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422ab0*=0x0, lpOverlapped=0x0) returned 1
	[0291.062] CloseHandle (hObject=0x17c) returned 1
	[0291.063] CloseHandle (hObject=0x178) returned 1
	[0291.063] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x127de000*, nNumberOfCharsToWrite=0x60, lpNumberOfCharsWritten=0x12422774, lpReserved=0x0 | out: lpBuffer=0x127de000*, lpNumberOfCharsWritten=0x12422774*=0x60) returned 1
	[0291.074] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\ZTQJHTAJ0x.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\ztqjhtaj0x.png")) returned 1
	[0291.080] SetEvent (hEvent=0x14c) returned 1
	[0291.081] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0291.083] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.083] SetEvent (hEvent=0x14c) returned 1
	[0291.083] SetEvent (hEvent=0x104) returned 1
	[0291.083] SetEvent (hEvent=0x174) returned 1
	[0291.083] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.084] SetEvent (hEvent=0x174) returned 1
	[0291.107] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0291.108] SetEvent (hEvent=0x168) returned 1
	[0291.108] SetEvent (hEvent=0x174) returned 1
	[0291.110] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0291.111] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0291.111] SetEvent (hEvent=0x174) returned 1
	[0291.111] SetEvent (hEvent=0x104) returned 1
	[0291.111] SetEvent (hEvent=0x14c) returned 1
	[0291.111] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.112] SetEvent (hEvent=0x14c) returned 1
	[0291.112] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\ZTQJHTAJ0x.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\ztqjhtaj0x.png"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0291.113] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bd0 | out: lpMode=0x12422bd0) returned 0
	[0291.113] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422bc0, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422bc0*=0xfa000, lpOverlapped=0x0) returned 1
	[0291.135] CloseHandle (hObject=0x178) returned 1
	[0291.135] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\ZTQJHTAJ0x.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\ztqjhtaj0x.png")) returned 1
	[0291.141] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-"), fInfoLevelId=0x0, lpFileInformation=0x124a60f8 | out: lpFileInformation=0x124a60f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd44fcff0, ftCreationTime.dwHighDateTime=0x1d81d4c, ftLastAccessTime.dwLowDateTime=0xac420490, ftLastAccessTime.dwHighDateTime=0x1d82587, ftLastWriteTime.dwLowDateTime=0xac420490, ftLastWriteTime.dwHighDateTime=0x1d82587, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1
	[0291.141] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0291.141] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd44fcff0, ftCreationTime.dwHighDateTime=0x1d81d4c, ftLastAccessTime.dwLowDateTime=0xac420490, ftLastAccessTime.dwHighDateTime=0x1d82587, ftLastWriteTime.dwLowDateTime=0xac420490, ftLastWriteTime.dwHighDateTime=0x1d82587, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fa68
	[0291.141] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd44fcff0, ftCreationTime.dwHighDateTime=0x1d81d4c, ftLastAccessTime.dwLowDateTime=0xac420490, ftLastAccessTime.dwHighDateTime=0x1d82587, ftLastWriteTime.dwLowDateTime=0xac420490, ftLastWriteTime.dwHighDateTime=0x1d82587, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0291.141] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85dbe1c0, ftCreationTime.dwHighDateTime=0x1d81ff8, ftLastAccessTime.dwLowDateTime=0xf727c110, ftLastAccessTime.dwHighDateTime=0x1d82169, ftLastWriteTime.dwLowDateTime=0xf727c110, ftLastWriteTime.dwHighDateTime=0x1d82169, nFileSizeHigh=0x0, nFileSizeLow=0x10324, dwReserved0=0x0, dwReserved1=0x0, cFileName="3t7gHBCqGn34DT.bmp", cAlternateFileName="3T7GHB~1.BMP")) returned 1
	[0291.141] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37158040, ftCreationTime.dwHighDateTime=0x1d82a17, ftLastAccessTime.dwLowDateTime=0xc5b8b2e0, ftLastAccessTime.dwHighDateTime=0x1d82a17, ftLastWriteTime.dwLowDateTime=0xc5b8b2e0, ftLastWriteTime.dwHighDateTime=0x1d82a17, nFileSizeHigh=0x0, nFileSizeLow=0xcb76, dwReserved0=0x0, dwReserved1=0x0, cFileName="DHnVuHi QU.png", cAlternateFileName="DHNVUH~1.PNG")) returned 1
	[0291.141] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2cfb330, ftCreationTime.dwHighDateTime=0x1d82046, ftLastAccessTime.dwLowDateTime=0xa6787a70, ftLastAccessTime.dwHighDateTime=0x1d82047, ftLastWriteTime.dwLowDateTime=0xa6787a70, ftLastWriteTime.dwHighDateTime=0x1d82047, nFileSizeHigh=0x0, nFileSizeLow=0x7b0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="G_QDMHXRVlH4LOw.gif", cAlternateFileName="G_QDMH~1.GIF")) returned 1
	[0291.142] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78cb49e0, ftCreationTime.dwHighDateTime=0x1d8244d, ftLastAccessTime.dwLowDateTime=0x9563010, ftLastAccessTime.dwHighDateTime=0x1d82642, ftLastWriteTime.dwLowDateTime=0x9563010, ftLastWriteTime.dwHighDateTime=0x1d82642, nFileSizeHigh=0x0, nFileSizeLow=0x2557, dwReserved0=0x0, dwReserved1=0x0, cFileName="NPZDGEhorjDHWlG0.jpg", cAlternateFileName="NPZDGE~1.JPG")) returned 1
	[0291.142] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30828350, ftCreationTime.dwHighDateTime=0x1d821b0, ftLastAccessTime.dwLowDateTime=0xb29cde00, ftLastAccessTime.dwHighDateTime=0x1d82a1e, ftLastWriteTime.dwLowDateTime=0xb29cde00, ftLastWriteTime.dwHighDateTime=0x1d82a1e, nFileSizeHigh=0x0, nFileSizeLow=0xea78, dwReserved0=0x0, dwReserved1=0x0, cFileName="pTxoaLKfud6Leg05GX_k.png", cAlternateFileName="PTXOAL~1.PNG")) returned 1
	[0291.142] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba21dec0, ftCreationTime.dwHighDateTime=0x1d8203f, ftLastAccessTime.dwLowDateTime=0xe4a17ee0, ftLastAccessTime.dwHighDateTime=0x1d827e6, ftLastWriteTime.dwLowDateTime=0xe4a17ee0, ftLastWriteTime.dwHighDateTime=0x1d827e6, nFileSizeHigh=0x0, nFileSizeLow=0x4a04, dwReserved0=0x0, dwReserved1=0x0, cFileName="rsVKOpgEcVvbWZPED.png", cAlternateFileName="RSVKOP~1.PNG")) returned 1
	[0291.142] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd28328e0, ftCreationTime.dwHighDateTime=0x1d826a5, ftLastAccessTime.dwLowDateTime=0xc7e36e00, ftLastAccessTime.dwHighDateTime=0x1d82799, ftLastWriteTime.dwLowDateTime=0xc7e36e00, ftLastWriteTime.dwHighDateTime=0x1d82799, nFileSizeHigh=0x0, nFileSizeLow=0x7367, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUjBm.png", cAlternateFileName="")) returned 1
	[0291.142] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x559d8970, ftCreationTime.dwHighDateTime=0x1d82587, ftLastAccessTime.dwLowDateTime=0x846106d0, ftLastAccessTime.dwHighDateTime=0x1d82675, ftLastWriteTime.dwLowDateTime=0x846106d0, ftLastWriteTime.dwHighDateTime=0x1d82675, nFileSizeHigh=0x0, nFileSizeLow=0x169ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZKYSX3tFn1Sk.gif", cAlternateFileName="ZKYSX3~1.GIF")) returned 1
	[0291.142] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef2d7c20, ftCreationTime.dwHighDateTime=0x1d8271d, ftLastAccessTime.dwLowDateTime=0x64378e30, ftLastAccessTime.dwHighDateTime=0x1d8288a, ftLastWriteTime.dwLowDateTime=0x64378e30, ftLastWriteTime.dwHighDateTime=0x1d8288a, nFileSizeHigh=0x0, nFileSizeLow=0x6154, dwReserved0=0x0, dwReserved1=0x0, cFileName="zwxsnUmdvyouw8jV0n.jpg", cAlternateFileName="ZWXSNU~1.JPG")) returned 1
	[0291.142] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0291.142] FindClose (in: hFindFile=0x79fa68 | out: hFindFile=0x79fa68) returned 1
	[0291.142] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0291.143] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c04 | out: lpMode=0x12422c04) returned 0
	[0291.143] WriteFile (in: hFile=0x178, lpBuffer=0x12694000*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422bf4, lpOverlapped=0x0 | out: lpBuffer=0x12694000*, lpNumberOfBytesWritten=0x12422bf4*=0xc85, lpOverlapped=0x0) returned 1
	[0291.144] CloseHandle (hObject=0x178) returned 1
	[0291.145] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12536000*, nNumberOfCharsToWrite=0x6e, lpNumberOfCharsWritten=0x12422784, lpReserved=0x0 | out: lpBuffer=0x12536000*, lpNumberOfCharsWritten=0x12422784*=0x6e) returned 1
	[0291.156] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\3t7gHBCqGn34DT.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\3t7ghbcqgn34dt.bmp"), fInfoLevelId=0x0, lpFileInformation=0x124a6508 | out: lpFileInformation=0x124a6508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85dbe1c0, ftCreationTime.dwHighDateTime=0x1d81ff8, ftLastAccessTime.dwLowDateTime=0xf727c110, ftLastAccessTime.dwHighDateTime=0x1d82169, ftLastWriteTime.dwLowDateTime=0xf727c110, ftLastWriteTime.dwHighDateTime=0x1d82169, nFileSizeHigh=0x0, nFileSizeLow=0x10324)) returned 1
	[0291.156] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\3t7gHBCqGn34DT.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\3t7ghbcqgn34dt.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0291.156] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0291.156] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\3t7gHBCqGn34DT.bmp.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\3t7ghbcqgn34dt.bmp.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0291.157] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0291.157] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc4c0 | out: pbBuffer=0x123cc4c0) returned 1
	[0291.157] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x12412330 | out: pbBuffer=0x12412330) returned 1
	[0291.157] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc081 | out: pbBuffer=0x123fc081) returned 1
	[0291.157] WriteFile (in: hFile=0x17c, lpBuffer=0x1250b000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422a5c, lpOverlapped=0x0 | out: lpBuffer=0x1250b000*, lpNumberOfBytesWritten=0x12422a5c*=0x80, lpOverlapped=0x0) returned 1
	[0291.159] SetEvent (hEvent=0x104) returned 1
	[0291.160] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422a4c*=0x10324, lpOverlapped=0x0) returned 1
	[0291.162] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x10324, lpNumberOfBytesWritten=0x12422a58, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422a58*=0x10324, lpOverlapped=0x0) returned 1
	[0291.165] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422a4c*=0x0, lpOverlapped=0x0) returned 1
	[0291.165] CloseHandle (hObject=0x17c) returned 1
	[0291.165] CloseHandle (hObject=0x178) returned 1
	[0291.166] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1250c000*, nNumberOfCharsToWrite=0x6b, lpNumberOfCharsWritten=0x12422710, lpReserved=0x0 | out: lpBuffer=0x1250c000*, lpNumberOfCharsWritten=0x12422710*=0x6b) returned 1
	[0291.181] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.182] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\3t7gHBCqGn34DT.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\3t7ghbcqgn34dt.bmp")) returned 1
	[0291.192] SetEvent (hEvent=0x104) returned 1
	[0291.193] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0291.195] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.195] SetEvent (hEvent=0x104) returned 1
	[0291.195] SetEvent (hEvent=0x124) returned 1
	[0291.195] SetEvent (hEvent=0x174) returned 1
	[0291.195] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.195] SetEvent (hEvent=0x174) returned 1
	[0291.245] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0291.260] SetEvent (hEvent=0x168) returned 1
	[0291.260] SetEvent (hEvent=0x174) returned 1
	[0291.262] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0291.264] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.264] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0291.264] SetEvent (hEvent=0x174) returned 1
	[0291.264] SetEvent (hEvent=0x124) returned 1
	[0291.264] SetEvent (hEvent=0x104) returned 1
	[0291.264] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.264] SetEvent (hEvent=0x104) returned 1
	[0291.265] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\3t7gHBCqGn34DT.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\3t7ghbcqgn34dt.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0291.266] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b6c | out: lpMode=0x12422b6c) returned 0
	[0291.266] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422b5c, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422b5c*=0xfa000, lpOverlapped=0x0) returned 1
	[0291.285] CloseHandle (hObject=0x178) returned 1
	[0291.286] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\3t7gHBCqGn34DT.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\3t7ghbcqgn34dt.bmp")) returned 1
	[0291.291] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\DHnVuHi QU.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\dhnvuhi qu.png"), fInfoLevelId=0x0, lpFileInformation=0x124a6148 | out: lpFileInformation=0x124a6148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37158040, ftCreationTime.dwHighDateTime=0x1d82a17, ftLastAccessTime.dwLowDateTime=0xc5b8b2e0, ftLastAccessTime.dwHighDateTime=0x1d82a17, ftLastWriteTime.dwLowDateTime=0xc5b8b2e0, ftLastWriteTime.dwHighDateTime=0x1d82a17, nFileSizeHigh=0x0, nFileSizeLow=0xcb76)) returned 1
	[0291.292] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\DHnVuHi QU.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\dhnvuhi qu.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0291.292] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0291.292] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\DHnVuHi QU.png.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\dhnvuhi qu.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0291.292] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0291.292] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc480 | out: pbBuffer=0x123cc480) returned 1
	[0291.292] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c130 | out: pbBuffer=0x1251c130) returned 1
	[0291.292] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc081 | out: pbBuffer=0x123fc081) returned 1
	[0291.293] WriteFile (in: hFile=0x17c, lpBuffer=0x1253b000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422a5c, lpOverlapped=0x0 | out: lpBuffer=0x1253b000*, lpNumberOfBytesWritten=0x12422a5c*=0x80, lpOverlapped=0x0) returned 1
	[0291.295] SetEvent (hEvent=0x124) returned 1
	[0291.295] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422a4c*=0xcb76, lpOverlapped=0x0) returned 1
	[0291.297] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0xcb76, lpNumberOfBytesWritten=0x12422a58, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422a58*=0xcb76, lpOverlapped=0x0) returned 1
	[0291.300] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422a4c*=0x0, lpOverlapped=0x0) returned 1
	[0291.300] CloseHandle (hObject=0x17c) returned 1
	[0291.300] CloseHandle (hObject=0x178) returned 1
	[0291.300] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1253c000*, nNumberOfCharsToWrite=0x67, lpNumberOfCharsWritten=0x12422710, lpReserved=0x0 | out: lpBuffer=0x1253c000*, lpNumberOfCharsWritten=0x12422710*=0x67) returned 1
	[0291.312] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.313] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\DHnVuHi QU.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\dhnvuhi qu.png")) returned 1
	[0291.320] SetEvent (hEvent=0x124) returned 1
	[0291.324] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0291.325] SetEvent (hEvent=0x124) returned 1
	[0291.325] SetEvent (hEvent=0x14c) returned 1
	[0291.325] SetEvent (hEvent=0x174) returned 1
	[0291.325] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.325] SetEvent (hEvent=0x174) returned 1
	[0291.348] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0291.348] SetEvent (hEvent=0x168) returned 1
	[0291.348] SetEvent (hEvent=0x174) returned 1
	[0291.351] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0291.351] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0291.351] SetEvent (hEvent=0x174) returned 1
	[0291.351] SetEvent (hEvent=0x14c) returned 1
	[0291.351] SetEvent (hEvent=0x124) returned 1
	[0291.351] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.352] SetEvent (hEvent=0x124) returned 1
	[0291.352] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\DHnVuHi QU.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\dhnvuhi qu.png"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0291.353] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b6c | out: lpMode=0x12422b6c) returned 0
	[0291.354] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422b5c, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422b5c*=0xfa000, lpOverlapped=0x0) returned 1
	[0291.372] CloseHandle (hObject=0x178) returned 1
	[0291.372] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\DHnVuHi QU.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\dhnvuhi qu.png")) returned 1
	[0291.377] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\G_QDMHXRVlH4LOw.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\g_qdmhxrvlh4low.gif"), fInfoLevelId=0x0, lpFileInformation=0x124a6198 | out: lpFileInformation=0x124a6198*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2cfb330, ftCreationTime.dwHighDateTime=0x1d82046, ftLastAccessTime.dwLowDateTime=0xa6787a70, ftLastAccessTime.dwHighDateTime=0x1d82047, ftLastWriteTime.dwLowDateTime=0xa6787a70, ftLastWriteTime.dwHighDateTime=0x1d82047, nFileSizeHigh=0x0, nFileSizeLow=0x7b0f)) returned 1
	[0291.378] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\G_QDMHXRVlH4LOw.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\g_qdmhxrvlh4low.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0291.378] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0291.378] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\G_QDMHXRVlH4LOw.gif.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\g_qdmhxrvlh4low.gif.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0291.378] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0291.378] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc480 | out: pbBuffer=0x123cc480) returned 1
	[0291.378] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x12412200 | out: pbBuffer=0x12412200) returned 1
	[0291.378] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc081 | out: pbBuffer=0x123fc081) returned 1
	[0291.378] WriteFile (in: hFile=0x17c, lpBuffer=0x1253b000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422a5c, lpOverlapped=0x0 | out: lpBuffer=0x1253b000*, lpNumberOfBytesWritten=0x12422a5c*=0x80, lpOverlapped=0x0) returned 1
	[0291.381] SetEvent (hEvent=0x14c) returned 1
	[0291.381] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422a4c*=0x7b0f, lpOverlapped=0x0) returned 1
	[0291.383] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x7b0f, lpNumberOfBytesWritten=0x12422a58, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422a58*=0x7b0f, lpOverlapped=0x0) returned 1
	[0291.385] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422a4c*=0x0, lpOverlapped=0x0) returned 1
	[0291.385] CloseHandle (hObject=0x17c) returned 1
	[0291.386] CloseHandle (hObject=0x178) returned 1
	[0291.386] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1253c000*, nNumberOfCharsToWrite=0x6c, lpNumberOfCharsWritten=0x12422710, lpReserved=0x0 | out: lpBuffer=0x1253c000*, lpNumberOfCharsWritten=0x12422710*=0x6c) returned 1
	[0291.397] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.398] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\G_QDMHXRVlH4LOw.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\g_qdmhxrvlh4low.gif")) returned 1
	[0291.407] SetEvent (hEvent=0x14c) returned 1
	[0291.408] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0291.408] SetEvent (hEvent=0x14c) returned 1
	[0291.408] SetEvent (hEvent=0x104) returned 1
	[0291.409] SetEvent (hEvent=0x174) returned 1
	[0291.409] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.457] SetEvent (hEvent=0x168) returned 1
	[0291.457] SetEvent (hEvent=0x174) returned 1
	[0291.486] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0291.487] SetEvent (hEvent=0x174) returned 1
	[0291.488] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0291.489] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0291.489] SetEvent (hEvent=0x174) returned 1
	[0291.489] SetEvent (hEvent=0x104) returned 1
	[0291.489] SetEvent (hEvent=0x14c) returned 1
	[0291.489] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.490] SetEvent (hEvent=0x168) returned 1
	[0291.490] SetEvent (hEvent=0x14c) returned 1
	[0291.491] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\G_QDMHXRVlH4LOw.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\g_qdmhxrvlh4low.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0291.492] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b6c | out: lpMode=0x12422b6c) returned 0
	[0291.492] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422b5c, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422b5c*=0xfa000, lpOverlapped=0x0) returned 1
	[0291.515] CloseHandle (hObject=0x178) returned 1
	[0291.516] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\G_QDMHXRVlH4LOw.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\g_qdmhxrvlh4low.gif")) returned 1
	[0291.523] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\NPZDGEhorjDHWlG0.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\npzdgehorjdhwlg0.jpg"), fInfoLevelId=0x0, lpFileInformation=0x124a6148 | out: lpFileInformation=0x124a6148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78cb49e0, ftCreationTime.dwHighDateTime=0x1d8244d, ftLastAccessTime.dwLowDateTime=0x9563010, ftLastAccessTime.dwHighDateTime=0x1d82642, ftLastWriteTime.dwLowDateTime=0x9563010, ftLastWriteTime.dwHighDateTime=0x1d82642, nFileSizeHigh=0x0, nFileSizeLow=0x2557)) returned 1
	[0291.523] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\NPZDGEhorjDHWlG0.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\npzdgehorjdhwlg0.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0291.523] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0291.523] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\NPZDGEhorjDHWlG0.jpg.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\npzdgehorjdhwlg0.jpg.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0291.526] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0291.527] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc480 | out: pbBuffer=0x123cc480) returned 1
	[0291.527] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c130 | out: pbBuffer=0x1251c130) returned 1
	[0291.527] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc081 | out: pbBuffer=0x123fc081) returned 1
	[0291.527] WriteFile (in: hFile=0x17c, lpBuffer=0x1253b000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422a5c, lpOverlapped=0x0 | out: lpBuffer=0x1253b000*, lpNumberOfBytesWritten=0x12422a5c*=0x80, lpOverlapped=0x0) returned 1
	[0291.531] SetEvent (hEvent=0x104) returned 1
	[0291.531] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422a4c*=0x2557, lpOverlapped=0x0) returned 1
	[0291.533] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x2557, lpNumberOfBytesWritten=0x12422a58, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422a58*=0x2557, lpOverlapped=0x0) returned 1
	[0291.535] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422a4c*=0x0, lpOverlapped=0x0) returned 1
	[0291.535] CloseHandle (hObject=0x17c) returned 1
	[0291.536] CloseHandle (hObject=0x178) returned 1
	[0291.536] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1253c000*, nNumberOfCharsToWrite=0x6d, lpNumberOfCharsWritten=0x12422710, lpReserved=0x0 | out: lpBuffer=0x1253c000*, lpNumberOfCharsWritten=0x12422710*=0x6d) returned 1
	[0291.548] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.552] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\NPZDGEhorjDHWlG0.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\npzdgehorjdhwlg0.jpg")) returned 1
	[0291.558] SetEvent (hEvent=0x104) returned 1
	[0291.559] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0291.560] SetEvent (hEvent=0x104) returned 1
	[0291.560] SetEvent (hEvent=0x124) returned 1
	[0291.560] SetEvent (hEvent=0x174) returned 1
	[0291.560] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.563] SetEvent (hEvent=0x168) returned 1
	[0291.564] SetEvent (hEvent=0x174) returned 1
	[0291.584] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0291.586] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.586] SetEvent (hEvent=0x174) returned 1
	[0291.588] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0291.589] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0291.589] SetEvent (hEvent=0x174) returned 1
	[0291.589] SetEvent (hEvent=0x124) returned 1
	[0291.589] SetEvent (hEvent=0x104) returned 1
	[0291.589] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.589] SetEvent (hEvent=0x104) returned 1
	[0291.590] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\NPZDGEhorjDHWlG0.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\npzdgehorjdhwlg0.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0291.591] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b6c | out: lpMode=0x12422b6c) returned 0
	[0291.591] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422b5c, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422b5c*=0xfa000, lpOverlapped=0x0) returned 1
	[0291.609] CloseHandle (hObject=0x178) returned 1
	[0291.610] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\NPZDGEhorjDHWlG0.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\npzdgehorjdhwlg0.jpg")) returned 1
	[0291.615] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\SUjBm.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\sujbm.png"), fInfoLevelId=0x0, lpFileInformation=0x124a6198 | out: lpFileInformation=0x124a6198*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd28328e0, ftCreationTime.dwHighDateTime=0x1d826a5, ftLastAccessTime.dwLowDateTime=0xc7e36e00, ftLastAccessTime.dwHighDateTime=0x1d82799, ftLastWriteTime.dwLowDateTime=0xc7e36e00, ftLastWriteTime.dwHighDateTime=0x1d82799, nFileSizeHigh=0x0, nFileSizeLow=0x7367)) returned 1
	[0291.615] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\SUjBm.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\sujbm.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0291.615] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0291.615] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\SUjBm.png.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\sujbm.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0291.616] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0291.616] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc480 | out: pbBuffer=0x123cc480) returned 1
	[0291.616] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x12412200 | out: pbBuffer=0x12412200) returned 1
	[0291.616] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc081 | out: pbBuffer=0x123fc081) returned 1
	[0291.616] WriteFile (in: hFile=0x17c, lpBuffer=0x1253f000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422a5c, lpOverlapped=0x0 | out: lpBuffer=0x1253f000*, lpNumberOfBytesWritten=0x12422a5c*=0x80, lpOverlapped=0x0) returned 1
	[0291.618] SetEvent (hEvent=0x124) returned 1
	[0291.618] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422a4c*=0x7367, lpOverlapped=0x0) returned 1
	[0291.620] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x7367, lpNumberOfBytesWritten=0x12422a58, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422a58*=0x7367, lpOverlapped=0x0) returned 1
	[0291.622] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422a4c*=0x0, lpOverlapped=0x0) returned 1
	[0291.622] CloseHandle (hObject=0x17c) returned 1
	[0291.623] CloseHandle (hObject=0x178) returned 1
	[0291.623] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x125ce000*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x12422710, lpReserved=0x0 | out: lpBuffer=0x125ce000*, lpNumberOfCharsWritten=0x12422710*=0x62) returned 1
	[0291.633] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.635] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\SUjBm.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\sujbm.png")) returned 1
	[0291.644] SetEvent (hEvent=0x124) returned 1
	[0291.645] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0291.647] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.647] SetEvent (hEvent=0x124) returned 1
	[0291.647] SetEvent (hEvent=0x14c) returned 1
	[0291.647] SetEvent (hEvent=0x174) returned 1
	[0291.647] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.647] SetEvent (hEvent=0x168) returned 1
	[0291.647] SetEvent (hEvent=0x174) returned 1
	[0291.669] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0291.669] SetEvent (hEvent=0x174) returned 1
	[0291.671] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0291.671] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0291.672] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.672] SetEvent (hEvent=0x174) returned 1
	[0291.672] SetEvent (hEvent=0x14c) returned 1
	[0291.672] SetEvent (hEvent=0x124) returned 1
	[0291.672] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.673] SetEvent (hEvent=0x168) returned 1
	[0291.673] SetEvent (hEvent=0x124) returned 1
	[0291.673] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\SUjBm.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\sujbm.png"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0291.674] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b6c | out: lpMode=0x12422b6c) returned 0
	[0291.675] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422b5c, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422b5c*=0xfa000, lpOverlapped=0x0) returned 1
	[0291.693] CloseHandle (hObject=0x178) returned 1
	[0291.693] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\SUjBm.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\sujbm.png")) returned 1
	[0291.698] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\ZKYSX3tFn1Sk.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\zkysx3tfn1sk.gif"), fInfoLevelId=0x0, lpFileInformation=0x124a6148 | out: lpFileInformation=0x124a6148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x559d8970, ftCreationTime.dwHighDateTime=0x1d82587, ftLastAccessTime.dwLowDateTime=0x846106d0, ftLastAccessTime.dwHighDateTime=0x1d82675, ftLastWriteTime.dwLowDateTime=0x846106d0, ftLastWriteTime.dwHighDateTime=0x1d82675, nFileSizeHigh=0x0, nFileSizeLow=0x169ca)) returned 1
	[0291.698] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\ZKYSX3tFn1Sk.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\zkysx3tfn1sk.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0291.698] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0291.698] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\ZKYSX3tFn1Sk.gif.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\zkysx3tfn1sk.gif.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0291.699] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0291.699] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc480 | out: pbBuffer=0x123cc480) returned 1
	[0291.699] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c130 | out: pbBuffer=0x1251c130) returned 1
	[0291.699] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc081 | out: pbBuffer=0x123fc081) returned 1
	[0291.699] WriteFile (in: hFile=0x17c, lpBuffer=0x1253f000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422a5c, lpOverlapped=0x0 | out: lpBuffer=0x1253f000*, lpNumberOfBytesWritten=0x12422a5c*=0x80, lpOverlapped=0x0) returned 1
	[0291.712] SetEvent (hEvent=0x14c) returned 1
	[0291.713] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422a4c*=0x169ca, lpOverlapped=0x0) returned 1
	[0291.718] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x169ca, lpNumberOfBytesWritten=0x12422a58, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422a58*=0x169ca, lpOverlapped=0x0) returned 1
	[0291.726] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422a4c*=0x0, lpOverlapped=0x0) returned 1
	[0291.726] CloseHandle (hObject=0x17c) returned 1
	[0291.727] CloseHandle (hObject=0x178) returned 1
	[0291.727] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12506000*, nNumberOfCharsToWrite=0x69, lpNumberOfCharsWritten=0x12422710, lpReserved=0x0 | out: lpBuffer=0x12506000*, lpNumberOfCharsWritten=0x12422710*=0x69) returned 1
	[0291.741] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.745] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\ZKYSX3tFn1Sk.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\zkysx3tfn1sk.gif")) returned 1
	[0291.752] SetEvent (hEvent=0x14c) returned 1
	[0291.753] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0291.755] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.755] SetEvent (hEvent=0x14c) returned 1
	[0291.755] SetEvent (hEvent=0x104) returned 1
	[0291.755] SetEvent (hEvent=0x174) returned 1
	[0291.755] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.755] SetEvent (hEvent=0x174) returned 1
	[0291.781] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0291.782] SetEvent (hEvent=0x168) returned 1
	[0291.782] SetEvent (hEvent=0x174) returned 1
	[0291.784] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0291.785] SetEvent (hEvent=0x174) returned 1
	[0291.785] SetEvent (hEvent=0x104) returned 1
	[0291.785] SetEvent (hEvent=0x14c) returned 1
	[0291.785] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.785] SetEvent (hEvent=0x14c) returned 1
	[0291.786] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\ZKYSX3tFn1Sk.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\zkysx3tfn1sk.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0291.787] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b6c | out: lpMode=0x12422b6c) returned 0
	[0291.788] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422b5c, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422b5c*=0xfa000, lpOverlapped=0x0) returned 1
	[0291.807] CloseHandle (hObject=0x178) returned 1
	[0291.807] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\ZKYSX3tFn1Sk.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\zkysx3tfn1sk.gif")) returned 1
	[0291.811] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\pTxoaLKfud6Leg05GX_k.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\ptxoalkfud6leg05gx_k.png"), fInfoLevelId=0x0, lpFileInformation=0x124a6198 | out: lpFileInformation=0x124a6198*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30828350, ftCreationTime.dwHighDateTime=0x1d821b0, ftLastAccessTime.dwLowDateTime=0xb29cde00, ftLastAccessTime.dwHighDateTime=0x1d82a1e, ftLastWriteTime.dwLowDateTime=0xb29cde00, ftLastWriteTime.dwHighDateTime=0x1d82a1e, nFileSizeHigh=0x0, nFileSizeLow=0xea78)) returned 1
	[0291.811] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\pTxoaLKfud6Leg05GX_k.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\ptxoalkfud6leg05gx_k.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0291.812] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0291.812] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\pTxoaLKfud6Leg05GX_k.png.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\ptxoalkfud6leg05gx_k.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0291.813] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0291.813] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc480 | out: pbBuffer=0x123cc480) returned 1
	[0291.813] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x12412200 | out: pbBuffer=0x12412200) returned 1
	[0291.813] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc181 | out: pbBuffer=0x123fc181) returned 1
	[0291.813] WriteFile (in: hFile=0x17c, lpBuffer=0x1253b000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422a5c, lpOverlapped=0x0 | out: lpBuffer=0x1253b000*, lpNumberOfBytesWritten=0x12422a5c*=0x80, lpOverlapped=0x0) returned 1
	[0291.815] SetEvent (hEvent=0x104) returned 1
	[0291.816] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422a4c*=0xea78, lpOverlapped=0x0) returned 1
	[0291.818] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0xea78, lpNumberOfBytesWritten=0x12422a58, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422a58*=0xea78, lpOverlapped=0x0) returned 1
	[0291.821] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422a4c*=0x0, lpOverlapped=0x0) returned 1
	[0291.821] CloseHandle (hObject=0x17c) returned 1
	[0291.822] CloseHandle (hObject=0x178) returned 1
	[0291.822] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x125ce000*, nNumberOfCharsToWrite=0x71, lpNumberOfCharsWritten=0x12422710, lpReserved=0x0 | out: lpBuffer=0x125ce000*, lpNumberOfCharsWritten=0x12422710*=0x71) returned 1
	[0291.832] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.835] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\pTxoaLKfud6Leg05GX_k.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\ptxoalkfud6leg05gx_k.png")) returned 1
	[0291.842] SetEvent (hEvent=0x104) returned 1
	[0291.843] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0291.843] SetEvent (hEvent=0x104) returned 1
	[0291.843] SetEvent (hEvent=0x124) returned 1
	[0291.843] SetEvent (hEvent=0x174) returned 1
	[0291.843] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.844] SetEvent (hEvent=0x174) returned 1
	[0291.880] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0291.881] SetEvent (hEvent=0x168) returned 1
	[0291.881] SetEvent (hEvent=0x174) returned 1
	[0291.883] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0291.883] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0291.883] SetEvent (hEvent=0x174) returned 1
	[0291.883] SetEvent (hEvent=0x124) returned 1
	[0291.883] SetEvent (hEvent=0x104) returned 1
	[0291.883] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.885] SetEvent (hEvent=0x104) returned 1
	[0291.885] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\pTxoaLKfud6Leg05GX_k.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\ptxoalkfud6leg05gx_k.png"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0291.993] SetEvent (hEvent=0x168) returned 1
	[0291.993] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b6c | out: lpMode=0x12422b6c) returned 0
	[0291.993] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422b5c, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422b5c*=0xfa000, lpOverlapped=0x0) returned 1
	[0292.015] CloseHandle (hObject=0x178) returned 1
	[0292.015] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\pTxoaLKfud6Leg05GX_k.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\ptxoalkfud6leg05gx_k.png")) returned 1
	[0292.037] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\rsVKOpgEcVvbWZPED.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\rsvkopgecvvbwzped.png"), fInfoLevelId=0x0, lpFileInformation=0x124a6148 | out: lpFileInformation=0x124a6148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba21dec0, ftCreationTime.dwHighDateTime=0x1d8203f, ftLastAccessTime.dwLowDateTime=0xe4a17ee0, ftLastAccessTime.dwHighDateTime=0x1d827e6, ftLastWriteTime.dwLowDateTime=0xe4a17ee0, ftLastWriteTime.dwHighDateTime=0x1d827e6, nFileSizeHigh=0x0, nFileSizeLow=0x4a04)) returned 1
	[0292.037] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\rsVKOpgEcVvbWZPED.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\rsvkopgecvvbwzped.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0292.037] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0292.037] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\rsVKOpgEcVvbWZPED.png.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\rsvkopgecvvbwzped.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0292.038] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0292.038] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc480 | out: pbBuffer=0x123cc480) returned 1
	[0292.038] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c130 | out: pbBuffer=0x1251c130) returned 1
	[0292.038] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc101 | out: pbBuffer=0x123fc101) returned 1
	[0292.038] WriteFile (in: hFile=0x17c, lpBuffer=0x1253b000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422a5c, lpOverlapped=0x0 | out: lpBuffer=0x1253b000*, lpNumberOfBytesWritten=0x12422a5c*=0x80, lpOverlapped=0x0) returned 1
	[0292.044] SetEvent (hEvent=0x124) returned 1
	[0292.045] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422a4c*=0x4a04, lpOverlapped=0x0) returned 1
	[0292.046] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x4a04, lpNumberOfBytesWritten=0x12422a58, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422a58*=0x4a04, lpOverlapped=0x0) returned 1
	[0292.336] SetEvent (hEvent=0x168) returned 1
	[0292.336] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422a4c*=0x0, lpOverlapped=0x0) returned 1
	[0292.336] CloseHandle (hObject=0x17c) returned 1
	[0292.337] CloseHandle (hObject=0x178) returned 1
	[0292.337] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x127de000*, nNumberOfCharsToWrite=0x6e, lpNumberOfCharsWritten=0x12422710, lpReserved=0x0 | out: lpBuffer=0x127de000*, lpNumberOfCharsWritten=0x12422710*=0x6e) returned 1
	[0292.361] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\rsVKOpgEcVvbWZPED.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\rsvkopgecvvbwzped.png")) returned 1
	[0292.397] SetEvent (hEvent=0x14c) returned 1
	[0292.448] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0292.469] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0292.469] SetEvent (hEvent=0x14c) returned 1
	[0292.469] SetEvent (hEvent=0x124) returned 1
	[0292.469] SetEvent (hEvent=0x174) returned 1
	[0292.469] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0292.481] SetEvent (hEvent=0x168) returned 1
	[0292.481] SetEvent (hEvent=0x174) returned 1
	[0292.570] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0292.574] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0292.574] SetEvent (hEvent=0x174) returned 1
	[0292.577] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0292.577] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0292.577] SetEvent (hEvent=0x174) returned 1
	[0292.577] SetEvent (hEvent=0x124) returned 1
	[0292.577] SetEvent (hEvent=0x14c) returned 1
	[0292.577] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0292.578] SetEvent (hEvent=0x168) returned 1
	[0292.578] SetEvent (hEvent=0x14c) returned 1
	[0292.579] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\rsVKOpgEcVvbWZPED.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\rsvkopgecvvbwzped.png"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0292.582] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b6c | out: lpMode=0x12422b6c) returned 0
	[0292.582] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422b5c, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422b5c*=0xfa000, lpOverlapped=0x0) returned 1
	[0292.609] CloseHandle (hObject=0x178) returned 1
	[0292.610] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\rsVKOpgEcVvbWZPED.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\rsvkopgecvvbwzped.png")) returned 1
	[0292.617] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\zwxsnUmdvyouw8jV0n.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\zwxsnumdvyouw8jv0n.jpg"), fInfoLevelId=0x0, lpFileInformation=0x124a6198 | out: lpFileInformation=0x124a6198*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef2d7c20, ftCreationTime.dwHighDateTime=0x1d8271d, ftLastAccessTime.dwLowDateTime=0x64378e30, ftLastAccessTime.dwHighDateTime=0x1d8288a, ftLastWriteTime.dwLowDateTime=0x64378e30, ftLastWriteTime.dwHighDateTime=0x1d8288a, nFileSizeHigh=0x0, nFileSizeLow=0x6154)) returned 1
	[0292.618] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\zwxsnUmdvyouw8jV0n.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\zwxsnumdvyouw8jv0n.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0292.618] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0292.618] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\zwxsnUmdvyouw8jV0n.jpg.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\zwxsnumdvyouw8jv0n.jpg.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0292.618] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422a80 | out: lpMode=0x12422a80) returned 0
	[0292.618] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc480 | out: pbBuffer=0x123cc480) returned 1
	[0292.619] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c130 | out: pbBuffer=0x1251c130) returned 1
	[0292.619] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc181 | out: pbBuffer=0x123fc181) returned 1
	[0292.619] WriteFile (in: hFile=0x17c, lpBuffer=0x1253b000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422a5c, lpOverlapped=0x0 | out: lpBuffer=0x1253b000*, lpNumberOfBytesWritten=0x12422a5c*=0x80, lpOverlapped=0x0) returned 1
	[0292.627] SetEvent (hEvent=0x124) returned 1
	[0292.627] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422a4c*=0x6154, lpOverlapped=0x0) returned 1
	[0292.629] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x6154, lpNumberOfBytesWritten=0x12422a58, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422a58*=0x6154, lpOverlapped=0x0) returned 1
	[0292.632] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422a4c, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422a4c*=0x0, lpOverlapped=0x0) returned 1
	[0292.633] CloseHandle (hObject=0x17c) returned 1
	[0292.633] CloseHandle (hObject=0x178) returned 1
	[0292.634] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1253c000*, nNumberOfCharsToWrite=0x6f, lpNumberOfCharsWritten=0x12422710, lpReserved=0x0 | out: lpBuffer=0x1253c000*, lpNumberOfCharsWritten=0x12422710*=0x6f) returned 1
	[0292.650] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0292.652] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\zwxsnUmdvyouw8jV0n.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\zwxsnumdvyouw8jv0n.jpg")) returned 1
	[0292.662] SetEvent (hEvent=0x124) returned 1
	[0292.663] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0292.663] SetEvent (hEvent=0x124) returned 1
	[0292.663] SetEvent (hEvent=0x104) returned 1
	[0292.663] SetEvent (hEvent=0x174) returned 1
	[0292.663] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0292.664] SetEvent (hEvent=0x174) returned 1
	[0292.704] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0292.706] SetEvent (hEvent=0x168) returned 1
	[0292.706] SetEvent (hEvent=0x174) returned 1
	[0292.709] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0292.709] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0292.710] SetEvent (hEvent=0x174) returned 1
	[0292.710] SetEvent (hEvent=0x104) returned 1
	[0292.710] SetEvent (hEvent=0x124) returned 1
	[0292.710] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0292.710] SetEvent (hEvent=0x124) returned 1
	[0292.713] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\zwxsnUmdvyouw8jV0n.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\zwxsnumdvyouw8jv0n.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0292.714] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b6c | out: lpMode=0x12422b6c) returned 0
	[0292.714] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422b5c, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422b5c*=0xfa000, lpOverlapped=0x0) returned 1
	[0292.734] CloseHandle (hObject=0x178) returned 1
	[0292.735] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\LwwYEKAS1DSwHRtiI9\\szOEK-\\zwxsnUmdvyouw8jV0n.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\lwwyekas1dswhrtii9\\szoek-\\zwxsnumdvyouw8jv0n.jpg")) returned 1
	[0292.739] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\T26SrzDK.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\t26srzdk.jpg"), fInfoLevelId=0x0, lpFileInformation=0x124a6148 | out: lpFileInformation=0x124a6148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3265ed0, ftCreationTime.dwHighDateTime=0x1d82611, ftLastAccessTime.dwLowDateTime=0x8b2a49b0, ftLastAccessTime.dwHighDateTime=0x1d82970, ftLastWriteTime.dwLowDateTime=0x8b2a49b0, ftLastWriteTime.dwHighDateTime=0x1d82970, nFileSizeHigh=0x0, nFileSizeLow=0xa361)) returned 1
	[0292.739] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\T26SrzDK.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\t26srzdk.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0292.740] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b48 | out: lpMode=0x12422b48) returned 0
	[0292.740] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\T26SrzDK.jpg.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\t26srzdk.jpg.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0292.740] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422b48 | out: lpMode=0x12422b48) returned 0
	[0292.740] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc480 | out: pbBuffer=0x123cc480) returned 1
	[0292.740] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x12412200 | out: pbBuffer=0x12412200) returned 1
	[0292.740] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc081 | out: pbBuffer=0x123fc081) returned 1
	[0292.741] WriteFile (in: hFile=0x17c, lpBuffer=0x1253b000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b24, lpOverlapped=0x0 | out: lpBuffer=0x1253b000*, lpNumberOfBytesWritten=0x12422b24*=0x80, lpOverlapped=0x0) returned 1
	[0292.766] SetEvent (hEvent=0x104) returned 1
	[0292.766] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b14, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b14*=0xa361, lpOverlapped=0x0) returned 1
	[0292.768] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0xa361, lpNumberOfBytesWritten=0x12422b20, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b20*=0xa361, lpOverlapped=0x0) returned 1
	[0292.773] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b14, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b14*=0x0, lpOverlapped=0x0) returned 1
	[0292.773] CloseHandle (hObject=0x17c) returned 1
	[0292.773] CloseHandle (hObject=0x178) returned 1
	[0292.774] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1253c000*, nNumberOfCharsToWrite=0x4b, lpNumberOfCharsWritten=0x124227d8, lpReserved=0x0 | out: lpBuffer=0x1253c000*, lpNumberOfCharsWritten=0x124227d8*=0x4b) returned 1
	[0292.792] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0292.794] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\T26SrzDK.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\t26srzdk.jpg")) returned 1
	[0292.801] SetEvent (hEvent=0x104) returned 1
	[0292.803] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0292.803] SetEvent (hEvent=0x104) returned 1
	[0292.803] SetEvent (hEvent=0x14c) returned 1
	[0292.803] SetEvent (hEvent=0x174) returned 1
	[0292.803] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0292.803] SetEvent (hEvent=0x174) returned 1
	[0292.832] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0292.833] SetEvent (hEvent=0x168) returned 1
	[0292.833] SetEvent (hEvent=0x174) returned 1
	[0292.835] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0292.836] SetEvent (hEvent=0x174) returned 1
	[0292.836] SetEvent (hEvent=0x14c) returned 1
	[0292.836] SetEvent (hEvent=0x104) returned 1
	[0292.836] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0292.836] SetEvent (hEvent=0x104) returned 1
	[0292.838] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\T26SrzDK.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\t26srzdk.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0292.839] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c34 | out: lpMode=0x12422c34) returned 0
	[0292.839] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c24, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c24*=0xfa000, lpOverlapped=0x0) returned 1
	[0292.857] CloseHandle (hObject=0x178) returned 1
	[0292.858] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\T26SrzDK.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\t26srzdk.jpg")) returned 1
	[0292.862] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\_3za2f0R.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\_3za2f0r.jpg"), fInfoLevelId=0x0, lpFileInformation=0x124a60a8 | out: lpFileInformation=0x124a60a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e325cf0, ftCreationTime.dwHighDateTime=0x1d82999, ftLastAccessTime.dwLowDateTime=0x5113f800, ftLastAccessTime.dwHighDateTime=0x1d829cc, ftLastWriteTime.dwLowDateTime=0x5113f800, ftLastWriteTime.dwHighDateTime=0x1d829cc, nFileSizeHigh=0x0, nFileSizeLow=0xdf60)) returned 1
	[0292.862] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\_3za2f0R.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\_3za2f0r.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0292.862] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b48 | out: lpMode=0x12422b48) returned 0
	[0292.863] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\_3za2f0R.jpg.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\_3za2f0r.jpg.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0292.863] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422b48 | out: lpMode=0x12422b48) returned 0
	[0292.863] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc320 | out: pbBuffer=0x123cc320) returned 1
	[0292.863] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c110 | out: pbBuffer=0x1251c110) returned 1
	[0292.863] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc081 | out: pbBuffer=0x123fc081) returned 1
	[0292.863] WriteFile (in: hFile=0x17c, lpBuffer=0x12517000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b24, lpOverlapped=0x0 | out: lpBuffer=0x12517000*, lpNumberOfBytesWritten=0x12422b24*=0x80, lpOverlapped=0x0) returned 1
	[0292.866] SetEvent (hEvent=0x14c) returned 1
	[0292.866] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b14, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b14*=0xdf60, lpOverlapped=0x0) returned 1
	[0292.868] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0xdf60, lpNumberOfBytesWritten=0x12422b20, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b20*=0xdf60, lpOverlapped=0x0) returned 1
	[0292.870] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b14, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b14*=0x0, lpOverlapped=0x0) returned 1
	[0292.870] CloseHandle (hObject=0x17c) returned 1
	[0292.871] CloseHandle (hObject=0x178) returned 1
	[0292.871] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x125d2000*, nNumberOfCharsToWrite=0x4b, lpNumberOfCharsWritten=0x124227d8, lpReserved=0x0 | out: lpBuffer=0x125d2000*, lpNumberOfCharsWritten=0x124227d8*=0x4b) returned 1
	[0292.883] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0292.888] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\_3za2f0R.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\_3za2f0r.jpg")) returned 1
	[0292.894] SetEvent (hEvent=0x14c) returned 1
	[0292.895] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0292.896] SetEvent (hEvent=0x14c) returned 1
	[0292.896] SetEvent (hEvent=0x124) returned 1
	[0292.896] SetEvent (hEvent=0x174) returned 1
	[0292.896] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0292.896] SetEvent (hEvent=0x174) returned 1
	[0292.934] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0292.935] SetEvent (hEvent=0x168) returned 1
	[0292.935] SetEvent (hEvent=0x174) returned 1
	[0292.938] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0292.940] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0292.940] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0292.940] SetEvent (hEvent=0x174) returned 1
	[0292.940] SetEvent (hEvent=0x124) returned 1
	[0292.940] SetEvent (hEvent=0x14c) returned 1
	[0292.940] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0292.940] SetEvent (hEvent=0x14c) returned 1
	[0292.941] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\_3za2f0R.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\_3za2f0r.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0292.942] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c34 | out: lpMode=0x12422c34) returned 0
	[0292.942] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c24, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c24*=0xfa000, lpOverlapped=0x0) returned 1
	[0292.962] CloseHandle (hObject=0x178) returned 1
	[0292.962] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\9_G_fS\\_3za2f0R.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\9_g_fs\\_3za2f0r.jpg")) returned 1
	[0292.967] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\E41Dj3poiaXO2R" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\e41dj3poiaxo2r"), fInfoLevelId=0x0, lpFileInformation=0x124a60f8 | out: lpFileInformation=0x124a60f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadc5a380, ftCreationTime.dwHighDateTime=0x1d82046, ftLastAccessTime.dwLowDateTime=0xa27059e0, ftLastAccessTime.dwHighDateTime=0x1d820ae, ftLastWriteTime.dwLowDateTime=0xa27059e0, ftLastWriteTime.dwHighDateTime=0x1d820ae, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0292.967] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\E41Dj3poiaXO2R" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\e41dj3poiaxo2r"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0292.967] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\E41Dj3poiaXO2R\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadc5a380, ftCreationTime.dwHighDateTime=0x1d82046, ftLastAccessTime.dwLowDateTime=0xa27059e0, ftLastAccessTime.dwHighDateTime=0x1d820ae, ftLastWriteTime.dwLowDateTime=0xa27059e0, ftLastWriteTime.dwHighDateTime=0x1d820ae, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fca8
	[0292.967] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xadc5a380, ftCreationTime.dwHighDateTime=0x1d82046, ftLastAccessTime.dwLowDateTime=0xa27059e0, ftLastAccessTime.dwHighDateTime=0x1d820ae, ftLastWriteTime.dwLowDateTime=0xa27059e0, ftLastWriteTime.dwHighDateTime=0x1d820ae, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0292.967] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a80c850, ftCreationTime.dwHighDateTime=0x1d81ed8, ftLastAccessTime.dwLowDateTime=0x203999b0, ftLastAccessTime.dwHighDateTime=0x1d82319, ftLastWriteTime.dwLowDateTime=0x203999b0, ftLastWriteTime.dwHighDateTime=0x1d82319, nFileSizeHigh=0x0, nFileSizeLow=0x13d99, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q-xhs2 UO_.bmp", cAlternateFileName="Q-XHS2~1.BMP")) returned 1
	[0292.967] FindNextFileW (in: hFindFile=0x79fca8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0292.968] FindClose (in: hFindFile=0x79fca8 | out: hFindFile=0x79fca8) returned 1
	[0292.968] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\E41Dj3poiaXO2R\\README.html" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\e41dj3poiaxo2r\\readme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0292.969] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422ccc | out: lpMode=0x12422ccc) returned 0
	[0292.969] WriteFile (in: hFile=0x178, lpBuffer=0x12694000*, nNumberOfBytesToWrite=0xc85, lpNumberOfBytesWritten=0x12422cbc, lpOverlapped=0x0 | out: lpBuffer=0x12694000*, lpNumberOfBytesWritten=0x12422cbc*=0xc85, lpOverlapped=0x0) returned 1
	[0292.970] CloseHandle (hObject=0x178) returned 1
	[0292.970] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12516000*, nNumberOfCharsToWrite=0x5c, lpNumberOfCharsWritten=0x1242284c, lpReserved=0x0 | out: lpBuffer=0x12516000*, lpNumberOfCharsWritten=0x1242284c*=0x5c) returned 1
	[0292.983] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\E41Dj3poiaXO2R\\Q-xhs2 UO_.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\e41dj3poiaxo2r\\q-xhs2 uo_.bmp"), fInfoLevelId=0x0, lpFileInformation=0x124a6198 | out: lpFileInformation=0x124a6198*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a80c850, ftCreationTime.dwHighDateTime=0x1d81ed8, ftLastAccessTime.dwLowDateTime=0x203999b0, ftLastAccessTime.dwHighDateTime=0x1d82319, ftLastWriteTime.dwLowDateTime=0x203999b0, ftLastWriteTime.dwHighDateTime=0x1d82319, nFileSizeHigh=0x0, nFileSizeLow=0x13d99)) returned 1
	[0292.983] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\E41Dj3poiaXO2R\\Q-xhs2 UO_.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\e41dj3poiaxo2r\\q-xhs2 uo_.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0292.983] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422b48 | out: lpMode=0x12422b48) returned 0
	[0292.983] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\E41Dj3poiaXO2R\\Q-xhs2 UO_.bmp.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\e41dj3poiaxo2r\\q-xhs2 uo_.bmp.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0292.985] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422b48 | out: lpMode=0x12422b48) returned 0
	[0292.985] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc380 | out: pbBuffer=0x123cc380) returned 1
	[0292.985] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x12412320 | out: pbBuffer=0x12412320) returned 1
	[0292.985] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc081 | out: pbBuffer=0x123fc081) returned 1
	[0292.986] WriteFile (in: hFile=0x17c, lpBuffer=0x1253f000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b24, lpOverlapped=0x0 | out: lpBuffer=0x1253f000*, lpNumberOfBytesWritten=0x12422b24*=0x80, lpOverlapped=0x0) returned 1
	[0292.988] SetEvent (hEvent=0x124) returned 1
	[0292.988] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b14, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b14*=0x13d99, lpOverlapped=0x0) returned 1
	[0292.991] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x13d99, lpNumberOfBytesWritten=0x12422b20, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b20*=0x13d99, lpOverlapped=0x0) returned 1
	[0292.994] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b14, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b14*=0x0, lpOverlapped=0x0) returned 1
	[0292.994] CloseHandle (hObject=0x17c) returned 1
	[0292.995] CloseHandle (hObject=0x178) returned 1
	[0292.995] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12508000*, nNumberOfCharsToWrite=0x55, lpNumberOfCharsWritten=0x124227d8, lpReserved=0x0 | out: lpBuffer=0x12508000*, lpNumberOfCharsWritten=0x124227d8*=0x55) returned 1
	[0293.008] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.010] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\E41Dj3poiaXO2R\\Q-xhs2 UO_.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\e41dj3poiaxo2r\\q-xhs2 uo_.bmp")) returned 1
	[0293.019] SetEvent (hEvent=0x124) returned 1
	[0293.021] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0293.021] SetEvent (hEvent=0x124) returned 1
	[0293.021] SetEvent (hEvent=0x104) returned 1
	[0293.021] SetEvent (hEvent=0x174) returned 1
	[0293.021] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.022] SetEvent (hEvent=0x174) returned 1
	[0293.041] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0293.042] SetEvent (hEvent=0x168) returned 1
	[0293.042] SetEvent (hEvent=0x174) returned 1
	[0293.044] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0293.047] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0293.048] SetEvent (hEvent=0x174) returned 1
	[0293.048] SetEvent (hEvent=0x104) returned 1
	[0293.048] SetEvent (hEvent=0x124) returned 1
	[0293.048] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.048] SetEvent (hEvent=0x168) returned 1
	[0293.048] SetEvent (hEvent=0x124) returned 1
	[0293.049] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\E41Dj3poiaXO2R\\Q-xhs2 UO_.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\e41dj3poiaxo2r\\q-xhs2 uo_.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0293.051] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c34 | out: lpMode=0x12422c34) returned 0
	[0293.051] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c24, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c24*=0xfa000, lpOverlapped=0x0) returned 1
	[0293.070] CloseHandle (hObject=0x178) returned 1
	[0293.071] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\E41Dj3poiaXO2R\\Q-xhs2 UO_.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\e41dj3poiaxo2r\\q-xhs2 uo_.bmp")) returned 1
	[0293.075] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\KPjc0osAaE6A.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\kpjc0osaae6a.bmp"), fInfoLevelId=0x0, lpFileInformation=0x124a6058 | out: lpFileInformation=0x124a6058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23403d10, ftCreationTime.dwHighDateTime=0x1d81b91, ftLastAccessTime.dwLowDateTime=0x604e63c0, ftLastAccessTime.dwHighDateTime=0x1d828a3, ftLastWriteTime.dwLowDateTime=0x604e63c0, ftLastWriteTime.dwHighDateTime=0x1d828a3, nFileSizeHigh=0x0, nFileSizeLow=0x7785)) returned 1
	[0293.075] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\KPjc0osAaE6A.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\kpjc0osaae6a.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0293.075] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0293.075] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\KPjc0osAaE6A.bmp.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\kpjc0osaae6a.bmp.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0293.076] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0293.076] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc320 | out: pbBuffer=0x123cc320) returned 1
	[0293.076] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c110 | out: pbBuffer=0x1251c110) returned 1
	[0293.076] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc081 | out: pbBuffer=0x123fc081) returned 1
	[0293.076] WriteFile (in: hFile=0x17c, lpBuffer=0x12539000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x12539000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0293.079] SetEvent (hEvent=0x104) returned 1
	[0293.079] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x7785, lpOverlapped=0x0) returned 1
	[0293.080] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x7785, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b84*=0x7785, lpOverlapped=0x0) returned 1
	[0293.082] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0293.083] CloseHandle (hObject=0x17c) returned 1
	[0293.083] CloseHandle (hObject=0x178) returned 1
	[0293.083] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1253a000*, nNumberOfCharsToWrite=0x48, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x1253a000*, lpNumberOfCharsWritten=0x1242283c*=0x48) returned 1
	[0293.094] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.095] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\KPjc0osAaE6A.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\kpjc0osaae6a.bmp")) returned 1
	[0293.101] SetEvent (hEvent=0x104) returned 1
	[0293.102] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0293.104] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.104] SetEvent (hEvent=0x104) returned 1
	[0293.104] SetEvent (hEvent=0x14c) returned 1
	[0293.104] SetEvent (hEvent=0x174) returned 1
	[0293.104] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.105] SetEvent (hEvent=0x168) returned 1
	[0293.105] SetEvent (hEvent=0x174) returned 1
	[0293.129] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0293.130] SetEvent (hEvent=0x174) returned 1
	[0293.132] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0293.132] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0293.132] SetEvent (hEvent=0x174) returned 1
	[0293.132] SetEvent (hEvent=0x14c) returned 1
	[0293.132] SetEvent (hEvent=0x104) returned 1
	[0293.132] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.133] SetEvent (hEvent=0x168) returned 1
	[0293.133] SetEvent (hEvent=0x104) returned 1
	[0293.147] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\KPjc0osAaE6A.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\kpjc0osaae6a.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0293.150] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0293.150] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0293.170] CloseHandle (hObject=0x178) returned 1
	[0293.171] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\KPjc0osAaE6A.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\kpjc0osaae6a.bmp")) returned 1
	[0293.177] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\YFXG0jjPN7Y.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\yfxg0jjpn7y.png"), fInfoLevelId=0x0, lpFileInformation=0x124a60a8 | out: lpFileInformation=0x124a60a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e316b80, ftCreationTime.dwHighDateTime=0x1d82839, ftLastAccessTime.dwLowDateTime=0x7aea72e0, ftLastAccessTime.dwHighDateTime=0x1d8288b, ftLastWriteTime.dwLowDateTime=0x7aea72e0, ftLastWriteTime.dwHighDateTime=0x1d8288b, nFileSizeHigh=0x0, nFileSizeLow=0x14677)) returned 1
	[0293.177] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\YFXG0jjPN7Y.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\yfxg0jjpn7y.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0293.178] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0293.178] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\YFXG0jjPN7Y.png.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\yfxg0jjpn7y.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0293.178] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0293.178] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc300 | out: pbBuffer=0x123cc300) returned 1
	[0293.178] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x124121c0 | out: pbBuffer=0x124121c0) returned 1
	[0293.178] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc081 | out: pbBuffer=0x123fc081) returned 1
	[0293.179] WriteFile (in: hFile=0x17c, lpBuffer=0x12537000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x12537000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0293.182] SetEvent (hEvent=0x14c) returned 1
	[0293.182] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x14677, lpOverlapped=0x0) returned 1
	[0293.184] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x14677, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b84*=0x14677, lpOverlapped=0x0) returned 1
	[0293.187] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0293.188] CloseHandle (hObject=0x17c) returned 1
	[0293.188] CloseHandle (hObject=0x178) returned 1
	[0293.188] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x1250a000*, nNumberOfCharsToWrite=0x47, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x1250a000*, lpNumberOfCharsWritten=0x1242283c*=0x47) returned 1
	[0293.202] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.204] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\YFXG0jjPN7Y.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\yfxg0jjpn7y.png")) returned 1
	[0293.237] SetEvent (hEvent=0x14c) returned 1
	[0293.239] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0293.241] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.241] SetEvent (hEvent=0x14c) returned 1
	[0293.241] SetEvent (hEvent=0x124) returned 1
	[0293.241] SetEvent (hEvent=0x174) returned 1
	[0293.241] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.241] SetEvent (hEvent=0x168) returned 1
	[0293.241] SetEvent (hEvent=0x174) returned 1
	[0293.262] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0293.263] SetEvent (hEvent=0x174) returned 1
	[0293.265] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0293.265] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0293.266] SetEvent (hEvent=0x174) returned 1
	[0293.266] SetEvent (hEvent=0x124) returned 1
	[0293.266] SetEvent (hEvent=0x14c) returned 1
	[0293.266] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.266] SetEvent (hEvent=0x168) returned 1
	[0293.266] SetEvent (hEvent=0x14c) returned 1
	[0293.267] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\YFXG0jjPN7Y.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\yfxg0jjpn7y.png"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0293.268] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422c98 | out: lpMode=0x12422c98) returned 0
	[0293.268] WriteFile (in: hFile=0x178, lpBuffer=0x1280c000*, nNumberOfBytesToWrite=0xfa000, lpNumberOfBytesWritten=0x12422c88, lpOverlapped=0x0 | out: lpBuffer=0x1280c000*, lpNumberOfBytesWritten=0x12422c88*=0xfa000, lpOverlapped=0x0) returned 1
	[0293.286] CloseHandle (hObject=0x178) returned 1
	[0293.287] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\YFXG0jjPN7Y.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\yfxg0jjpn7y.png")) returned 1
	[0293.292] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\ZC2EzW b.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\zc2ezw b.png"), fInfoLevelId=0x0, lpFileInformation=0x124a6058 | out: lpFileInformation=0x124a6058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9b87a40, ftCreationTime.dwHighDateTime=0x1d81cb1, ftLastAccessTime.dwLowDateTime=0x3c3a050, ftLastAccessTime.dwHighDateTime=0x1d82477, ftLastWriteTime.dwLowDateTime=0x3c3a050, ftLastWriteTime.dwHighDateTime=0x1d82477, nFileSizeHigh=0x0, nFileSizeLow=0x7418)) returned 1
	[0293.292] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\ZC2EzW b.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\zc2ezw b.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x178
	[0293.292] GetConsoleMode (in: hConsoleHandle=0x178, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0293.293] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\ZC2EzW b.png.locked" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\zc2ezw b.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c
	[0293.293] GetConsoleMode (in: hConsoleHandle=0x17c, lpMode=0x12422bac | out: lpMode=0x12422bac) returned 0
	[0293.293] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123cc300 | out: pbBuffer=0x123cc300) returned 1
	[0293.293] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x10, pbBuffer=0x1251c110 | out: pbBuffer=0x1251c110) returned 1
	[0293.293] CryptGenRandom (in: hProv=0x78dbd8, dwLen=0x20, pbBuffer=0x123fc181 | out: pbBuffer=0x123fc181) returned 1
	[0293.293] WriteFile (in: hFile=0x17c, lpBuffer=0x12517000*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x12422b88, lpOverlapped=0x0 | out: lpBuffer=0x12517000*, lpNumberOfBytesWritten=0x12422b88*=0x80, lpOverlapped=0x0) returned 1
	[0293.296] SetEvent (hEvent=0x124) returned 1
	[0293.296] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x7418, lpOverlapped=0x0) returned 1
	[0293.297] WriteFile (in: hFile=0x17c, lpBuffer=0x12c6c000*, nNumberOfBytesToWrite=0x7418, lpNumberOfBytesWritten=0x12422b84, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesWritten=0x12422b84*=0x7418, lpOverlapped=0x0) returned 1
	[0293.302] ReadFile (in: hFile=0x178, lpBuffer=0x12c6c000, nNumberOfBytesToRead=0x9c4000, lpNumberOfBytesRead=0x12422b78, lpOverlapped=0x0 | out: lpBuffer=0x12c6c000*, lpNumberOfBytesRead=0x12422b78*=0x0, lpOverlapped=0x0) returned 1
	[0293.302] CloseHandle (hObject=0x17c) returned 1
	[0293.302] CloseHandle (hObject=0x178) returned 1
	[0293.303] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x12508000*, nNumberOfCharsToWrite=0x44, lpNumberOfCharsWritten=0x1242283c, lpReserved=0x0 | out: lpBuffer=0x12508000*, lpNumberOfCharsWritten=0x1242283c*=0x44) returned 1
	[0293.314] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.315] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\obQ_cDa0HsewFXG1Fqa\\ZC2EzW b.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\obq_cda0hsewfxg1fqa\\zc2ezw b.png")) returned 1
	[0293.327] SetEvent (hEvent=0x124) returned 1
	[0293.374] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.377] SetEvent (hEvent=0x124) returned 1
	[0293.377] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.378] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.474] SetEvent (hEvent=0x104) returned 1
	[0293.474] SetEvent (hEvent=0x174) returned 1
	[0293.474] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.476] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.493] SetEvent (hEvent=0x124) returned 1
	[0293.493] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.516] SetEvent (hEvent=0x124) returned 1
	[0293.516] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.520] SetEvent (hEvent=0x124) returned 1
	[0293.520] SwitchToThread () returned 1
	[0293.520] SetEvent (hEvent=0x124) returned 1
	[0293.520] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.520] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.614] SetEvent (hEvent=0x14c) returned 1
	[0293.614] SetEvent (hEvent=0x104) returned 1
	[0293.614] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.616] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.632] SetEvent (hEvent=0x124) returned 1
	[0293.632] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.659] SetEvent (hEvent=0x124) returned 1
	[0293.659] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.663] SetEvent (hEvent=0x124) returned 1
	[0293.663] SwitchToThread () returned 1
	[0293.663] SetEvent (hEvent=0x124) returned 1
	[0293.663] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.663] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.717] SetEvent (hEvent=0x174) returned 1
	[0293.717] SetEvent (hEvent=0x14c) returned 1
	[0293.717] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.718] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.747] SetEvent (hEvent=0x124) returned 1
	[0293.747] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.769] SetEvent (hEvent=0x124) returned 1
	[0293.769] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.771] SetEvent (hEvent=0x124) returned 1
	[0293.771] SwitchToThread () returned 1
	[0293.773] SetEvent (hEvent=0x124) returned 1
	[0293.773] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.774] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.821] SetEvent (hEvent=0x104) returned 1
	[0293.821] SetEvent (hEvent=0x174) returned 1
	[0293.821] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.822] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.831] SetEvent (hEvent=0x124) returned 1
	[0293.831] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.858] SetEvent (hEvent=0x124) returned 1
	[0293.858] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.863] SetEvent (hEvent=0x124) returned 1
	[0293.863] SwitchToThread () returned 1
	[0293.864] SetEvent (hEvent=0x124) returned 1
	[0293.864] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.864] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.002] SetEvent (hEvent=0x14c) returned 1
	[0294.002] SetEvent (hEvent=0x104) returned 1
	[0294.002] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.005] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.024] SetEvent (hEvent=0x124) returned 1
	[0294.024] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.077] SetEvent (hEvent=0x124) returned 1
	[0294.077] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.085] SetEvent (hEvent=0x124) returned 1
	[0294.085] SwitchToThread () returned 1
	[0294.085] SetEvent (hEvent=0x124) returned 1
	[0294.085] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.086] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.159] SetEvent (hEvent=0x174) returned 1
	[0294.159] SetEvent (hEvent=0x14c) returned 1
	[0294.159] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.162] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.182] SetEvent (hEvent=0x124) returned 1
	[0294.182] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.229] SetEvent (hEvent=0x124) returned 1
	[0294.229] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.231] SetEvent (hEvent=0x124) returned 1
	[0294.231] SwitchToThread () returned 1
	[0294.231] SetEvent (hEvent=0x124) returned 1
	[0294.231] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.232] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.275] SetEvent (hEvent=0x104) returned 1
	[0294.275] SetEvent (hEvent=0x174) returned 1
	[0294.275] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.278] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.289] SetEvent (hEvent=0x124) returned 1
	[0294.289] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.316] SwitchToThread () returned 1
	[0294.325] SetEvent (hEvent=0x124) returned 1
	[0294.325] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.332] SetEvent (hEvent=0x124) returned 1
	[0294.332] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.333] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.384] SetEvent (hEvent=0x14c) returned 1
	[0294.384] SetEvent (hEvent=0x104) returned 1
	[0294.384] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.385] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.395] SetEvent (hEvent=0x124) returned 1
	[0294.395] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.459] SetEvent (hEvent=0x124) returned 1
	[0294.459] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.463] SetEvent (hEvent=0x124) returned 1
	[0294.463] SwitchToThread () returned 1
	[0294.463] SetEvent (hEvent=0x124) returned 1
	[0294.463] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.463] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.532] SetEvent (hEvent=0x174) returned 1
	[0294.532] SetEvent (hEvent=0x14c) returned 1
	[0294.532] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.533] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.563] SetEvent (hEvent=0x124) returned 1
	[0294.563] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.590] SetEvent (hEvent=0x124) returned 1
	[0294.590] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.594] SetEvent (hEvent=0x124) returned 1
	[0294.594] SwitchToThread () returned 1
	[0294.594] SetEvent (hEvent=0x124) returned 1
	[0294.594] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.594] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.669] SetEvent (hEvent=0x104) returned 1
	[0294.669] SetEvent (hEvent=0x174) returned 1
	[0294.669] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.671] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.738] SetEvent (hEvent=0x124) returned 1
	[0294.738] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.766] SwitchToThread () returned 1
	[0294.779] SetEvent (hEvent=0x124) returned 1
	[0294.779] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.788] SetEvent (hEvent=0x124) returned 1
	[0294.788] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.791] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.864] SetEvent (hEvent=0x14c) returned 1
	[0294.864] SetEvent (hEvent=0x104) returned 1
	[0294.864] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.870] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.890] SetEvent (hEvent=0x124) returned 1
	[0294.890] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.920] SwitchToThread () returned 1
	[0294.925] SetEvent (hEvent=0x124) returned 1
	[0294.925] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.929] SetEvent (hEvent=0x124) returned 1
	[0294.929] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.930] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.996] SetEvent (hEvent=0x174) returned 1
	[0294.996] SetEvent (hEvent=0x14c) returned 1
	[0294.996] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.997] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.006] SetEvent (hEvent=0x124) returned 1
	[0295.006] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.029] SetEvent (hEvent=0x124) returned 1
	[0295.029] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.036] SetEvent (hEvent=0x124) returned 1
	[0295.036] SwitchToThread () returned 1
	[0295.037] SetEvent (hEvent=0x124) returned 1
	[0295.037] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.037] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.103] SetEvent (hEvent=0x104) returned 1
	[0295.103] SetEvent (hEvent=0x174) returned 1
	[0295.103] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.104] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.117] SetEvent (hEvent=0x124) returned 1
	[0295.117] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.139] SetEvent (hEvent=0x124) returned 1
	[0295.139] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.142] SetEvent (hEvent=0x124) returned 1
	[0295.142] SwitchToThread () returned 1
	[0295.142] SetEvent (hEvent=0x124) returned 1
	[0295.142] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.143] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.255] SetEvent (hEvent=0x14c) returned 1
	[0295.256] SetEvent (hEvent=0x104) returned 1
	[0295.256] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.265] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.280] SetEvent (hEvent=0x124) returned 1
	[0295.280] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.297] SwitchToThread () returned 1
	[0295.306] SetEvent (hEvent=0x124) returned 1
	[0295.306] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.309] SetEvent (hEvent=0x124) returned 1
	[0295.309] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.310] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.367] SetEvent (hEvent=0x14c) returned 1
	[0295.367] SetEvent (hEvent=0x174) returned 1
	[0295.367] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.368] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.405] SetEvent (hEvent=0x124) returned 1
	[0295.405] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.509] SetEvent (hEvent=0x124) returned 1
	[0295.509] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.513] SetEvent (hEvent=0x124) returned 1
	[0295.513] SwitchToThread () returned 1
	[0295.513] SetEvent (hEvent=0x124) returned 1
	[0295.514] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.514] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.566] SetEvent (hEvent=0x14c) returned 1
	[0295.566] SetEvent (hEvent=0x104) returned 1
	[0295.566] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.570] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.585] SetEvent (hEvent=0x124) returned 1
	[0295.586] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.608] SetEvent (hEvent=0x124) returned 1
	[0295.608] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.611] SetEvent (hEvent=0x124) returned 1
	[0295.611] SwitchToThread () returned 1
	[0295.612] SetEvent (hEvent=0x124) returned 1
	[0295.612] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.612] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.661] SetEvent (hEvent=0x174) returned 1
	[0295.661] SetEvent (hEvent=0x14c) returned 1
	[0295.661] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.662] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.679] SetEvent (hEvent=0x124) returned 1
	[0295.679] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.701] SetEvent (hEvent=0x124) returned 1
	[0295.701] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.705] SetEvent (hEvent=0x124) returned 1
	[0295.705] SwitchToThread () returned 1
	[0295.705] SetEvent (hEvent=0x124) returned 1
	[0295.705] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.706] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.752] SetEvent (hEvent=0x104) returned 1
	[0295.752] SetEvent (hEvent=0x174) returned 1
	[0295.752] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.753] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.768] SetEvent (hEvent=0x124) returned 1
	[0295.768] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.798] SetEvent (hEvent=0x124) returned 1
	[0295.798] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.803] SetEvent (hEvent=0x124) returned 1
	[0295.803] SwitchToThread () returned 1
	[0295.803] SetEvent (hEvent=0x124) returned 1
	[0295.803] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.803] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.851] SetEvent (hEvent=0x14c) returned 1
	[0295.851] SetEvent (hEvent=0x104) returned 1
	[0295.851] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.852] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.863] SetEvent (hEvent=0x124) returned 1
	[0295.863] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.866] SwitchToThread () returned 1
	[0295.883] SetEvent (hEvent=0x124) returned 1
	[0295.883] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.887] SetEvent (hEvent=0x124) returned 1
	[0295.887] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.888] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.942] SetEvent (hEvent=0x14c) returned 1
	[0295.942] SetEvent (hEvent=0x174) returned 1
	[0295.942] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.945] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.959] SetEvent (hEvent=0x124) returned 1
	[0295.959] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.983] SetEvent (hEvent=0x124) returned 1
	[0295.983] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.986] SetEvent (hEvent=0x124) returned 1
	[0295.986] SwitchToThread () returned 1
	[0295.986] SetEvent (hEvent=0x124) returned 1
	[0295.986] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.986] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.042] SetEvent (hEvent=0x104) returned 1
	[0296.042] SetEvent (hEvent=0x14c) returned 1
	[0296.042] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.043] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.086] SetEvent (hEvent=0x124) returned 1
	[0296.087] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.111] SetEvent (hEvent=0x124) returned 1
	[0296.111] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.114] SetEvent (hEvent=0x124) returned 1
	[0296.114] SwitchToThread () returned 1
	[0296.114] SetEvent (hEvent=0x124) returned 1
	[0296.114] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.115] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.172] SetEvent (hEvent=0x174) returned 1
	[0296.172] SetEvent (hEvent=0x104) returned 1
	[0296.172] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.174] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.195] SetEvent (hEvent=0x124) returned 1
	[0296.195] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.206] SwitchToThread () returned 1
	[0296.253] SetEvent (hEvent=0x124) returned 1
	[0296.253] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.257] SetEvent (hEvent=0x124) returned 1
	[0296.257] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.258] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.338] SetEvent (hEvent=0x14c) returned 1
	[0296.338] SetEvent (hEvent=0x174) returned 1
	[0296.338] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.340] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.358] SetEvent (hEvent=0x124) returned 1
	[0296.358] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.390] SwitchToThread () returned 1
	[0296.467] SetEvent (hEvent=0x124) returned 1
	[0296.467] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.471] SetEvent (hEvent=0x124) returned 1
	[0296.471] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.471] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.564] SetEvent (hEvent=0x104) returned 1
	[0296.564] SetEvent (hEvent=0x14c) returned 1
	[0296.565] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.567] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.589] SetEvent (hEvent=0x124) returned 1
	[0296.589] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.626] SetEvent (hEvent=0x124) returned 1
	[0296.626] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.629] SetEvent (hEvent=0x124) returned 1
	[0296.629] SwitchToThread () returned 1
	[0296.630] SetEvent (hEvent=0x124) returned 1
	[0296.630] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.630] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.705] SetEvent (hEvent=0x174) returned 1
	[0296.706] SetEvent (hEvent=0x104) returned 1
	[0296.706] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.707] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.744] SetEvent (hEvent=0x124) returned 1
	[0296.744] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.768] SetEvent (hEvent=0x124) returned 1
	[0296.768] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.771] SetEvent (hEvent=0x124) returned 1
	[0296.771] SwitchToThread () returned 1
	[0296.772] SetEvent (hEvent=0x124) returned 1
	[0296.772] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.772] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.821] SetEvent (hEvent=0x174) returned 1
	[0296.821] SetEvent (hEvent=0x14c) returned 1
	[0296.821] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.826] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.838] SetEvent (hEvent=0x124) returned 1
	[0296.838] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.861] SetEvent (hEvent=0x124) returned 1
	[0296.861] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.864] SetEvent (hEvent=0x124) returned 1
	[0296.864] SwitchToThread () returned 1
	[0296.864] SetEvent (hEvent=0x124) returned 1
	[0296.864] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.864] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.899] SetEvent (hEvent=0x104) returned 1
	[0296.899] SetEvent (hEvent=0x174) returned 1
	[0296.899] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.900] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.017] SetEvent (hEvent=0x124) returned 1
	[0297.017] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.044] SetEvent (hEvent=0x124) returned 1
	[0297.044] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.049] SetEvent (hEvent=0x124) returned 1
	[0297.049] SwitchToThread () returned 1
	[0297.050] SetEvent (hEvent=0x124) returned 1
	[0297.050] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.050] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.110] SetEvent (hEvent=0x104) returned 1
	[0297.110] SetEvent (hEvent=0x14c) returned 1
	[0297.110] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.112] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.129] SetEvent (hEvent=0x124) returned 1
	[0297.129] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.157] SwitchToThread () returned 1
	[0297.163] SetEvent (hEvent=0x124) returned 1
	[0297.163] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.165] SetEvent (hEvent=0x124) returned 1
	[0297.165] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.166] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.227] SetEvent (hEvent=0x174) returned 1
	[0297.227] SetEvent (hEvent=0x104) returned 1
	[0297.227] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.230] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.246] SetEvent (hEvent=0x124) returned 1
	[0297.246] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.288] SetEvent (hEvent=0x124) returned 1
	[0297.288] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.293] SetEvent (hEvent=0x124) returned 1
	[0297.293] SwitchToThread () returned 1
	[0297.294] SetEvent (hEvent=0x124) returned 1
	[0297.294] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.294] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.369] SetEvent (hEvent=0x14c) returned 1
	[0297.369] SetEvent (hEvent=0x174) returned 1
	[0297.369] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.371] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.389] SetEvent (hEvent=0x124) returned 1
	[0297.389] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.462] SetEvent (hEvent=0x124) returned 1
	[0297.462] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.485] SetEvent (hEvent=0x124) returned 1
	[0297.485] SwitchToThread () returned 1
	[0297.485] SetEvent (hEvent=0x124) returned 1
	[0297.485] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.486] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.538] SetEvent (hEvent=0x104) returned 1
	[0297.538] SetEvent (hEvent=0x14c) returned 1
	[0297.538] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.540] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.674] SetEvent (hEvent=0x124) returned 1
	[0297.674] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.726] SetEvent (hEvent=0x124) returned 1
	[0297.726] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.730] SetEvent (hEvent=0x124) returned 1
	[0297.730] SwitchToThread () returned 1
	[0297.731] SetEvent (hEvent=0x124) returned 1
	[0297.731] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.731] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.790] SetEvent (hEvent=0x124) returned 1
	[0297.790] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.806] SetEvent (hEvent=0x104) returned 1
	[0297.806] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.867] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.874] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.905] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.924] SetEvent (hEvent=0x104) returned 1
	[0297.924] SetEvent (hEvent=0x174) returned 1
	[0297.924] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0297.942] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.942] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0297.943] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.943] SetEvent (hEvent=0x104) returned 1
	[0297.943] SetEvent (hEvent=0x174) returned 1
	[0297.944] SetEvent (hEvent=0x14c) returned 1
	[0297.944] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.944] SetEvent (hEvent=0x168) returned 1
	[0297.944] SetEvent (hEvent=0x14c) returned 1
	[0297.945] SetEvent (hEvent=0x124) returned 1
	[0297.945] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.946] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.957] SetEvent (hEvent=0x124) returned 1
	[0297.957] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.957] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.000] SetEvent (hEvent=0x124) returned 1
	[0298.001] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.002] SetEvent (hEvent=0x14c) returned 1
	[0298.002] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.087] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.091] SetEvent (hEvent=0x14c) returned 1
	[0298.091] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.092] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.210] SetEvent (hEvent=0x104) returned 1
	[0298.211] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.211] SetEvent (hEvent=0x104) returned 1
	[0298.211] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.261] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.300] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.315] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.373] SetEvent (hEvent=0x104) returned 1
	[0298.377] SetEvent (hEvent=0x174) returned 1
	[0298.377] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x102
	[0298.399] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.399] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0x1) returned 0x0
	[0298.400] SetEvent (hEvent=0x104) returned 1
	[0298.400] SetEvent (hEvent=0x174) returned 1
	[0298.400] SetEvent (hEvent=0x14c) returned 1
	[0298.400] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.401] SetEvent (hEvent=0x168) returned 1
	[0298.401] SetEvent (hEvent=0x14c) returned 1
	[0298.401] SetEvent (hEvent=0x124) returned 1
	[0298.401] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.403] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.467] SetEvent (hEvent=0x124) returned 1
	[0298.467] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.468] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.508] SetEvent (hEvent=0x124) returned 1
	[0298.508] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.510] SetEvent (hEvent=0x14c) returned 1
	[0298.510] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.600] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.605] SetEvent (hEvent=0x14c) returned 1
	[0298.605] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.606] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.724] SetEvent (hEvent=0x104) returned 1
	[0298.724] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.724] SetEvent (hEvent=0x104) returned 1
	[0298.724] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.738] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.765] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.818] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.819] SetEvent (hEvent=0x104) returned 1
	[0298.819] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.820] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0302.767] SetEvent (hEvent=0x124) returned 1
	[0302.767] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0302.768] SetEvent (hEvent=0x124) returned 1
	[0302.768] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0303.695] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0303.712] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0304.243] SetEvent (hEvent=0x174) returned 1
	[0304.243] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0304.243] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0304.696] SetEvent (hEvent=0x174) returned 1
	[0304.696] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0304.697] SetEvent (hEvent=0x124) returned 1
	[0304.698] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0305.268] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0305.270] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0305.447] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0305.690] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0306.059] SetEvent (hEvent=0x174) returned 1
	[0306.059] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0306.060] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0306.747] SetEvent (hEvent=0x174) returned 1
	[0306.747] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0306.748] SetEvent (hEvent=0x124) returned 1
	[0306.749] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0307.874] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0307.880] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0308.227] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0309.298] SetEvent (hEvent=0x174) returned 1
	[0309.298] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0309.298] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0309.912] SetEvent (hEvent=0x174) returned 1
	[0309.912] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0309.959] SetEvent (hEvent=0x124) returned 1
	[0309.959] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0310.567] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0310.574] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0310.733] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0311.091] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0311.202] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0311.274] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0311.321] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0311.342] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0311.363] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0311.387] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0311.423] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0311.507] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0311.564] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0311.685] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0312.023] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0312.093] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0312.164] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0312.229] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0313.089] SetEvent (hEvent=0x14c) returned 1
	[0313.089] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0313.090] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0313.092] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0314.492] SetEvent (hEvent=0x174) returned 1
	[0314.492] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0314.495] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0315.107] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0315.932] SetEvent (hEvent=0x124) returned 1
	[0315.932] SetEvent (hEvent=0x104) returned 1
	[0315.932] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0315.933] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0316.584] SetEvent (hEvent=0x174) returned 1
	[0316.584] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) returned 0x0
	[0316.629] SetEvent (hEvent=0x14c) returned 1
	[0316.629] WaitForSingleObject (hHandle=0x12c, dwMilliseconds=0xffffffff) 

Thread:
	id = 10
	os_tid = 0x1278

	[0109.552] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x328cff58, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x328cff58*=0x148) returned 1
	[0109.553] SetEvent (hEvent=0x124) returned 1
	[0109.553] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x14c
	[0109.553] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0197.247] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0197.252] SetEvent (hEvent=0x124) returned 1
	[0197.252] SetEvent (hEvent=0x104) returned 1
	[0197.252] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0197.309] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0197.319] SetEvent (hEvent=0x124) returned 1
	[0197.319] SetEvent (hEvent=0x104) returned 1
	[0197.320] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0197.402] SetEvent (hEvent=0x124) returned 1
	[0197.402] SetEvent (hEvent=0x12c) returned 1
	[0197.402] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0197.410] SetEvent (hEvent=0x124) returned 1
	[0197.411] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0197.421] SetEvent (hEvent=0x124) returned 1
	[0197.421] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0202.472] SetEvent (hEvent=0x104) returned 1
	[0202.472] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0202.478] SetEvent (hEvent=0x124) returned 1
	[0202.479] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0208.415] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0208.419] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0208.431] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0208.509] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0208.610] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0208.701] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0208.736] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0208.842] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0208.882] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0208.974] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0209.016] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0209.053] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0209.081] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0209.218] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0209.380] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0209.526] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0209.759] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0209.795] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0209.837] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0209.992] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0210.162] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0210.551] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0210.612] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0210.638] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0210.667] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0210.783] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0210.977] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0210.999] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0211.235] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0211.340] SetEvent (hEvent=0x104) returned 1
	[0211.340] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0211.341] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0214.815] SetEvent (hEvent=0x104) returned 1
	[0214.815] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0214.818] SetEvent (hEvent=0x124) returned 1
	[0214.818] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0216.903] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0216.908] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0216.929] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0217.074] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0217.264] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0217.282] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0217.378] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0217.406] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0217.440] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0217.516] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0217.596] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0217.837] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0218.183] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0218.247] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0218.320] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0218.376] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0218.557] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0218.857] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.311] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.375] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.562] SetEvent (hEvent=0x104) returned 1
	[0219.562] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0219.562] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0220.955] SetEvent (hEvent=0x104) returned 1
	[0220.955] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0220.958] SetEvent (hEvent=0x124) returned 1
	[0220.958] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0223.310] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0223.318] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0223.340] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0223.404] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0223.417] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0223.533] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0223.642] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0223.652] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0223.707] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0223.771] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0223.802] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0223.879] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0223.984] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0224.010] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0224.027] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0224.211] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0224.361] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0224.691] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0224.712] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0224.874] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0225.818] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0226.020] SetEvent (hEvent=0x104) returned 1
	[0226.020] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0226.020] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0226.870] SetEvent (hEvent=0x104) returned 1
	[0226.870] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0226.873] SetEvent (hEvent=0x124) returned 1
	[0226.874] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0228.116] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0228.149] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0228.206] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0229.051] SetEvent (hEvent=0x104) returned 1
	[0229.051] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0229.051] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0231.315] SetEvent (hEvent=0x104) returned 1
	[0231.315] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0231.316] SetEvent (hEvent=0x124) returned 1
	[0231.316] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0233.758] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0233.760] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0233.919] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0233.996] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0234.064] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0234.153] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0234.268] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0234.497] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0234.598] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0234.681] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0234.745] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0234.796] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0234.855] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0234.875] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0234.949] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0235.045] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0235.160] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0235.192] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0235.235] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0235.247] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0235.285] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0235.306] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0235.333] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0235.384] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0235.395] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0235.433] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0235.500] SetEvent (hEvent=0x104) returned 1
	[0235.500] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0235.500] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0236.938] SetEvent (hEvent=0x104) returned 1
	[0236.938] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0236.952] SetEvent (hEvent=0x124) returned 1
	[0236.953] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0238.279] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0238.323] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0238.333] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0238.395] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0238.493] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0238.608] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0238.726] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0238.775] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0238.843] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0238.934] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0238.997] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0239.216] SetEvent (hEvent=0x104) returned 1
	[0239.216] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0239.217] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0239.375] SetEvent (hEvent=0x104) returned 1
	[0239.375] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0239.414] SetEvent (hEvent=0x104) returned 1
	[0239.414] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0239.421] SetEvent (hEvent=0x104) returned 1
	[0239.421] SwitchToThread () returned 1
	[0239.422] SetEvent (hEvent=0x104) returned 1
	[0239.422] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0239.422] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0239.771] SetEvent (hEvent=0x124) returned 1
	[0239.771] SetEvent (hEvent=0x174) returned 1
	[0239.771] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0239.773] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0239.830] SetEvent (hEvent=0x104) returned 1
	[0239.830] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0239.834] SetEvent (hEvent=0x104) returned 1
	[0239.834] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0239.835] SetEvent (hEvent=0x104) returned 1
	[0239.835] SwitchToThread () returned 1
	[0239.836] SetEvent (hEvent=0x104) returned 1
	[0239.836] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0239.837] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0240.034] SetEvent (hEvent=0x12c) returned 1
	[0240.034] SetEvent (hEvent=0x124) returned 1
	[0240.034] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0240.036] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0240.070] SetEvent (hEvent=0x104) returned 1
	[0240.070] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0240.095] SetEvent (hEvent=0x104) returned 1
	[0240.095] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0240.101] SetEvent (hEvent=0x104) returned 1
	[0240.101] SwitchToThread () returned 1
	[0240.101] SetEvent (hEvent=0x104) returned 1
	[0240.101] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0240.101] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0240.348] SetEvent (hEvent=0x174) returned 1
	[0240.348] SetEvent (hEvent=0x12c) returned 1
	[0240.348] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0240.360] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0240.464] SetEvent (hEvent=0x104) returned 1
	[0240.464] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0240.487] SetEvent (hEvent=0x104) returned 1
	[0240.487] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0240.489] SetEvent (hEvent=0x104) returned 1
	[0240.489] SwitchToThread () returned 1
	[0240.489] SetEvent (hEvent=0x104) returned 1
	[0240.489] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0240.490] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0240.685] SetEvent (hEvent=0x124) returned 1
	[0240.685] SetEvent (hEvent=0x174) returned 1
	[0240.685] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0240.686] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0240.699] SetEvent (hEvent=0x104) returned 1
	[0240.699] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0240.732] SetEvent (hEvent=0x104) returned 1
	[0240.732] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0240.741] SetEvent (hEvent=0x104) returned 1
	[0240.741] SwitchToThread () returned 1
	[0240.741] SetEvent (hEvent=0x104) returned 1
	[0240.741] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0240.741] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0241.414] SetEvent (hEvent=0x12c) returned 1
	[0241.414] SetEvent (hEvent=0x124) returned 1
	[0241.414] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0242.802] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0242.894] SetEvent (hEvent=0x104) returned 1
	[0242.894] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0242.934] SetEvent (hEvent=0x104) returned 1
	[0242.934] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0242.970] SetEvent (hEvent=0x104) returned 1
	[0242.970] SwitchToThread () returned 1
	[0243.043] SetEvent (hEvent=0x104) returned 1
	[0243.043] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0243.050] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0243.339] SetEvent (hEvent=0x174) returned 1
	[0243.339] SetEvent (hEvent=0x12c) returned 1
	[0243.339] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0243.354] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0243.507] SetEvent (hEvent=0x104) returned 1
	[0243.507] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0243.629] SetEvent (hEvent=0x104) returned 1
	[0243.629] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0243.640] SetEvent (hEvent=0x104) returned 1
	[0243.640] SwitchToThread () returned 1
	[0243.676] SetEvent (hEvent=0x104) returned 1
	[0243.676] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0244.027] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0244.239] SetEvent (hEvent=0x174) returned 1
	[0244.239] SetEvent (hEvent=0x124) returned 1
	[0244.239] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0244.319] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0244.467] SetEvent (hEvent=0x104) returned 1
	[0244.467] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0244.534] SetEvent (hEvent=0x104) returned 1
	[0244.534] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0244.560] SetEvent (hEvent=0x104) returned 1
	[0244.560] SwitchToThread () returned 1
	[0244.588] SetEvent (hEvent=0x104) returned 1
	[0244.588] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0244.689] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0244.956] SetEvent (hEvent=0x12c) returned 1
	[0244.956] SetEvent (hEvent=0x174) returned 1
	[0244.956] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0245.021] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0245.102] SetEvent (hEvent=0x104) returned 1
	[0245.102] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0245.162] SetEvent (hEvent=0x104) returned 1
	[0245.162] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0245.241] SetEvent (hEvent=0x104) returned 1
	[0245.241] SwitchToThread () returned 1
	[0245.282] SetEvent (hEvent=0x104) returned 1
	[0245.282] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0245.293] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0246.028] SetEvent (hEvent=0x124) returned 1
	[0246.028] SetEvent (hEvent=0x12c) returned 1
	[0246.028] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0246.042] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0246.410] SetEvent (hEvent=0x104) returned 1
	[0246.410] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0246.480] SetEvent (hEvent=0x104) returned 1
	[0246.480] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0246.529] SetEvent (hEvent=0x104) returned 1
	[0246.529] SwitchToThread () returned 1
	[0246.564] SetEvent (hEvent=0x104) returned 1
	[0246.564] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0246.605] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0247.002] SetEvent (hEvent=0x174) returned 1
	[0247.002] SetEvent (hEvent=0x124) returned 1
	[0247.002] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0247.127] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0247.280] SetEvent (hEvent=0x104) returned 1
	[0247.280] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0247.353] SetEvent (hEvent=0x104) returned 1
	[0247.353] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0247.449] SetEvent (hEvent=0x104) returned 1
	[0247.449] SwitchToThread () returned 1
	[0247.450] SetEvent (hEvent=0x104) returned 1
	[0247.450] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0247.480] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0248.037] SetEvent (hEvent=0x12c) returned 1
	[0248.037] SetEvent (hEvent=0x174) returned 1
	[0248.037] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0248.096] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0248.268] SetEvent (hEvent=0x104) returned 1
	[0248.269] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0248.316] SetEvent (hEvent=0x104) returned 1
	[0248.317] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0248.350] SetEvent (hEvent=0x104) returned 1
	[0248.350] SwitchToThread () returned 1
	[0248.358] SetEvent (hEvent=0x104) returned 1
	[0248.358] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0248.423] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0248.879] SetEvent (hEvent=0x124) returned 1
	[0248.879] SetEvent (hEvent=0x12c) returned 1
	[0248.879] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0248.997] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0249.207] SetEvent (hEvent=0x104) returned 1
	[0249.207] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0249.241] SetEvent (hEvent=0x104) returned 1
	[0249.241] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0249.271] SetEvent (hEvent=0x104) returned 1
	[0249.271] SwitchToThread () returned 1
	[0249.423] SetEvent (hEvent=0x104) returned 1
	[0249.423] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0249.534] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0249.758] SetEvent (hEvent=0x174) returned 1
	[0249.758] SetEvent (hEvent=0x124) returned 1
	[0249.758] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0249.806] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0249.985] SetEvent (hEvent=0x104) returned 1
	[0249.985] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0250.136] SetEvent (hEvent=0x104) returned 1
	[0250.136] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0250.164] SetEvent (hEvent=0x104) returned 1
	[0250.164] SwitchToThread () returned 1
	[0250.168] SetEvent (hEvent=0x104) returned 1
	[0250.168] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0250.197] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0250.510] SetEvent (hEvent=0x12c) returned 1
	[0250.510] SetEvent (hEvent=0x174) returned 1
	[0250.510] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0250.598] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0250.798] SetEvent (hEvent=0x104) returned 1
	[0250.798] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0250.883] SetEvent (hEvent=0x104) returned 1
	[0250.883] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0250.942] SetEvent (hEvent=0x104) returned 1
	[0250.942] SwitchToThread () returned 1
	[0250.990] SetEvent (hEvent=0x104) returned 1
	[0250.990] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0251.053] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0251.269] SetEvent (hEvent=0x124) returned 1
	[0251.269] SetEvent (hEvent=0x12c) returned 1
	[0251.269] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0251.282] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0251.553] SetEvent (hEvent=0x104) returned 1
	[0251.554] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0251.591] SetEvent (hEvent=0x104) returned 1
	[0251.591] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0251.668] SetEvent (hEvent=0x104) returned 1
	[0251.668] SwitchToThread () returned 1
	[0251.704] SetEvent (hEvent=0x104) returned 1
	[0251.704] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0251.716] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0252.156] SetEvent (hEvent=0x174) returned 1
	[0252.156] SetEvent (hEvent=0x124) returned 1
	[0252.157] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0252.244] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0252.479] SetEvent (hEvent=0x104) returned 1
	[0252.480] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0252.519] SetEvent (hEvent=0x104) returned 1
	[0252.519] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0252.525] SetEvent (hEvent=0x104) returned 1
	[0252.525] SwitchToThread () returned 1
	[0252.526] SetEvent (hEvent=0x104) returned 1
	[0252.526] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0252.554] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0252.800] SetEvent (hEvent=0x12c) returned 1
	[0252.800] SetEvent (hEvent=0x174) returned 1
	[0252.800] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0252.806] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0252.868] SetEvent (hEvent=0x104) returned 1
	[0252.868] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0252.909] SetEvent (hEvent=0x104) returned 1
	[0252.926] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0253.027] SetEvent (hEvent=0x104) returned 1
	[0253.027] SwitchToThread () returned 1
	[0253.119] SetEvent (hEvent=0x104) returned 1
	[0253.119] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0253.209] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0253.524] SetEvent (hEvent=0x124) returned 1
	[0253.524] SetEvent (hEvent=0x12c) returned 1
	[0253.524] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0253.642] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0253.855] SetEvent (hEvent=0x104) returned 1
	[0253.855] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0253.923] SetEvent (hEvent=0x104) returned 1
	[0253.923] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0253.928] SetEvent (hEvent=0x104) returned 1
	[0253.929] SwitchToThread () returned 1
	[0253.951] SetEvent (hEvent=0x104) returned 1
	[0253.951] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0253.990] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0254.161] SetEvent (hEvent=0x12c) returned 1
	[0254.161] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0254.199] SetEvent (hEvent=0x174) returned 1
	[0254.199] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0254.230] SetEvent (hEvent=0x174) returned 1
	[0254.230] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0254.346] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0254.506] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0254.652] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0254.745] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0254.794] SetEvent (hEvent=0x174) returned 1
	[0254.794] SetEvent (hEvent=0x124) returned 1
	[0254.794] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0254.805] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0254.805] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0254.836] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0254.836] SetEvent (hEvent=0x174) returned 1
	[0254.836] SetEvent (hEvent=0x124) returned 1
	[0254.836] SetEvent (hEvent=0x12c) returned 1
	[0254.836] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0254.869] SetEvent (hEvent=0x168) returned 1
	[0254.869] SetEvent (hEvent=0x12c) returned 1
	[0254.869] SetEvent (hEvent=0x104) returned 1
	[0254.869] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0254.951] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0254.985] SetEvent (hEvent=0x104) returned 1
	[0254.985] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0254.994] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0255.139] SetEvent (hEvent=0x104) returned 1
	[0255.139] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0255.144] SetEvent (hEvent=0x12c) returned 1
	[0255.144] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0256.221] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0256.229] SetEvent (hEvent=0x12c) returned 1
	[0256.229] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0256.231] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0256.517] SetEvent (hEvent=0x174) returned 1
	[0256.517] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0256.517] SetEvent (hEvent=0x174) returned 1
	[0256.517] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0256.527] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0256.558] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0256.568] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0257.112] SetEvent (hEvent=0x174) returned 1
	[0257.112] SetEvent (hEvent=0x124) returned 1
	[0257.112] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0257.251] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0257.252] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0258.002] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0258.002] SetEvent (hEvent=0x174) returned 1
	[0258.002] SetEvent (hEvent=0x124) returned 1
	[0258.002] SetEvent (hEvent=0x12c) returned 1
	[0258.002] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0258.023] SetEvent (hEvent=0x168) returned 1
	[0258.023] SetEvent (hEvent=0x12c) returned 1
	[0258.024] SetEvent (hEvent=0x104) returned 1
	[0258.024] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0258.117] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0258.188] SetEvent (hEvent=0x104) returned 1
	[0258.188] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0258.257] SetEvent (hEvent=0x104) returned 1
	[0258.257] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0258.263] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0258.491] SetEvent (hEvent=0x104) returned 1
	[0258.491] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0258.546] SetEvent (hEvent=0x12c) returned 1
	[0258.546] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0258.973] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0259.190] SetEvent (hEvent=0x12c) returned 1
	[0259.191] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0259.255] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0259.869] SetEvent (hEvent=0x174) returned 1
	[0259.869] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0259.890] SetEvent (hEvent=0x174) returned 1
	[0259.890] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0259.962] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0260.212] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0260.368] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0260.473] SetEvent (hEvent=0x104) returned 1
	[0260.473] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0260.516] SetEvent (hEvent=0x174) returned 1
	[0260.516] SetEvent (hEvent=0x124) returned 1
	[0260.516] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0260.557] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0260.557] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0260.578] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0260.578] SetEvent (hEvent=0x174) returned 1
	[0260.578] SetEvent (hEvent=0x124) returned 1
	[0260.578] SetEvent (hEvent=0x12c) returned 1
	[0260.578] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0260.645] SetEvent (hEvent=0x168) returned 1
	[0260.645] SetEvent (hEvent=0x12c) returned 1
	[0260.645] SetEvent (hEvent=0x104) returned 1
	[0260.645] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0260.700] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0260.778] SetEvent (hEvent=0x104) returned 1
	[0260.778] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0260.815] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0260.989] SetEvent (hEvent=0x104) returned 1
	[0260.989] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0261.041] SetEvent (hEvent=0x12c) returned 1
	[0261.041] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0261.832] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0261.834] SetEvent (hEvent=0x12c) returned 1
	[0261.834] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0261.834] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0262.951] SetEvent (hEvent=0x124) returned 1
	[0262.951] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0262.961] SetEvent (hEvent=0x124) returned 1
	[0262.961] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0263.158] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0263.377] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0263.549] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0263.640] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0263.823] SetEvent (hEvent=0x124) returned 1
	[0263.824] SetEvent (hEvent=0x174) returned 1
	[0263.824] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0263.851] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0263.851] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0263.905] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0263.905] SetEvent (hEvent=0x124) returned 1
	[0263.905] SetEvent (hEvent=0x174) returned 1
	[0263.905] SetEvent (hEvent=0x12c) returned 1
	[0263.905] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0263.965] SetEvent (hEvent=0x168) returned 1
	[0263.965] SetEvent (hEvent=0x12c) returned 1
	[0263.965] SetEvent (hEvent=0x104) returned 1
	[0263.965] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0264.036] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0264.190] SetEvent (hEvent=0x104) returned 1
	[0264.190] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0264.219] SetEvent (hEvent=0x104) returned 1
	[0264.219] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0264.255] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0264.402] SetEvent (hEvent=0x104) returned 1
	[0264.402] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0264.417] SetEvent (hEvent=0x12c) returned 1
	[0264.418] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0265.756] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0265.770] SetEvent (hEvent=0x12c) returned 1
	[0265.770] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0266.897] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0267.779] SetEvent (hEvent=0x124) returned 1
	[0267.779] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0267.835] SetEvent (hEvent=0x124) returned 1
	[0267.835] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0268.075] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0268.469] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0268.791] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0269.690] SetEvent (hEvent=0x124) returned 1
	[0269.692] SetEvent (hEvent=0x174) returned 1
	[0269.692] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0269.772] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0269.772] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0269.779] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0269.779] SetEvent (hEvent=0x124) returned 1
	[0269.779] SetEvent (hEvent=0x174) returned 1
	[0269.779] SetEvent (hEvent=0x12c) returned 1
	[0269.779] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0269.935] SetEvent (hEvent=0x168) returned 1
	[0269.935] SetEvent (hEvent=0x12c) returned 1
	[0269.935] SetEvent (hEvent=0x104) returned 1
	[0269.935] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0270.008] SetEvent (hEvent=0x104) returned 1
	[0270.009] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0270.028] SetEvent (hEvent=0x104) returned 1
	[0270.028] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0270.061] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0270.301] SetEvent (hEvent=0x104) returned 1
	[0270.301] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0270.349] SetEvent (hEvent=0x12c) returned 1
	[0270.349] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0271.122] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0271.301] SetEvent (hEvent=0x12c) returned 1
	[0271.302] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0271.318] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0273.134] SetEvent (hEvent=0x124) returned 1
	[0273.134] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0273.181] SetEvent (hEvent=0x124) returned 1
	[0273.181] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0273.297] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0273.329] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0273.332] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0274.095] SetEvent (hEvent=0x124) returned 1
	[0274.096] SetEvent (hEvent=0x174) returned 1
	[0274.096] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0274.118] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0274.118] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0274.134] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0274.134] SetEvent (hEvent=0x124) returned 1
	[0274.134] SetEvent (hEvent=0x174) returned 1
	[0274.134] SetEvent (hEvent=0x12c) returned 1
	[0274.134] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0274.160] SetEvent (hEvent=0x168) returned 1
	[0274.161] SetEvent (hEvent=0x12c) returned 1
	[0274.161] SetEvent (hEvent=0x104) returned 1
	[0274.161] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0274.178] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0274.207] SetEvent (hEvent=0x104) returned 1
	[0274.207] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0274.210] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0274.280] SetEvent (hEvent=0x104) returned 1
	[0274.280] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0274.283] SetEvent (hEvent=0x12c) returned 1
	[0274.283] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.411] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.426] SetEvent (hEvent=0x12c) returned 1
	[0275.426] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.427] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.622] SetEvent (hEvent=0x124) returned 1
	[0275.622] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.623] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.656] SetEvent (hEvent=0x104) returned 1
	[0275.656] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.656] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.695] SetEvent (hEvent=0x104) returned 1
	[0275.695] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.698] SetEvent (hEvent=0x124) returned 1
	[0275.698] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.832] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.833] SetEvent (hEvent=0x124) returned 1
	[0275.833] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.834] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.988] SetEvent (hEvent=0x174) returned 1
	[0275.989] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0275.997] SetEvent (hEvent=0x174) returned 1
	[0275.997] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0276.034] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0276.078] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0276.144] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0276.173] SetEvent (hEvent=0x174) returned 1
	[0276.173] SetEvent (hEvent=0x12c) returned 1
	[0276.173] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0276.176] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0276.176] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x0
	[0276.177] SetEvent (hEvent=0x174) returned 1
	[0276.177] SetEvent (hEvent=0x12c) returned 1
	[0276.177] SetEvent (hEvent=0x124) returned 1
	[0276.177] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0276.178] SetEvent (hEvent=0x168) returned 1
	[0276.178] SetEvent (hEvent=0x124) returned 1
	[0276.178] SetEvent (hEvent=0x104) returned 1
	[0276.178] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0276.440] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0276.529] SetEvent (hEvent=0x104) returned 1
	[0276.529] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0276.626] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0276.907] SetEvent (hEvent=0x104) returned 1
	[0276.907] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0276.979] SetEvent (hEvent=0x124) returned 1
	[0276.979] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0277.125] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0277.152] SetEvent (hEvent=0x124) returned 1
	[0277.152] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0277.192] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0277.799] SetEvent (hEvent=0x174) returned 1
	[0277.799] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0277.873] SetEvent (hEvent=0x174) returned 1
	[0277.873] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0277.964] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0278.088] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0278.182] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0278.256] SetEvent (hEvent=0x174) returned 1
	[0278.257] SetEvent (hEvent=0x12c) returned 1
	[0278.257] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0278.286] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0278.286] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0278.363] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0278.363] SetEvent (hEvent=0x174) returned 1
	[0278.363] SetEvent (hEvent=0x12c) returned 1
	[0278.363] SetEvent (hEvent=0x124) returned 1
	[0278.363] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0278.396] SetEvent (hEvent=0x168) returned 1
	[0278.396] SetEvent (hEvent=0x124) returned 1
	[0278.396] SetEvent (hEvent=0x104) returned 1
	[0278.396] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0278.454] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0278.464] SetEvent (hEvent=0x104) returned 1
	[0278.464] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0278.464] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0278.510] SetEvent (hEvent=0x104) returned 1
	[0278.510] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0278.513] SetEvent (hEvent=0x124) returned 1
	[0278.513] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0278.641] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0278.646] SetEvent (hEvent=0x124) returned 1
	[0278.646] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0278.647] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0278.899] SetEvent (hEvent=0x174) returned 1
	[0278.899] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0278.900] SetEvent (hEvent=0x174) returned 1
	[0278.900] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0278.938] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0278.975] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.054] SetEvent (hEvent=0x104) returned 1
	[0279.054] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.060] SetEvent (hEvent=0x174) returned 1
	[0279.060] SetEvent (hEvent=0x12c) returned 1
	[0279.061] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0279.079] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.079] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x0
	[0279.079] SetEvent (hEvent=0x174) returned 1
	[0279.079] SetEvent (hEvent=0x12c) returned 1
	[0279.079] SetEvent (hEvent=0x124) returned 1
	[0279.079] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.081] SetEvent (hEvent=0x168) returned 1
	[0279.081] SetEvent (hEvent=0x124) returned 1
	[0279.081] SetEvent (hEvent=0x104) returned 1
	[0279.081] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.084] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.100] SetEvent (hEvent=0x104) returned 1
	[0279.100] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.101] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.144] SetEvent (hEvent=0x104) returned 1
	[0279.144] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.146] SetEvent (hEvent=0x124) returned 1
	[0279.146] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.267] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.270] SetEvent (hEvent=0x124) returned 1
	[0279.270] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.271] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.668] SetEvent (hEvent=0x174) returned 1
	[0279.668] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.668] SetEvent (hEvent=0x174) returned 1
	[0279.668] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.679] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.706] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.759] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.780] SetEvent (hEvent=0x174) returned 1
	[0279.780] SetEvent (hEvent=0x12c) returned 1
	[0279.780] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0279.787] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.787] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0279.788] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.788] SetEvent (hEvent=0x174) returned 1
	[0279.789] SetEvent (hEvent=0x12c) returned 1
	[0279.789] SetEvent (hEvent=0x124) returned 1
	[0279.789] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.790] SetEvent (hEvent=0x168) returned 1
	[0279.790] SetEvent (hEvent=0x124) returned 1
	[0279.790] SetEvent (hEvent=0x104) returned 1
	[0279.790] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.805] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.825] SetEvent (hEvent=0x104) returned 1
	[0279.825] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.827] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.859] SetEvent (hEvent=0x104) returned 1
	[0279.859] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.861] SetEvent (hEvent=0x124) returned 1
	[0279.861] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.980] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.981] SetEvent (hEvent=0x124) returned 1
	[0279.981] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0279.982] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.110] SetEvent (hEvent=0x174) returned 1
	[0280.110] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.110] SetEvent (hEvent=0x174) returned 1
	[0280.110] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.119] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.150] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.202] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.237] SetEvent (hEvent=0x174) returned 1
	[0280.238] SetEvent (hEvent=0x12c) returned 1
	[0280.238] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x0
	[0280.238] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x0
	[0280.238] SetEvent (hEvent=0x174) returned 1
	[0280.238] SetEvent (hEvent=0x12c) returned 1
	[0280.238] SetEvent (hEvent=0x124) returned 1
	[0280.239] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.240] SetEvent (hEvent=0x168) returned 1
	[0280.240] SetEvent (hEvent=0x124) returned 1
	[0280.240] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.278] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.311] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.394] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.412] SetEvent (hEvent=0x124) returned 1
	[0280.413] SwitchToThread () returned 1
	[0280.415] SetEvent (hEvent=0x124) returned 1
	[0280.415] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0280.432] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.432] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x0
	[0280.433] SetEvent (hEvent=0x12c) returned 1
	[0280.433] SetEvent (hEvent=0x124) returned 1
	[0280.433] SetEvent (hEvent=0x174) returned 1
	[0280.433] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.434] SetEvent (hEvent=0x168) returned 1
	[0280.434] SetEvent (hEvent=0x174) returned 1
	[0280.434] SetEvent (hEvent=0x104) returned 1
	[0280.434] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.435] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.446] SetEvent (hEvent=0x104) returned 1
	[0280.446] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.448] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.475] SetEvent (hEvent=0x104) returned 1
	[0280.475] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.477] SetEvent (hEvent=0x174) returned 1
	[0280.477] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.595] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.623] SetEvent (hEvent=0x174) returned 1
	[0280.623] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.623] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.770] SetEvent (hEvent=0x12c) returned 1
	[0280.770] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.771] SetEvent (hEvent=0x12c) returned 1
	[0280.772] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.785] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.811] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.854] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.899] SetEvent (hEvent=0x12c) returned 1
	[0280.900] SetEvent (hEvent=0x124) returned 1
	[0280.900] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0280.925] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.926] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0280.928] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.928] SetEvent (hEvent=0x12c) returned 1
	[0280.928] SetEvent (hEvent=0x124) returned 1
	[0280.928] SetEvent (hEvent=0x174) returned 1
	[0280.928] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.929] SetEvent (hEvent=0x168) returned 1
	[0280.929] SetEvent (hEvent=0x174) returned 1
	[0280.929] SetEvent (hEvent=0x104) returned 1
	[0280.929] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.931] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.948] SetEvent (hEvent=0x104) returned 1
	[0280.948] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0280.949] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0281.003] SetEvent (hEvent=0x104) returned 1
	[0281.003] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0281.005] SetEvent (hEvent=0x174) returned 1
	[0281.005] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0281.106] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0281.107] SetEvent (hEvent=0x174) returned 1
	[0281.107] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0281.107] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0281.559] SetEvent (hEvent=0x174) returned 1
	[0281.559] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0281.560] SetEvent (hEvent=0x174) returned 1
	[0281.560] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0281.576] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0281.617] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0281.633] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0281.769] SetEvent (hEvent=0x174) returned 1
	[0281.769] SetEvent (hEvent=0x124) returned 1
	[0281.769] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0281.793] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0281.794] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0281.799] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0281.799] SetEvent (hEvent=0x174) returned 1
	[0281.799] SetEvent (hEvent=0x124) returned 1
	[0281.800] SetEvent (hEvent=0x12c) returned 1
	[0281.800] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0281.800] SetEvent (hEvent=0x168) returned 1
	[0281.800] SetEvent (hEvent=0x12c) returned 1
	[0281.800] SetEvent (hEvent=0x104) returned 1
	[0281.800] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0281.802] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0281.841] SetEvent (hEvent=0x104) returned 1
	[0281.841] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0281.844] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0281.885] SetEvent (hEvent=0x104) returned 1
	[0281.885] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0281.888] SetEvent (hEvent=0x12c) returned 1
	[0281.888] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.024] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.026] SetEvent (hEvent=0x12c) returned 1
	[0282.026] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.027] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.250] SetEvent (hEvent=0x174) returned 1
	[0282.250] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.251] SetEvent (hEvent=0x174) returned 1
	[0282.251] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.266] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.304] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.367] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.420] SetEvent (hEvent=0x174) returned 1
	[0282.420] SetEvent (hEvent=0x124) returned 1
	[0282.420] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0282.438] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.438] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0282.440] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.440] SetEvent (hEvent=0x174) returned 1
	[0282.440] SetEvent (hEvent=0x124) returned 1
	[0282.440] SetEvent (hEvent=0x12c) returned 1
	[0282.440] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.440] SetEvent (hEvent=0x168) returned 1
	[0282.440] SetEvent (hEvent=0x12c) returned 1
	[0282.440] SetEvent (hEvent=0x104) returned 1
	[0282.441] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.442] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.450] SetEvent (hEvent=0x104) returned 1
	[0282.450] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.453] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.480] SetEvent (hEvent=0x104) returned 1
	[0282.480] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.482] SetEvent (hEvent=0x12c) returned 1
	[0282.482] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.576] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.578] SetEvent (hEvent=0x12c) returned 1
	[0282.578] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.579] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.714] SetEvent (hEvent=0x174) returned 1
	[0282.714] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.715] SetEvent (hEvent=0x174) returned 1
	[0282.715] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.727] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.755] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.788] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.835] SetEvent (hEvent=0x174) returned 1
	[0282.835] SetEvent (hEvent=0x124) returned 1
	[0282.835] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0282.853] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.853] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0282.855] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.856] SetEvent (hEvent=0x174) returned 1
	[0282.856] SetEvent (hEvent=0x124) returned 1
	[0282.856] SetEvent (hEvent=0x12c) returned 1
	[0282.856] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.856] SetEvent (hEvent=0x168) returned 1
	[0282.856] SetEvent (hEvent=0x12c) returned 1
	[0282.856] SetEvent (hEvent=0x104) returned 1
	[0282.857] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.858] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.872] SetEvent (hEvent=0x104) returned 1
	[0282.872] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.873] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.908] SetEvent (hEvent=0x104) returned 1
	[0282.908] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.910] SetEvent (hEvent=0x12c) returned 1
	[0282.910] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0282.993] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.009] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.042] SetEvent (hEvent=0x104) returned 1
	[0283.043] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.044] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.048] SetEvent (hEvent=0x104) returned 1
	[0283.048] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.049] SetEvent (hEvent=0x124) returned 1
	[0283.049] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.144] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.145] SetEvent (hEvent=0x124) returned 1
	[0283.145] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.146] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.340] SetEvent (hEvent=0x174) returned 1
	[0283.340] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.340] SetEvent (hEvent=0x174) returned 1
	[0283.340] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.349] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.379] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.439] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.457] SetEvent (hEvent=0x174) returned 1
	[0283.457] SetEvent (hEvent=0x12c) returned 1
	[0283.457] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0283.460] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.460] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x0
	[0283.461] SetEvent (hEvent=0x174) returned 1
	[0283.461] SetEvent (hEvent=0x12c) returned 1
	[0283.461] SetEvent (hEvent=0x124) returned 1
	[0283.461] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.462] SetEvent (hEvent=0x168) returned 1
	[0283.462] SetEvent (hEvent=0x124) returned 1
	[0283.462] SetEvent (hEvent=0x104) returned 1
	[0283.462] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.474] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.482] SetEvent (hEvent=0x104) returned 1
	[0283.482] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.482] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.512] SetEvent (hEvent=0x104) returned 1
	[0283.512] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.513] SetEvent (hEvent=0x124) returned 1
	[0283.513] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.600] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.601] SetEvent (hEvent=0x124) returned 1
	[0283.601] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.602] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.778] SetEvent (hEvent=0x174) returned 1
	[0283.778] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.778] SetEvent (hEvent=0x174) returned 1
	[0283.778] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.815] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.856] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.917] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.938] SetEvent (hEvent=0x174) returned 1
	[0283.939] SetEvent (hEvent=0x12c) returned 1
	[0283.939] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0283.957] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.957] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0283.960] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.960] SetEvent (hEvent=0x174) returned 1
	[0283.960] SetEvent (hEvent=0x12c) returned 1
	[0283.960] SetEvent (hEvent=0x124) returned 1
	[0283.960] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.961] SetEvent (hEvent=0x168) returned 1
	[0283.961] SetEvent (hEvent=0x124) returned 1
	[0283.961] SetEvent (hEvent=0x104) returned 1
	[0283.961] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.963] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.994] SetEvent (hEvent=0x104) returned 1
	[0283.994] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0283.995] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.034] SetEvent (hEvent=0x104) returned 1
	[0284.034] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.036] SetEvent (hEvent=0x124) returned 1
	[0284.036] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.148] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.149] SetEvent (hEvent=0x124) returned 1
	[0284.149] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.150] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.210] SetEvent (hEvent=0x104) returned 1
	[0284.210] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.211] SetEvent (hEvent=0x104) returned 1
	[0284.211] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.376] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.383] SetEvent (hEvent=0x104) returned 1
	[0284.383] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.386] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.535] SetEvent (hEvent=0x124) returned 1
	[0284.536] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.538] SetEvent (hEvent=0x124) returned 1
	[0284.538] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.553] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.581] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.637] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.658] SetEvent (hEvent=0x124) returned 1
	[0284.659] SetEvent (hEvent=0x174) returned 1
	[0284.659] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0284.663] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.663] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0284.667] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.668] SetEvent (hEvent=0x124) returned 1
	[0284.668] SetEvent (hEvent=0x174) returned 1
	[0284.668] SetEvent (hEvent=0x104) returned 1
	[0284.668] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.670] SetEvent (hEvent=0x168) returned 1
	[0284.670] SetEvent (hEvent=0x104) returned 1
	[0284.670] SetEvent (hEvent=0x12c) returned 1
	[0284.670] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.687] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.698] SetEvent (hEvent=0x12c) returned 1
	[0284.698] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.698] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.729] SetEvent (hEvent=0x12c) returned 1
	[0284.729] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.730] SetEvent (hEvent=0x104) returned 1
	[0284.730] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.817] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.819] SetEvent (hEvent=0x104) returned 1
	[0284.819] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.819] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.994] SetEvent (hEvent=0x124) returned 1
	[0284.994] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0284.995] SetEvent (hEvent=0x124) returned 1
	[0284.995] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.004] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.034] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.093] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.112] SetEvent (hEvent=0x124) returned 1
	[0285.112] SetEvent (hEvent=0x174) returned 1
	[0285.112] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0285.129] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.129] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0285.165] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.165] SetEvent (hEvent=0x124) returned 1
	[0285.165] SetEvent (hEvent=0x174) returned 1
	[0285.165] SetEvent (hEvent=0x104) returned 1
	[0285.165] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.172] SetEvent (hEvent=0x168) returned 1
	[0285.172] SetEvent (hEvent=0x104) returned 1
	[0285.172] SetEvent (hEvent=0x12c) returned 1
	[0285.172] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.176] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.183] SetEvent (hEvent=0x12c) returned 1
	[0285.183] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.184] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.208] SetEvent (hEvent=0x12c) returned 1
	[0285.208] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.209] SetEvent (hEvent=0x104) returned 1
	[0285.209] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.304] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.304] SetEvent (hEvent=0x104) returned 1
	[0285.305] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.305] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.586] SetEvent (hEvent=0x124) returned 1
	[0285.586] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.586] SetEvent (hEvent=0x124) returned 1
	[0285.587] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.604] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.644] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.694] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.732] SetEvent (hEvent=0x124) returned 1
	[0285.732] SetEvent (hEvent=0x174) returned 1
	[0285.732] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0285.747] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.747] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0285.749] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.749] SetEvent (hEvent=0x124) returned 1
	[0285.749] SetEvent (hEvent=0x174) returned 1
	[0285.749] SetEvent (hEvent=0x104) returned 1
	[0285.749] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.749] SetEvent (hEvent=0x168) returned 1
	[0285.749] SetEvent (hEvent=0x104) returned 1
	[0285.750] SetEvent (hEvent=0x12c) returned 1
	[0285.750] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.751] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.762] SetEvent (hEvent=0x12c) returned 1
	[0285.762] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.762] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.790] SetEvent (hEvent=0x12c) returned 1
	[0285.790] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.791] SetEvent (hEvent=0x104) returned 1
	[0285.791] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.875] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.876] SetEvent (hEvent=0x104) returned 1
	[0285.876] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.876] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.994] SetEvent (hEvent=0x124) returned 1
	[0285.994] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0285.995] SetEvent (hEvent=0x124) returned 1
	[0285.995] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.008] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.033] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.094] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.128] SetEvent (hEvent=0x124) returned 1
	[0286.129] SetEvent (hEvent=0x174) returned 1
	[0286.129] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0286.150] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.151] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x0
	[0286.153] SetEvent (hEvent=0x124) returned 1
	[0286.153] SetEvent (hEvent=0x174) returned 1
	[0286.153] SetEvent (hEvent=0x104) returned 1
	[0286.153] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.153] SetEvent (hEvent=0x168) returned 1
	[0286.153] SetEvent (hEvent=0x104) returned 1
	[0286.153] SetEvent (hEvent=0x12c) returned 1
	[0286.153] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.155] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.171] SetEvent (hEvent=0x12c) returned 1
	[0286.171] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.171] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.234] SetEvent (hEvent=0x12c) returned 1
	[0286.234] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.236] SetEvent (hEvent=0x104) returned 1
	[0286.236] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.417] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.420] SetEvent (hEvent=0x104) returned 1
	[0286.420] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.420] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.639] SetEvent (hEvent=0x124) returned 1
	[0286.639] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.639] SetEvent (hEvent=0x124) returned 1
	[0286.639] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.659] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.692] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.741] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.761] SetEvent (hEvent=0x124) returned 1
	[0286.761] SetEvent (hEvent=0x174) returned 1
	[0286.761] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0286.776] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.776] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x0
	[0286.777] SetEvent (hEvent=0x124) returned 1
	[0286.777] SetEvent (hEvent=0x174) returned 1
	[0286.777] SetEvent (hEvent=0x104) returned 1
	[0286.777] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.778] SetEvent (hEvent=0x168) returned 1
	[0286.778] SetEvent (hEvent=0x104) returned 1
	[0286.778] SetEvent (hEvent=0x12c) returned 1
	[0286.778] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.779] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.788] SetEvent (hEvent=0x12c) returned 1
	[0286.788] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.789] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.818] SetEvent (hEvent=0x12c) returned 1
	[0286.818] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.819] SetEvent (hEvent=0x104) returned 1
	[0286.819] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.906] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.907] SetEvent (hEvent=0x104) returned 1
	[0286.907] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0286.907] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.042] SetEvent (hEvent=0x124) returned 1
	[0287.042] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.042] SetEvent (hEvent=0x124) returned 1
	[0287.043] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.060] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.085] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.136] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.156] SetEvent (hEvent=0x124) returned 1
	[0287.156] SetEvent (hEvent=0x174) returned 1
	[0287.156] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0287.168] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.168] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x0
	[0287.169] SetEvent (hEvent=0x124) returned 1
	[0287.169] SetEvent (hEvent=0x174) returned 1
	[0287.169] SetEvent (hEvent=0x104) returned 1
	[0287.169] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.170] SetEvent (hEvent=0x168) returned 1
	[0287.170] SetEvent (hEvent=0x104) returned 1
	[0287.170] SetEvent (hEvent=0x12c) returned 1
	[0287.170] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.171] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.177] SetEvent (hEvent=0x12c) returned 1
	[0287.177] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.178] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.206] SetEvent (hEvent=0x12c) returned 1
	[0287.206] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.208] SetEvent (hEvent=0x104) returned 1
	[0287.208] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.305] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.306] SetEvent (hEvent=0x104) returned 1
	[0287.306] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.307] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.470] SetEvent (hEvent=0x124) returned 1
	[0287.470] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.471] SetEvent (hEvent=0x124) returned 1
	[0287.471] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.499] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.523] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.572] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.592] SetEvent (hEvent=0x124) returned 1
	[0287.593] SetEvent (hEvent=0x174) returned 1
	[0287.593] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0287.661] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.662] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0287.667] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.667] SetEvent (hEvent=0x124) returned 1
	[0287.667] SetEvent (hEvent=0x174) returned 1
	[0287.667] SetEvent (hEvent=0x104) returned 1
	[0287.667] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.667] SetEvent (hEvent=0x168) returned 1
	[0287.667] SetEvent (hEvent=0x104) returned 1
	[0287.667] SetEvent (hEvent=0x12c) returned 1
	[0287.668] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.678] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.687] SetEvent (hEvent=0x12c) returned 1
	[0287.687] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.689] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.715] SetEvent (hEvent=0x12c) returned 1
	[0287.715] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.717] SetEvent (hEvent=0x104) returned 1
	[0287.717] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.802] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.805] SetEvent (hEvent=0x104) returned 1
	[0287.805] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.805] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.985] SetEvent (hEvent=0x124) returned 1
	[0287.985] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0287.985] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.038] SetEvent (hEvent=0x12c) returned 1
	[0288.038] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.038] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.072] SetEvent (hEvent=0x12c) returned 1
	[0288.072] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.073] SetEvent (hEvent=0x124) returned 1
	[0288.073] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.120] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.123] SetEvent (hEvent=0x124) returned 1
	[0288.123] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.123] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.260] SetEvent (hEvent=0x104) returned 1
	[0288.260] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.261] SetEvent (hEvent=0x104) returned 1
	[0288.261] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.274] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.308] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.325] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.355] SetEvent (hEvent=0x104) returned 1
	[0288.355] SetEvent (hEvent=0x174) returned 1
	[0288.355] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0288.367] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.367] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0288.378] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.378] SetEvent (hEvent=0x104) returned 1
	[0288.378] SetEvent (hEvent=0x174) returned 1
	[0288.378] SetEvent (hEvent=0x124) returned 1
	[0288.378] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.382] SetEvent (hEvent=0x168) returned 1
	[0288.382] SetEvent (hEvent=0x124) returned 1
	[0288.382] SetEvent (hEvent=0x12c) returned 1
	[0288.382] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.405] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.451] SetEvent (hEvent=0x12c) returned 1
	[0288.452] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.457] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.487] SetEvent (hEvent=0x12c) returned 1
	[0288.487] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.492] SetEvent (hEvent=0x124) returned 1
	[0288.492] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.525] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.527] SetEvent (hEvent=0x124) returned 1
	[0288.527] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.527] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.775] SetEvent (hEvent=0x124) returned 1
	[0288.775] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.775] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.951] SetEvent (hEvent=0x12c) returned 1
	[0288.951] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0288.953] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.002] SetEvent (hEvent=0x12c) returned 1
	[0289.002] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.008] SetEvent (hEvent=0x124) returned 1
	[0289.008] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.096] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.114] SetEvent (hEvent=0x124) returned 1
	[0289.114] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.117] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.263] SetEvent (hEvent=0x104) returned 1
	[0289.263] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.263] SetEvent (hEvent=0x104) returned 1
	[0289.263] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.271] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.307] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.328] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.338] SetEvent (hEvent=0x104) returned 1
	[0289.338] SetEvent (hEvent=0x174) returned 1
	[0289.338] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x0
	[0289.339] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x0
	[0289.339] SetEvent (hEvent=0x104) returned 1
	[0289.339] SetEvent (hEvent=0x174) returned 1
	[0289.339] SetEvent (hEvent=0x124) returned 1
	[0289.339] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.340] SetEvent (hEvent=0x168) returned 1
	[0289.340] SetEvent (hEvent=0x124) returned 1
	[0289.340] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.384] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.447] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.472] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.498] SetEvent (hEvent=0x124) returned 1
	[0289.499] SetEvent (hEvent=0x174) returned 1
	[0289.499] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x0
	[0289.499] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x0
	[0289.499] SetEvent (hEvent=0x124) returned 1
	[0289.499] SetEvent (hEvent=0x174) returned 1
	[0289.499] SetEvent (hEvent=0x104) returned 1
	[0289.499] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.500] SetEvent (hEvent=0x168) returned 1
	[0289.500] SetEvent (hEvent=0x104) returned 1
	[0289.500] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.553] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.582] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.606] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.622] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.694] SetEvent (hEvent=0x104) returned 1
	[0289.695] SetEvent (hEvent=0x174) returned 1
	[0289.695] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0289.711] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.711] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x0
	[0289.711] SetEvent (hEvent=0x104) returned 1
	[0289.711] SetEvent (hEvent=0x174) returned 1
	[0289.711] SetEvent (hEvent=0x124) returned 1
	[0289.711] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.712] SetEvent (hEvent=0x124) returned 1
	[0289.712] SetEvent (hEvent=0x12c) returned 1
	[0289.712] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.713] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.725] SetEvent (hEvent=0x12c) returned 1
	[0289.725] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.726] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.755] SetEvent (hEvent=0x12c) returned 1
	[0289.755] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.756] SetEvent (hEvent=0x124) returned 1
	[0289.756] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.808] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.809] SetEvent (hEvent=0x124) returned 1
	[0289.809] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.809] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.940] SetEvent (hEvent=0x124) returned 1
	[0289.940] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0289.941] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.151] SetEvent (hEvent=0x12c) returned 1
	[0290.151] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.155] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.183] SetEvent (hEvent=0x12c) returned 1
	[0290.183] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.185] SetEvent (hEvent=0x124) returned 1
	[0290.185] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.291] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.293] SetEvent (hEvent=0x124) returned 1
	[0290.293] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.294] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.389] SetEvent (hEvent=0x104) returned 1
	[0290.389] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.390] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.470] SetEvent (hEvent=0x12c) returned 1
	[0290.470] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.470] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.496] SetEvent (hEvent=0x12c) returned 1
	[0290.496] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.498] SetEvent (hEvent=0x104) returned 1
	[0290.498] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.533] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.533] SetEvent (hEvent=0x104) returned 1
	[0290.533] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.533] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.734] SetEvent (hEvent=0x104) returned 1
	[0290.735] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.735] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.820] SetEvent (hEvent=0x12c) returned 1
	[0290.820] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.820] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.848] SetEvent (hEvent=0x12c) returned 1
	[0290.848] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.850] SetEvent (hEvent=0x104) returned 1
	[0290.850] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.884] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.884] SetEvent (hEvent=0x104) returned 1
	[0290.884] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.885] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.988] SetEvent (hEvent=0x104) returned 1
	[0290.988] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0290.989] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.083] SetEvent (hEvent=0x12c) returned 1
	[0291.083] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.083] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.111] SetEvent (hEvent=0x12c) returned 1
	[0291.111] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.113] SetEvent (hEvent=0x104) returned 1
	[0291.113] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.180] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.181] SetEvent (hEvent=0x104) returned 1
	[0291.181] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.181] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.312] SetEvent (hEvent=0x124) returned 1
	[0291.312] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.313] SetEvent (hEvent=0x124) returned 1
	[0291.313] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.325] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.351] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.373] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.384] SetEvent (hEvent=0x124) returned 1
	[0291.384] SetEvent (hEvent=0x174) returned 1
	[0291.384] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0291.396] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.397] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x0
	[0291.397] SetEvent (hEvent=0x124) returned 1
	[0291.397] SetEvent (hEvent=0x174) returned 1
	[0291.397] SetEvent (hEvent=0x104) returned 1
	[0291.397] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.398] SetEvent (hEvent=0x104) returned 1
	[0291.398] SetEvent (hEvent=0x12c) returned 1
	[0291.398] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.399] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.408] SetEvent (hEvent=0x12c) returned 1
	[0291.408] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.409] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.489] SetEvent (hEvent=0x12c) returned 1
	[0291.489] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.492] SetEvent (hEvent=0x104) returned 1
	[0291.492] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.548] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.551] SetEvent (hEvent=0x104) returned 1
	[0291.551] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.552] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.634] SetEvent (hEvent=0x124) returned 1
	[0291.634] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.635] SetEvent (hEvent=0x124) returned 1
	[0291.635] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.647] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.672] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.694] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.724] SetEvent (hEvent=0x124) returned 1
	[0291.724] SetEvent (hEvent=0x174) returned 1
	[0291.724] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0291.740] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.740] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0291.742] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.742] SetEvent (hEvent=0x124) returned 1
	[0291.742] SetEvent (hEvent=0x174) returned 1
	[0291.742] SetEvent (hEvent=0x104) returned 1
	[0291.743] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.744] SetEvent (hEvent=0x168) returned 1
	[0291.745] SetEvent (hEvent=0x104) returned 1
	[0291.745] SetEvent (hEvent=0x12c) returned 1
	[0291.745] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.746] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.755] SetEvent (hEvent=0x12c) returned 1
	[0291.755] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.755] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.785] SetEvent (hEvent=0x12c) returned 1
	[0291.785] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.787] SetEvent (hEvent=0x104) returned 1
	[0291.787] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.832] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.834] SetEvent (hEvent=0x104) returned 1
	[0291.834] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0291.834] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0292.050] SetEvent (hEvent=0x124) returned 1
	[0292.050] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0292.050] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0292.467] SetEvent (hEvent=0x12c) returned 1
	[0292.467] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0292.480] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0292.578] SetEvent (hEvent=0x12c) returned 1
	[0292.578] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0292.582] SetEvent (hEvent=0x124) returned 1
	[0292.582] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0292.650] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0292.650] SetEvent (hEvent=0x124) returned 1
	[0292.650] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0292.651] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0292.793] SetEvent (hEvent=0x104) returned 1
	[0292.793] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0292.794] SetEvent (hEvent=0x104) returned 1
	[0292.794] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0292.803] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0292.836] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0292.858] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0292.869] SetEvent (hEvent=0x104) returned 1
	[0292.869] SetEvent (hEvent=0x174) returned 1
	[0292.869] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0292.883] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0292.883] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x0
	[0292.884] SetEvent (hEvent=0x104) returned 1
	[0292.884] SetEvent (hEvent=0x174) returned 1
	[0292.884] SetEvent (hEvent=0x124) returned 1
	[0292.884] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0292.887] SetEvent (hEvent=0x168) returned 1
	[0292.887] SetEvent (hEvent=0x124) returned 1
	[0292.888] SetEvent (hEvent=0x12c) returned 1
	[0292.888] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0292.889] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0292.896] SetEvent (hEvent=0x12c) returned 1
	[0292.896] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0292.896] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0292.940] SetEvent (hEvent=0x12c) returned 1
	[0292.940] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0292.942] SetEvent (hEvent=0x124) returned 1
	[0292.942] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.007] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.008] SetEvent (hEvent=0x124) returned 1
	[0293.008] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.009] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.094] SetEvent (hEvent=0x104) returned 1
	[0293.094] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.095] SetEvent (hEvent=0x104) returned 1
	[0293.095] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.105] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.132] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.149] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.185] SetEvent (hEvent=0x104) returned 1
	[0293.186] SetEvent (hEvent=0x174) returned 1
	[0293.186] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0293.202] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.202] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x0
	[0293.202] SetEvent (hEvent=0x104) returned 1
	[0293.202] SetEvent (hEvent=0x174) returned 1
	[0293.203] SetEvent (hEvent=0x124) returned 1
	[0293.203] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.203] SetEvent (hEvent=0x168) returned 1
	[0293.203] SetEvent (hEvent=0x124) returned 1
	[0293.203] SetEvent (hEvent=0x12c) returned 1
	[0293.203] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.204] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.240] SetEvent (hEvent=0x12c) returned 1
	[0293.240] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.241] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.266] SetEvent (hEvent=0x12c) returned 1
	[0293.266] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.268] SetEvent (hEvent=0x124) returned 1
	[0293.268] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.313] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.314] SetEvent (hEvent=0x124) returned 1
	[0293.314] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.314] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.476] SetEvent (hEvent=0x104) returned 1
	[0293.476] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.477] SetEvent (hEvent=0x104) returned 1
	[0293.477] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.492] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.520] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.545] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.573] SetEvent (hEvent=0x104) returned 1
	[0293.573] SetEvent (hEvent=0x12c) returned 1
	[0293.573] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0293.614] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.614] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x0
	[0293.615] SetEvent (hEvent=0x104) returned 1
	[0293.615] SetEvent (hEvent=0x12c) returned 1
	[0293.615] SetEvent (hEvent=0x174) returned 1
	[0293.615] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.616] SetEvent (hEvent=0x168) returned 1
	[0293.616] SetEvent (hEvent=0x174) returned 1
	[0293.616] SetEvent (hEvent=0x124) returned 1
	[0293.616] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.618] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.631] SetEvent (hEvent=0x124) returned 1
	[0293.631] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.632] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.663] SetEvent (hEvent=0x124) returned 1
	[0293.663] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.666] SetEvent (hEvent=0x174) returned 1
	[0293.666] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.717] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.718] SetEvent (hEvent=0x174) returned 1
	[0293.718] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.718] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.822] SetEvent (hEvent=0x104) returned 1
	[0293.822] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.822] SetEvent (hEvent=0x104) returned 1
	[0293.823] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.831] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.864] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.887] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0293.983] SetEvent (hEvent=0x104) returned 1
	[0293.984] SetEvent (hEvent=0x12c) returned 1
	[0293.984] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0294.002] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.002] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0294.005] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.005] SetEvent (hEvent=0x104) returned 1
	[0294.005] SetEvent (hEvent=0x12c) returned 1
	[0294.005] SetEvent (hEvent=0x174) returned 1
	[0294.005] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.006] SetEvent (hEvent=0x168) returned 1
	[0294.006] SetEvent (hEvent=0x174) returned 1
	[0294.006] SetEvent (hEvent=0x124) returned 1
	[0294.006] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.011] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.022] SetEvent (hEvent=0x124) returned 1
	[0294.022] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.023] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.086] SetEvent (hEvent=0x124) returned 1
	[0294.086] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.090] SetEvent (hEvent=0x174) returned 1
	[0294.090] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.159] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.162] SetEvent (hEvent=0x174) returned 1
	[0294.162] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.162] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.278] SetEvent (hEvent=0x104) returned 1
	[0294.279] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.279] SetEvent (hEvent=0x104) returned 1
	[0294.279] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.285] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.333] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.355] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.371] SetEvent (hEvent=0x104) returned 1
	[0294.371] SetEvent (hEvent=0x12c) returned 1
	[0294.371] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0294.384] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.384] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x0
	[0294.384] SetEvent (hEvent=0x104) returned 1
	[0294.385] SetEvent (hEvent=0x12c) returned 1
	[0294.385] SetEvent (hEvent=0x174) returned 1
	[0294.385] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.385] SetEvent (hEvent=0x174) returned 1
	[0294.385] SetEvent (hEvent=0x124) returned 1
	[0294.385] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.392] SetEvent (hEvent=0x124) returned 1
	[0294.392] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.394] SetEvent (hEvent=0x124) returned 1
	[0294.394] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.395] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.463] SetEvent (hEvent=0x124) returned 1
	[0294.463] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.498] SetEvent (hEvent=0x174) returned 1
	[0294.498] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.532] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.533] SetEvent (hEvent=0x174) returned 1
	[0294.533] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.533] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.671] SetEvent (hEvent=0x104) returned 1
	[0294.671] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.672] SetEvent (hEvent=0x104) returned 1
	[0294.672] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.738] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.791] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.825] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.841] SetEvent (hEvent=0x104) returned 1
	[0294.841] SetEvent (hEvent=0x12c) returned 1
	[0294.841] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0294.865] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.865] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0294.870] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.870] SetEvent (hEvent=0x104) returned 1
	[0294.870] SetEvent (hEvent=0x12c) returned 1
	[0294.870] SetEvent (hEvent=0x174) returned 1
	[0294.870] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.871] SetEvent (hEvent=0x168) returned 1
	[0294.871] SetEvent (hEvent=0x174) returned 1
	[0294.871] SetEvent (hEvent=0x124) returned 1
	[0294.871] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.873] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.889] SetEvent (hEvent=0x124) returned 1
	[0294.889] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.890] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.930] SetEvent (hEvent=0x124) returned 1
	[0294.930] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.932] SetEvent (hEvent=0x174) returned 1
	[0294.932] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.996] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.997] SetEvent (hEvent=0x174) returned 1
	[0294.997] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0294.997] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.104] SetEvent (hEvent=0x104) returned 1
	[0295.104] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.105] SetEvent (hEvent=0x104) returned 1
	[0295.105] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.117] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.143] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.165] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.178] SetEvent (hEvent=0x104) returned 1
	[0295.178] SetEvent (hEvent=0x12c) returned 1
	[0295.178] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0295.256] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.256] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0295.265] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.265] SetEvent (hEvent=0x104) returned 1
	[0295.265] SetEvent (hEvent=0x12c) returned 1
	[0295.265] SetEvent (hEvent=0x174) returned 1
	[0295.265] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.265] SetEvent (hEvent=0x168) returned 1
	[0295.265] SetEvent (hEvent=0x174) returned 1
	[0295.265] SetEvent (hEvent=0x124) returned 1
	[0295.265] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.276] SetEvent (hEvent=0x124) returned 1
	[0295.276] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.280] SetEvent (hEvent=0x124) returned 1
	[0295.280] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.280] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.310] SetEvent (hEvent=0x124) returned 1
	[0295.310] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.344] SetEvent (hEvent=0x124) returned 1
	[0295.344] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.350] SetEvent (hEvent=0x174) returned 1
	[0295.350] SetEvent (hEvent=0x12c) returned 1
	[0295.350] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0295.368] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.368] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x0
	[0295.368] SetEvent (hEvent=0x174) returned 1
	[0295.368] SetEvent (hEvent=0x12c) returned 1
	[0295.368] SetEvent (hEvent=0x104) returned 1
	[0295.368] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.369] SetEvent (hEvent=0x104) returned 1
	[0295.369] SetEvent (hEvent=0x124) returned 1
	[0295.369] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.380] SetEvent (hEvent=0x124) returned 1
	[0295.380] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.404] SetEvent (hEvent=0x124) returned 1
	[0295.404] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.404] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.514] SetEvent (hEvent=0x124) returned 1
	[0295.514] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.545] SetEvent (hEvent=0x124) returned 1
	[0295.545] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.549] SwitchToThread () returned 1
	[0295.550] SetEvent (hEvent=0x104) returned 1
	[0295.551] SetEvent (hEvent=0x12c) returned 1
	[0295.551] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0295.566] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.566] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0295.569] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.569] SetEvent (hEvent=0x104) returned 1
	[0295.569] SetEvent (hEvent=0x12c) returned 1
	[0295.569] SetEvent (hEvent=0x174) returned 1
	[0295.570] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.570] SetEvent (hEvent=0x168) returned 1
	[0295.570] SetEvent (hEvent=0x174) returned 1
	[0295.570] SetEvent (hEvent=0x124) returned 1
	[0295.570] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.577] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.585] SetEvent (hEvent=0x124) returned 1
	[0295.585] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.585] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.612] SetEvent (hEvent=0x124) returned 1
	[0295.612] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.614] SetEvent (hEvent=0x174) returned 1
	[0295.614] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.661] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.662] SetEvent (hEvent=0x174) returned 1
	[0295.662] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.662] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.753] SetEvent (hEvent=0x104) returned 1
	[0295.753] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.757] SetEvent (hEvent=0x104) returned 1
	[0295.757] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.768] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.803] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.825] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.837] SetEvent (hEvent=0x104) returned 1
	[0295.837] SetEvent (hEvent=0x12c) returned 1
	[0295.837] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0295.851] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.851] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x0
	[0295.851] SetEvent (hEvent=0x104) returned 1
	[0295.851] SetEvent (hEvent=0x12c) returned 1
	[0295.852] SetEvent (hEvent=0x174) returned 1
	[0295.852] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.852] SetEvent (hEvent=0x174) returned 1
	[0295.852] SetEvent (hEvent=0x124) returned 1
	[0295.852] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.861] SetEvent (hEvent=0x124) returned 1
	[0295.861] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.863] SetEvent (hEvent=0x124) returned 1
	[0295.863] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.863] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.888] SetEvent (hEvent=0x124) returned 1
	[0295.888] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.919] SetEvent (hEvent=0x124) returned 1
	[0295.919] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.924] SetEvent (hEvent=0x174) returned 1
	[0295.925] SetEvent (hEvent=0x12c) returned 1
	[0295.925] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0295.942] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.942] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0295.944] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.944] SetEvent (hEvent=0x174) returned 1
	[0295.944] SetEvent (hEvent=0x12c) returned 1
	[0295.944] SetEvent (hEvent=0x104) returned 1
	[0295.945] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.945] SetEvent (hEvent=0x168) returned 1
	[0295.945] SetEvent (hEvent=0x104) returned 1
	[0295.945] SetEvent (hEvent=0x124) returned 1
	[0295.945] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.946] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.959] SetEvent (hEvent=0x124) returned 1
	[0295.959] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.959] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.987] SetEvent (hEvent=0x124) returned 1
	[0295.987] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0295.989] SetEvent (hEvent=0x104) returned 1
	[0295.989] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.042] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.043] SetEvent (hEvent=0x104) returned 1
	[0296.043] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.043] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.174] SetEvent (hEvent=0x174) returned 1
	[0296.175] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.175] SetEvent (hEvent=0x174) returned 1
	[0296.175] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.195] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.259] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.299] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.315] SetEvent (hEvent=0x174) returned 1
	[0296.315] SetEvent (hEvent=0x12c) returned 1
	[0296.315] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0296.338] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.338] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x0
	[0296.339] SetEvent (hEvent=0x174) returned 1
	[0296.340] SetEvent (hEvent=0x12c) returned 1
	[0296.340] SetEvent (hEvent=0x104) returned 1
	[0296.340] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.340] SetEvent (hEvent=0x168) returned 1
	[0296.340] SetEvent (hEvent=0x104) returned 1
	[0296.341] SetEvent (hEvent=0x124) returned 1
	[0296.341] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.353] SetEvent (hEvent=0x124) returned 1
	[0296.353] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.357] SetEvent (hEvent=0x124) returned 1
	[0296.357] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.358] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.471] SetEvent (hEvent=0x124) returned 1
	[0296.471] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.472] SetEvent (hEvent=0x104) returned 1
	[0296.472] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.564] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.566] SetEvent (hEvent=0x104) returned 1
	[0296.566] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.566] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.707] SetEvent (hEvent=0x174) returned 1
	[0296.707] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.708] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.744] SetEvent (hEvent=0x124) returned 1
	[0296.744] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.744] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.772] SetEvent (hEvent=0x124) returned 1
	[0296.772] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.774] SetEvent (hEvent=0x174) returned 1
	[0296.774] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.821] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.825] SetEvent (hEvent=0x174) returned 1
	[0296.825] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.826] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.900] SetEvent (hEvent=0x104) returned 1
	[0296.900] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0296.900] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.017] SetEvent (hEvent=0x124) returned 1
	[0297.017] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.017] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.050] SetEvent (hEvent=0x124) returned 1
	[0297.050] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.052] SetEvent (hEvent=0x104) returned 1
	[0297.052] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.110] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.111] SetEvent (hEvent=0x104) returned 1
	[0297.111] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.112] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.230] SetEvent (hEvent=0x174) returned 1
	[0297.230] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.230] SetEvent (hEvent=0x174) returned 1
	[0297.231] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.246] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.294] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.325] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.349] SetEvent (hEvent=0x174) returned 1
	[0297.350] SetEvent (hEvent=0x12c) returned 1
	[0297.350] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0297.370] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.370] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x0
	[0297.371] SetEvent (hEvent=0x174) returned 1
	[0297.371] SetEvent (hEvent=0x12c) returned 1
	[0297.371] SetEvent (hEvent=0x104) returned 1
	[0297.371] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.371] SetEvent (hEvent=0x168) returned 1
	[0297.371] SetEvent (hEvent=0x104) returned 1
	[0297.371] SetEvent (hEvent=0x124) returned 1
	[0297.372] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.373] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.388] SetEvent (hEvent=0x124) returned 1
	[0297.388] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.389] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.486] SetEvent (hEvent=0x124) returned 1
	[0297.486] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.487] SetEvent (hEvent=0x104) returned 1
	[0297.487] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.538] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.539] SetEvent (hEvent=0x104) returned 1
	[0297.539] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.540] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.944] SetEvent (hEvent=0x12c) returned 1
	[0297.944] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.945] SetEvent (hEvent=0x12c) returned 1
	[0297.945] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0297.957] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.000] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.029] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.067] SetEvent (hEvent=0x12c) returned 1
	[0298.068] SetEvent (hEvent=0x174) returned 1
	[0298.068] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0298.091] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.091] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x0
	[0298.092] SetEvent (hEvent=0x12c) returned 1
	[0298.092] SetEvent (hEvent=0x174) returned 1
	[0298.092] SetEvent (hEvent=0x104) returned 1
	[0298.092] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.093] SetEvent (hEvent=0x168) returned 1
	[0298.093] SetEvent (hEvent=0x104) returned 1
	[0298.093] SetEvent (hEvent=0x124) returned 1
	[0298.093] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.094] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.108] SetEvent (hEvent=0x124) returned 1
	[0298.108] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.109] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.144] SetEvent (hEvent=0x124) returned 1
	[0298.144] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.146] SetEvent (hEvent=0x104) returned 1
	[0298.146] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.208] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.210] SetEvent (hEvent=0x104) returned 1
	[0298.210] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.210] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.400] SetEvent (hEvent=0x12c) returned 1
	[0298.400] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.401] SetEvent (hEvent=0x12c) returned 1
	[0298.401] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.468] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.508] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.537] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.584] SetEvent (hEvent=0x12c) returned 1
	[0298.584] SetEvent (hEvent=0x174) returned 1
	[0298.585] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0298.600] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.600] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x1) returned 0x102
	[0298.606] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.606] SetEvent (hEvent=0x12c) returned 1
	[0298.606] SetEvent (hEvent=0x174) returned 1
	[0298.606] SetEvent (hEvent=0x104) returned 1
	[0298.606] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.607] SetEvent (hEvent=0x168) returned 1
	[0298.607] SetEvent (hEvent=0x104) returned 1
	[0298.607] SetEvent (hEvent=0x124) returned 1
	[0298.607] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.608] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.615] SetEvent (hEvent=0x124) returned 1
	[0298.615] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.616] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.661] SetEvent (hEvent=0x124) returned 1
	[0298.661] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.666] SetEvent (hEvent=0x104) returned 1
	[0298.666] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.720] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.722] SetEvent (hEvent=0x104) returned 1
	[0298.722] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.723] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.820] SetEvent (hEvent=0x104) returned 1
	[0298.820] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.820] SetEvent (hEvent=0x104) returned 1
	[0298.820] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.853] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.877] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.916] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.955] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0298.989] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0299.128] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0299.256] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0299.275] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0299.383] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0299.518] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0299.730] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0299.856] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0299.893] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0299.938] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0299.971] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0300.016] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0300.050] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0300.134] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0300.172] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0300.333] SetEvent (hEvent=0x124) returned 1
	[0300.333] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0300.333] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0302.767] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0303.695] SetEvent (hEvent=0x174) returned 1
	[0303.695] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0303.710] SetEvent (hEvent=0x12c) returned 1
	[0303.710] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0304.243] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0304.311] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0304.696] SetEvent (hEvent=0x174) returned 1
	[0304.696] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0304.696] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0305.268] SetEvent (hEvent=0x174) returned 1
	[0305.268] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0305.269] SetEvent (hEvent=0x12c) returned 1
	[0305.270] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0306.060] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0306.077] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0306.747] SetEvent (hEvent=0x174) returned 1
	[0306.747] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0306.747] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0307.874] SetEvent (hEvent=0x174) returned 1
	[0307.874] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0307.878] SetEvent (hEvent=0x12c) returned 1
	[0307.878] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0309.298] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0309.303] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0309.643] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0309.664] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0309.678] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0309.693] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0309.705] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0309.894] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0309.912] SetEvent (hEvent=0x174) returned 1
	[0309.912] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0309.912] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0310.567] SetEvent (hEvent=0x174) returned 1
	[0310.567] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0310.570] SetEvent (hEvent=0x12c) returned 1
	[0310.570] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0313.090] SetEvent (hEvent=0x174) returned 1
	[0313.090] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0313.090] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0314.495] SetEvent (hEvent=0x174) returned 1
	[0314.495] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0314.565] SetEvent (hEvent=0x124) returned 1
	[0314.565] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0315.106] SetEvent (hEvent=0x124) returned 1
	[0315.106] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0315.107] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0315.933] SetEvent (hEvent=0x124) returned 1
	[0315.934] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0315.934] SetEvent (hEvent=0x124) returned 1
	[0315.935] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0316.584] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) returned 0x0
	[0316.631] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0xffffffff) 

Thread:
	id = 399
	os_tid = 0xe54


Thread:
	id = 400
	os_tid = 0x8a4

	[0197.427] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x3329ff58, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x3329ff58*=0x138) returned 1
	[0197.427] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x174
	[0197.427] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0197.569] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0197.745] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0197.877] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0198.104] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0198.793] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0198.937] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0199.136] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0199.615] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0199.791] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0199.830] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0199.885] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0199.971] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0200.032] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0200.065] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0200.486] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0200.534] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0200.658] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0200.732] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0200.799] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0200.883] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0200.968] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0201.046] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0201.171] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0201.261] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0201.415] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0201.582] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0201.615] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0201.661] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0201.701] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0201.773] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0201.863] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0202.031] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0202.223] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0202.268] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0202.343] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0202.403] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0202.419] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0202.469] SetEvent (hEvent=0x104) returned 1
	[0202.469] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0202.472] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0208.415] SetEvent (hEvent=0x104) returned 1
	[0208.415] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0208.417] SetEvent (hEvent=0x14c) returned 1
	[0208.418] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0211.341] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0211.348] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0211.370] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0211.412] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0211.444] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0211.515] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0211.637] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0211.964] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0211.986] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0212.010] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0212.041] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0212.086] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0212.117] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0212.185] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0212.228] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0212.306] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0212.335] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0212.572] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0213.126] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0213.159] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0213.253] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0213.297] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0213.340] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0213.390] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0213.518] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0213.677] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0213.810] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0213.834] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0213.857] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0213.869] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0213.889] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0213.912] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0213.938] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0213.962] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0213.986] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0214.019] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0214.057] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0214.119] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0214.191] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0214.221] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0214.240] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0214.304] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0214.368] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0214.399] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0214.485] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0214.582] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0214.674] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0214.699] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0214.732] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0214.777] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0214.815] SetEvent (hEvent=0x104) returned 1
	[0214.815] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0214.815] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0216.903] SetEvent (hEvent=0x104) returned 1
	[0216.903] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0216.906] SetEvent (hEvent=0x14c) returned 1
	[0216.906] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0219.563] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0219.567] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0220.017] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0220.367] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0220.631] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0220.688] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0220.699] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0220.720] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0220.758] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0220.805] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0220.880] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0220.893] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0220.955] SetEvent (hEvent=0x104) returned 1
	[0220.955] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0220.955] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0223.310] SetEvent (hEvent=0x104) returned 1
	[0223.310] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0223.316] SetEvent (hEvent=0x14c) returned 1
	[0223.316] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0226.020] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0226.025] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0226.036] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0226.869] SetEvent (hEvent=0x104) returned 1
	[0226.869] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0226.870] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0228.116] SetEvent (hEvent=0x104) returned 1
	[0228.116] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0228.127] SetEvent (hEvent=0x14c) returned 1
	[0228.128] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0229.051] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0229.061] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0229.333] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0229.979] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0230.631] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0230.767] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0230.853] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0231.314] SetEvent (hEvent=0x104) returned 1
	[0231.314] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0231.314] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0233.758] SetEvent (hEvent=0x104) returned 1
	[0233.758] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0233.759] SetEvent (hEvent=0x14c) returned 1
	[0233.759] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0235.500] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0235.505] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0235.516] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0235.636] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0235.703] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0235.749] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0235.780] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0235.935] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0236.015] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0236.937] SetEvent (hEvent=0x104) returned 1
	[0236.937] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0236.938] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0238.279] SetEvent (hEvent=0x104) returned 1
	[0238.279] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0238.316] SetEvent (hEvent=0x14c) returned 1
	[0238.316] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0239.217] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0239.296] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0239.307] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0239.374] SetEvent (hEvent=0x104) returned 1
	[0239.374] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0239.375] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0239.422] SetEvent (hEvent=0x104) returned 1
	[0239.422] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0239.424] SetEvent (hEvent=0x124) returned 1
	[0239.424] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0239.770] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0239.773] SetEvent (hEvent=0x124) returned 1
	[0239.773] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0239.773] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0240.036] SetEvent (hEvent=0x12c) returned 1
	[0240.036] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0240.039] SetEvent (hEvent=0x12c) returned 1
	[0240.039] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0240.070] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0240.102] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0240.105] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0240.332] SetEvent (hEvent=0x12c) returned 1
	[0240.332] SetEvent (hEvent=0x14c) returned 1
	[0240.332] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0240.348] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0240.348] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0240.351] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0240.351] SetEvent (hEvent=0x12c) returned 1
	[0240.351] SetEvent (hEvent=0x14c) returned 1
	[0240.351] SetEvent (hEvent=0x124) returned 1
	[0240.351] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0240.360] SetEvent (hEvent=0x168) returned 1
	[0240.360] SetEvent (hEvent=0x124) returned 1
	[0240.361] SetEvent (hEvent=0x104) returned 1
	[0240.361] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0240.362] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0240.374] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0240.464] SetEvent (hEvent=0x104) returned 1
	[0240.464] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0240.464] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0240.490] SetEvent (hEvent=0x104) returned 1
	[0240.490] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0240.491] SetEvent (hEvent=0x124) returned 1
	[0240.491] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0240.685] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0240.686] SetEvent (hEvent=0x124) returned 1
	[0240.686] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0240.686] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0242.802] SetEvent (hEvent=0x12c) returned 1
	[0242.802] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0242.816] SetEvent (hEvent=0x12c) returned 1
	[0242.816] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0242.893] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0243.050] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0243.167] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0243.299] SetEvent (hEvent=0x12c) returned 1
	[0243.300] SetEvent (hEvent=0x14c) returned 1
	[0243.300] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0243.340] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0243.340] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0243.350] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0243.351] SetEvent (hEvent=0x12c) returned 1
	[0243.351] SetEvent (hEvent=0x14c) returned 1
	[0243.351] SetEvent (hEvent=0x124) returned 1
	[0243.351] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0243.387] SetEvent (hEvent=0x168) returned 1
	[0243.388] SetEvent (hEvent=0x124) returned 1
	[0243.388] SetEvent (hEvent=0x104) returned 1
	[0243.388] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0243.455] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0243.497] SetEvent (hEvent=0x104) returned 1
	[0243.497] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0243.507] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0244.027] SetEvent (hEvent=0x104) returned 1
	[0244.027] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0244.141] SetEvent (hEvent=0x104) returned 1
	[0244.141] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0244.183] SetEvent (hEvent=0x124) returned 1
	[0244.183] SetEvent (hEvent=0x14c) returned 1
	[0244.183] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0244.244] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0244.244] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x0
	[0244.281] SetEvent (hEvent=0x124) returned 1
	[0244.281] SetEvent (hEvent=0x14c) returned 1
	[0244.281] SetEvent (hEvent=0x12c) returned 1
	[0244.281] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0244.320] SetEvent (hEvent=0x168) returned 1
	[0244.320] SetEvent (hEvent=0x12c) returned 1
	[0244.321] SetEvent (hEvent=0x104) returned 1
	[0244.321] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0244.360] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0244.457] SetEvent (hEvent=0x104) returned 1
	[0244.457] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0244.467] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0244.689] SetEvent (hEvent=0x104) returned 1
	[0244.689] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0244.732] SetEvent (hEvent=0x12c) returned 1
	[0244.732] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0244.956] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0244.988] SetEvent (hEvent=0x12c) returned 1
	[0244.988] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0245.020] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0246.042] SetEvent (hEvent=0x124) returned 1
	[0246.042] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0246.081] SetEvent (hEvent=0x124) returned 1
	[0246.082] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0246.410] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0246.605] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0246.759] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0246.851] SetEvent (hEvent=0x124) returned 1
	[0246.851] SetEvent (hEvent=0x14c) returned 1
	[0246.851] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0247.002] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0247.002] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0247.067] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0247.067] SetEvent (hEvent=0x124) returned 1
	[0247.067] SetEvent (hEvent=0x14c) returned 1
	[0247.067] SetEvent (hEvent=0x12c) returned 1
	[0247.067] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0247.162] SetEvent (hEvent=0x168) returned 1
	[0247.162] SetEvent (hEvent=0x12c) returned 1
	[0247.162] SetEvent (hEvent=0x104) returned 1
	[0247.162] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0247.175] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0247.214] SetEvent (hEvent=0x104) returned 1
	[0247.214] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0247.280] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0247.481] SetEvent (hEvent=0x104) returned 1
	[0247.481] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0247.520] SetEvent (hEvent=0x12c) returned 1
	[0247.520] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0248.037] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0248.059] SetEvent (hEvent=0x12c) returned 1
	[0248.059] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0248.096] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0248.998] SetEvent (hEvent=0x124) returned 1
	[0248.998] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0249.044] SetEvent (hEvent=0x124) returned 1
	[0249.044] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0249.207] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0249.534] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0249.677] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0249.725] SetEvent (hEvent=0x124) returned 1
	[0249.726] SetEvent (hEvent=0x14c) returned 1
	[0249.726] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0249.758] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0249.758] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0249.794] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0249.794] SetEvent (hEvent=0x124) returned 1
	[0249.794] SetEvent (hEvent=0x14c) returned 1
	[0249.794] SetEvent (hEvent=0x12c) returned 1
	[0249.794] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0249.883] SetEvent (hEvent=0x168) returned 1
	[0249.883] SetEvent (hEvent=0x12c) returned 1
	[0249.884] SetEvent (hEvent=0x104) returned 1
	[0249.884] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0249.933] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0249.949] SetEvent (hEvent=0x104) returned 1
	[0249.949] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0249.985] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0250.197] SetEvent (hEvent=0x104) returned 1
	[0250.197] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0250.265] SetEvent (hEvent=0x12c) returned 1
	[0250.265] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0250.510] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0250.553] SetEvent (hEvent=0x12c) returned 1
	[0250.553] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0250.598] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0251.282] SetEvent (hEvent=0x124) returned 1
	[0251.282] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0251.332] SetEvent (hEvent=0x124) returned 1
	[0251.332] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0251.553] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0251.716] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0251.794] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0252.040] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0252.116] SetEvent (hEvent=0x124) returned 1
	[0252.117] SetEvent (hEvent=0x14c) returned 1
	[0252.117] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0252.157] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0252.157] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0252.206] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0252.206] SetEvent (hEvent=0x124) returned 1
	[0252.206] SetEvent (hEvent=0x14c) returned 1
	[0252.206] SetEvent (hEvent=0x12c) returned 1
	[0252.215] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0252.277] SetEvent (hEvent=0x168) returned 1
	[0252.277] SetEvent (hEvent=0x12c) returned 1
	[0252.277] SetEvent (hEvent=0x104) returned 1
	[0252.277] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0252.412] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0252.473] SetEvent (hEvent=0x104) returned 1
	[0252.473] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0252.479] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0252.554] SetEvent (hEvent=0x104) returned 1
	[0252.554] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0252.577] SetEvent (hEvent=0x12c) returned 1
	[0252.577] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0252.800] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0252.804] SetEvent (hEvent=0x12c) returned 1
	[0252.804] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0252.806] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0253.642] SetEvent (hEvent=0x124) returned 1
	[0253.642] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0253.716] SetEvent (hEvent=0x124) returned 1
	[0253.716] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0253.855] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0253.990] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0254.108] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0254.133] SetEvent (hEvent=0x124) returned 1
	[0254.133] SwitchToThread () returned 1
	[0254.160] SetEvent (hEvent=0x124) returned 1
	[0254.160] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x0
	[0254.189] SetEvent (hEvent=0x12c) returned 1
	[0254.189] SetEvent (hEvent=0x124) returned 1
	[0254.189] SetEvent (hEvent=0x14c) returned 1
	[0254.189] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0254.202] SetEvent (hEvent=0x168) returned 1
	[0254.202] SetEvent (hEvent=0x14c) returned 1
	[0254.202] SetEvent (hEvent=0x104) returned 1
	[0254.202] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0254.293] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0254.321] SetEvent (hEvent=0x104) returned 1
	[0254.321] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0254.346] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0254.506] SetEvent (hEvent=0x104) returned 1
	[0254.506] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0254.608] SetEvent (hEvent=0x14c) returned 1
	[0254.608] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0254.804] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0254.836] SetEvent (hEvent=0x14c) returned 1
	[0254.836] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0254.865] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0256.231] SetEvent (hEvent=0x12c) returned 1
	[0256.231] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0256.234] SetEvent (hEvent=0x12c) returned 1
	[0256.234] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0256.257] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0256.319] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0256.436] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0256.500] SetEvent (hEvent=0x12c) returned 1
	[0256.500] SetEvent (hEvent=0x124) returned 1
	[0256.500] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0256.516] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0256.516] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x0
	[0256.516] SetEvent (hEvent=0x12c) returned 1
	[0256.516] SetEvent (hEvent=0x124) returned 1
	[0256.516] SetEvent (hEvent=0x14c) returned 1
	[0256.516] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0256.517] SetEvent (hEvent=0x168) returned 1
	[0256.517] SetEvent (hEvent=0x14c) returned 1
	[0256.517] SetEvent (hEvent=0x104) returned 1
	[0256.517] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0256.518] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0256.526] SetEvent (hEvent=0x104) returned 1
	[0256.526] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0256.527] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0256.559] SetEvent (hEvent=0x104) returned 1
	[0256.559] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0256.560] SetEvent (hEvent=0x14c) returned 1
	[0256.560] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0257.251] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0257.956] SetEvent (hEvent=0x14c) returned 1
	[0257.956] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0258.018] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0259.255] SetEvent (hEvent=0x12c) returned 1
	[0259.255] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0259.329] SetEvent (hEvent=0x12c) returned 1
	[0259.330] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0259.379] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0259.556] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0259.660] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0259.733] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0259.755] SetEvent (hEvent=0x12c) returned 1
	[0259.756] SetEvent (hEvent=0x124) returned 1
	[0259.756] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0259.817] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0259.817] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0259.833] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0259.833] SetEvent (hEvent=0x12c) returned 1
	[0259.833] SetEvent (hEvent=0x124) returned 1
	[0259.833] SetEvent (hEvent=0x14c) returned 1
	[0259.834] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0259.876] SetEvent (hEvent=0x168) returned 1
	[0259.876] SetEvent (hEvent=0x14c) returned 1
	[0259.876] SetEvent (hEvent=0x104) returned 1
	[0259.876] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0259.897] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0259.955] SetEvent (hEvent=0x104) returned 1
	[0259.955] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0259.962] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0260.212] SetEvent (hEvent=0x104) returned 1
	[0260.212] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0260.253] SetEvent (hEvent=0x14c) returned 1
	[0260.253] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0260.557] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0260.577] SetEvent (hEvent=0x14c) returned 1
	[0260.577] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0260.609] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0261.835] SetEvent (hEvent=0x12c) returned 1
	[0261.835] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0261.835] SetEvent (hEvent=0x12c) returned 1
	[0261.835] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0261.851] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0261.897] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0261.965] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0262.046] SetEvent (hEvent=0x104) returned 1
	[0262.046] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0262.047] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0262.390] SetEvent (hEvent=0x104) returned 1
	[0262.391] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0262.432] SetEvent (hEvent=0x104) returned 1
	[0262.432] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0262.531] SetEvent (hEvent=0x104) returned 1
	[0262.531] SwitchToThread () returned 1
	[0262.592] SetEvent (hEvent=0x104) returned 1
	[0262.592] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0262.630] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0262.866] SetEvent (hEvent=0x124) returned 1
	[0262.866] SetEvent (hEvent=0x12c) returned 1
	[0262.866] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0262.951] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0263.158] SetEvent (hEvent=0x104) returned 1
	[0263.158] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0263.271] SetEvent (hEvent=0x104) returned 1
	[0263.271] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0263.293] SetEvent (hEvent=0x104) returned 1
	[0263.293] SwitchToThread () returned 1
	[0263.320] SetEvent (hEvent=0x104) returned 1
	[0263.320] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0263.377] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0263.851] SetEvent (hEvent=0x14c) returned 1
	[0263.851] SetEvent (hEvent=0x124) returned 1
	[0263.851] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0263.933] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0264.255] SetEvent (hEvent=0x104) returned 1
	[0264.255] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0264.308] SetEvent (hEvent=0x104) returned 1
	[0264.308] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0264.352] SetEvent (hEvent=0x104) returned 1
	[0264.352] SwitchToThread () returned 1
	[0264.366] SetEvent (hEvent=0x104) returned 1
	[0264.366] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0264.402] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0265.756] SetEvent (hEvent=0x12c) returned 1
	[0265.756] SetEvent (hEvent=0x14c) returned 1
	[0265.756] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0266.897] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0267.014] SetEvent (hEvent=0x104) returned 1
	[0267.014] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0267.092] SetEvent (hEvent=0x104) returned 1
	[0267.093] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0267.203] SetEvent (hEvent=0x104) returned 1
	[0267.203] SwitchToThread () returned 1
	[0267.236] SetEvent (hEvent=0x104) returned 1
	[0267.236] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0267.268] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0267.738] SetEvent (hEvent=0x124) returned 1
	[0267.738] SetEvent (hEvent=0x12c) returned 1
	[0267.738] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0267.778] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0268.075] SetEvent (hEvent=0x104) returned 1
	[0268.075] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0268.150] SetEvent (hEvent=0x104) returned 1
	[0268.150] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0268.211] SetEvent (hEvent=0x104) returned 1
	[0268.211] SwitchToThread () returned 1
	[0268.283] SetEvent (hEvent=0x104) returned 1
	[0268.283] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0268.469] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0269.771] SetEvent (hEvent=0x14c) returned 1
	[0269.771] SetEvent (hEvent=0x124) returned 1
	[0269.771] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0269.810] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0270.062] SetEvent (hEvent=0x104) returned 1
	[0270.062] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0270.183] SetEvent (hEvent=0x104) returned 1
	[0270.183] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0270.232] SetEvent (hEvent=0x104) returned 1
	[0270.232] SwitchToThread () returned 1
	[0270.262] SetEvent (hEvent=0x104) returned 1
	[0270.262] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0270.300] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0271.123] SetEvent (hEvent=0x12c) returned 1
	[0271.123] SetEvent (hEvent=0x14c) returned 1
	[0271.123] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0271.318] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0272.093] SetEvent (hEvent=0x104) returned 1
	[0272.093] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0272.154] SetEvent (hEvent=0x104) returned 1
	[0272.154] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0272.259] SetEvent (hEvent=0x104) returned 1
	[0272.259] SwitchToThread () returned 1
	[0272.265] SetEvent (hEvent=0x104) returned 1
	[0272.265] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0272.324] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0273.090] SetEvent (hEvent=0x124) returned 1
	[0273.090] SetEvent (hEvent=0x12c) returned 1
	[0273.090] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0273.134] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0273.297] SetEvent (hEvent=0x104) returned 1
	[0273.297] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0273.326] SetEvent (hEvent=0x104) returned 1
	[0273.326] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0273.328] SetEvent (hEvent=0x104) returned 1
	[0273.329] SwitchToThread () returned 1
	[0273.329] SetEvent (hEvent=0x104) returned 1
	[0273.329] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0273.329] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0274.118] SetEvent (hEvent=0x14c) returned 1
	[0274.118] SetEvent (hEvent=0x124) returned 1
	[0274.118] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0274.157] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0274.211] SetEvent (hEvent=0x104) returned 1
	[0274.211] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0274.265] SetEvent (hEvent=0x104) returned 1
	[0274.265] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0274.276] SetEvent (hEvent=0x104) returned 1
	[0274.276] SwitchToThread () returned 1
	[0274.276] SetEvent (hEvent=0x104) returned 1
	[0274.277] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0274.279] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0275.411] SetEvent (hEvent=0x12c) returned 1
	[0275.411] SetEvent (hEvent=0x14c) returned 1
	[0275.411] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0275.427] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0275.503] SetEvent (hEvent=0x104) returned 1
	[0275.503] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0275.522] SetEvent (hEvent=0x104) returned 1
	[0275.522] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0275.529] SetEvent (hEvent=0x104) returned 1
	[0275.529] SwitchToThread () returned 1
	[0275.529] SetEvent (hEvent=0x104) returned 1
	[0275.529] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0275.529] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0275.534] SetEvent (hEvent=0x104) returned 1
	[0275.534] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0275.535] SetEvent (hEvent=0x124) returned 1
	[0275.535] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0275.621] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0275.622] SetEvent (hEvent=0x124) returned 1
	[0275.622] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0275.622] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0275.834] SetEvent (hEvent=0x124) returned 1
	[0275.834] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0275.835] SetEvent (hEvent=0x124) returned 1
	[0275.835] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0275.849] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0275.889] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0275.915] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0275.987] SetEvent (hEvent=0x124) returned 1
	[0275.987] SetEvent (hEvent=0x12c) returned 1
	[0275.987] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x0
	[0275.987] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x0
	[0275.988] SetEvent (hEvent=0x124) returned 1
	[0275.988] SetEvent (hEvent=0x12c) returned 1
	[0275.988] SetEvent (hEvent=0x14c) returned 1
	[0275.988] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0275.996] SetEvent (hEvent=0x168) returned 1
	[0275.996] SetEvent (hEvent=0x14c) returned 1
	[0275.997] SetEvent (hEvent=0x104) returned 1
	[0275.997] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0276.015] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0276.033] SetEvent (hEvent=0x104) returned 1
	[0276.033] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0276.034] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0276.078] SetEvent (hEvent=0x104) returned 1
	[0276.078] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0276.081] SetEvent (hEvent=0x14c) returned 1
	[0276.081] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0276.176] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0276.177] SetEvent (hEvent=0x14c) returned 1
	[0276.177] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0276.178] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0277.193] SetEvent (hEvent=0x124) returned 1
	[0277.193] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0277.232] SetEvent (hEvent=0x124) returned 1
	[0277.233] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0277.380] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0277.540] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0277.672] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0277.696] SetEvent (hEvent=0x124) returned 1
	[0277.697] SetEvent (hEvent=0x12c) returned 1
	[0277.697] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0277.752] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0277.752] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0277.792] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0277.792] SetEvent (hEvent=0x124) returned 1
	[0277.792] SetEvent (hEvent=0x12c) returned 1
	[0277.792] SetEvent (hEvent=0x14c) returned 1
	[0277.792] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0277.833] SetEvent (hEvent=0x168) returned 1
	[0277.833] SetEvent (hEvent=0x14c) returned 1
	[0277.833] SetEvent (hEvent=0x104) returned 1
	[0277.834] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0277.881] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0277.924] SetEvent (hEvent=0x104) returned 1
	[0277.924] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0277.964] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0278.088] SetEvent (hEvent=0x104) returned 1
	[0278.088] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0278.128] SetEvent (hEvent=0x14c) returned 1
	[0278.128] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0278.286] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0278.363] SetEvent (hEvent=0x14c) returned 1
	[0278.363] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0278.368] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0278.647] SetEvent (hEvent=0x124) returned 1
	[0278.647] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0278.647] SetEvent (hEvent=0x124) returned 1
	[0278.648] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0278.658] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0278.693] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0278.819] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0278.870] SetEvent (hEvent=0x124) returned 1
	[0278.870] SetEvent (hEvent=0x12c) returned 1
	[0278.870] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0278.889] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0278.889] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x0
	[0278.899] SetEvent (hEvent=0x124) returned 1
	[0278.899] SetEvent (hEvent=0x12c) returned 1
	[0278.899] SetEvent (hEvent=0x14c) returned 1
	[0278.899] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0278.900] SetEvent (hEvent=0x168) returned 1
	[0278.900] SetEvent (hEvent=0x14c) returned 1
	[0278.900] SetEvent (hEvent=0x104) returned 1
	[0278.900] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0278.921] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0278.937] SetEvent (hEvent=0x104) returned 1
	[0278.937] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0278.938] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0278.975] SetEvent (hEvent=0x104) returned 1
	[0278.975] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0278.990] SetEvent (hEvent=0x14c) returned 1
	[0278.990] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0279.078] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0279.079] SetEvent (hEvent=0x14c) returned 1
	[0279.079] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0279.080] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0279.271] SetEvent (hEvent=0x124) returned 1
	[0279.271] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0279.272] SetEvent (hEvent=0x124) returned 1
	[0279.272] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0279.289] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0279.377] SetEvent (hEvent=0x104) returned 1
	[0279.377] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0279.378] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0279.461] SetEvent (hEvent=0x104) returned 1
	[0279.461] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0279.474] SetEvent (hEvent=0x124) returned 1
	[0279.474] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0279.512] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0279.516] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0279.572] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0279.591] SetEvent (hEvent=0x104) returned 1
	[0279.591] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0279.597] SetEvent (hEvent=0x124) returned 1
	[0279.598] SetEvent (hEvent=0x12c) returned 1
	[0279.598] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0279.621] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0279.621] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0279.665] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0279.665] SetEvent (hEvent=0x124) returned 1
	[0279.665] SetEvent (hEvent=0x12c) returned 1
	[0279.665] SetEvent (hEvent=0x14c) returned 1
	[0279.665] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0279.668] SetEvent (hEvent=0x168) returned 1
	[0279.668] SetEvent (hEvent=0x14c) returned 1
	[0279.668] SetEvent (hEvent=0x104) returned 1
	[0279.668] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0279.669] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0279.678] SetEvent (hEvent=0x104) returned 1
	[0279.678] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0279.679] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0279.706] SetEvent (hEvent=0x104) returned 1
	[0279.706] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0279.707] SetEvent (hEvent=0x14c) returned 1
	[0279.707] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0279.785] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0279.788] SetEvent (hEvent=0x14c) returned 1
	[0279.788] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0279.789] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0279.982] SetEvent (hEvent=0x124) returned 1
	[0279.982] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0279.982] SetEvent (hEvent=0x124) returned 1
	[0279.983] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0279.995] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0280.020] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0280.074] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0280.093] SetEvent (hEvent=0x124) returned 1
	[0280.094] SetEvent (hEvent=0x12c) returned 1
	[0280.094] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x0
	[0280.108] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x0
	[0280.109] SetEvent (hEvent=0x124) returned 1
	[0280.109] SetEvent (hEvent=0x12c) returned 1
	[0280.109] SetEvent (hEvent=0x14c) returned 1
	[0280.109] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0280.110] SetEvent (hEvent=0x168) returned 1
	[0280.110] SetEvent (hEvent=0x14c) returned 1
	[0280.110] SetEvent (hEvent=0x104) returned 1
	[0280.110] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0280.111] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0280.118] SetEvent (hEvent=0x104) returned 1
	[0280.118] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0280.119] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0280.150] SetEvent (hEvent=0x104) returned 1
	[0280.150] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0280.151] SetEvent (hEvent=0x14c) returned 1
	[0280.151] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0280.238] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0280.238] SetEvent (hEvent=0x14c) returned 1
	[0280.238] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0280.239] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0280.434] SetEvent (hEvent=0x14c) returned 1
	[0280.434] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0280.434] SetEvent (hEvent=0x14c) returned 1
	[0280.434] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0280.448] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0280.475] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0280.538] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0280.592] SetEvent (hEvent=0x14c) returned 1
	[0280.593] SetEvent (hEvent=0x124) returned 1
	[0280.593] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0280.622] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0280.622] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x0
	[0280.623] SetEvent (hEvent=0x14c) returned 1
	[0280.623] SetEvent (hEvent=0x124) returned 1
	[0280.623] SetEvent (hEvent=0x12c) returned 1
	[0280.623] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0280.624] SetEvent (hEvent=0x168) returned 1
	[0280.624] SetEvent (hEvent=0x12c) returned 1
	[0280.624] SetEvent (hEvent=0x104) returned 1
	[0280.624] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0280.625] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0280.633] SetEvent (hEvent=0x104) returned 1
	[0280.633] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0280.636] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0280.670] SetEvent (hEvent=0x104) returned 1
	[0280.670] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0280.672] SetEvent (hEvent=0x12c) returned 1
	[0280.672] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0280.768] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0280.769] SetEvent (hEvent=0x12c) returned 1
	[0280.769] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0280.769] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0280.929] SetEvent (hEvent=0x14c) returned 1
	[0280.929] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0280.929] SetEvent (hEvent=0x14c) returned 1
	[0280.930] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0280.949] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0281.003] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0281.031] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0281.106] SetEvent (hEvent=0x14c) returned 1
	[0281.106] SetEvent (hEvent=0x124) returned 1
	[0281.106] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x0
	[0281.107] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x0
	[0281.107] SetEvent (hEvent=0x14c) returned 1
	[0281.107] SetEvent (hEvent=0x124) returned 1
	[0281.107] SetEvent (hEvent=0x12c) returned 1
	[0281.107] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0281.108] SetEvent (hEvent=0x168) returned 1
	[0281.108] SetEvent (hEvent=0x12c) returned 1
	[0281.108] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0281.388] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0281.431] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0281.490] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0281.528] SetEvent (hEvent=0x12c) returned 1
	[0281.529] SetEvent (hEvent=0x124) returned 1
	[0281.529] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0281.551] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0281.551] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0281.559] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0281.559] SetEvent (hEvent=0x12c) returned 1
	[0281.559] SetEvent (hEvent=0x124) returned 1
	[0281.559] SetEvent (hEvent=0x14c) returned 1
	[0281.559] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0281.560] SetEvent (hEvent=0x168) returned 1
	[0281.560] SetEvent (hEvent=0x14c) returned 1
	[0281.560] SetEvent (hEvent=0x104) returned 1
	[0281.560] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0281.561] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0281.576] SetEvent (hEvent=0x104) returned 1
	[0281.576] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0281.576] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0281.617] SetEvent (hEvent=0x104) returned 1
	[0281.617] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0281.619] SetEvent (hEvent=0x14c) returned 1
	[0281.619] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0281.793] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0281.799] SetEvent (hEvent=0x14c) returned 1
	[0281.799] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0281.800] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0282.027] SetEvent (hEvent=0x12c) returned 1
	[0282.027] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0282.028] SetEvent (hEvent=0x12c) returned 1
	[0282.028] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0282.041] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0282.105] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0282.187] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0282.224] SetEvent (hEvent=0x12c) returned 1
	[0282.225] SetEvent (hEvent=0x124) returned 1
	[0282.225] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0282.247] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0282.247] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0282.249] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0282.250] SetEvent (hEvent=0x12c) returned 1
	[0282.250] SetEvent (hEvent=0x124) returned 1
	[0282.250] SetEvent (hEvent=0x14c) returned 1
	[0282.250] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0282.251] SetEvent (hEvent=0x168) returned 1
	[0282.251] SetEvent (hEvent=0x14c) returned 1
	[0282.251] SetEvent (hEvent=0x104) returned 1
	[0282.251] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0282.252] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0282.265] SetEvent (hEvent=0x104) returned 1
	[0282.266] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0282.266] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0282.304] SetEvent (hEvent=0x104) returned 1
	[0282.304] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0282.306] SetEvent (hEvent=0x14c) returned 1
	[0282.306] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0282.437] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0282.439] SetEvent (hEvent=0x14c) returned 1
	[0282.439] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0282.440] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0282.579] SetEvent (hEvent=0x12c) returned 1
	[0282.579] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0282.581] SetEvent (hEvent=0x12c) returned 1
	[0282.581] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0282.592] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0282.618] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0282.653] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0282.694] SetEvent (hEvent=0x12c) returned 1
	[0282.694] SetEvent (hEvent=0x124) returned 1
	[0282.694] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0282.712] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0282.712] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0282.714] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0282.714] SetEvent (hEvent=0x12c) returned 1
	[0282.714] SetEvent (hEvent=0x124) returned 1
	[0282.714] SetEvent (hEvent=0x14c) returned 1
	[0282.714] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0282.714] SetEvent (hEvent=0x168) returned 1
	[0282.714] SetEvent (hEvent=0x14c) returned 1
	[0282.714] SetEvent (hEvent=0x104) returned 1
	[0282.714] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0282.716] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0282.726] SetEvent (hEvent=0x104) returned 1
	[0282.726] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0282.727] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0282.755] SetEvent (hEvent=0x104) returned 1
	[0282.755] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0282.756] SetEvent (hEvent=0x14c) returned 1
	[0282.756] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0282.852] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0282.855] SetEvent (hEvent=0x14c) returned 1
	[0282.855] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0282.856] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0283.146] SetEvent (hEvent=0x124) returned 1
	[0283.146] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0283.146] SetEvent (hEvent=0x124) returned 1
	[0283.146] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0283.159] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0283.184] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0283.201] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0283.288] SetEvent (hEvent=0x124) returned 1
	[0283.288] SetEvent (hEvent=0x12c) returned 1
	[0283.288] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0283.304] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0283.304] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0283.339] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0283.339] SetEvent (hEvent=0x124) returned 1
	[0283.339] SetEvent (hEvent=0x12c) returned 1
	[0283.339] SetEvent (hEvent=0x14c) returned 1
	[0283.339] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0283.340] SetEvent (hEvent=0x168) returned 1
	[0283.340] SetEvent (hEvent=0x14c) returned 1
	[0283.340] SetEvent (hEvent=0x104) returned 1
	[0283.340] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0283.341] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0283.348] SetEvent (hEvent=0x104) returned 1
	[0283.348] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0283.348] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0283.379] SetEvent (hEvent=0x104) returned 1
	[0283.379] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0283.381] SetEvent (hEvent=0x14c) returned 1
	[0283.381] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0283.460] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0283.461] SetEvent (hEvent=0x14c) returned 1
	[0283.461] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0283.461] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0283.602] SetEvent (hEvent=0x124) returned 1
	[0283.602] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0283.602] SetEvent (hEvent=0x124) returned 1
	[0283.602] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0283.652] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0283.677] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0283.732] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0283.773] SetEvent (hEvent=0x124) returned 1
	[0283.773] SetEvent (hEvent=0x12c) returned 1
	[0283.773] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0283.775] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0283.776] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0283.777] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0283.777] SetEvent (hEvent=0x124) returned 1
	[0283.777] SetEvent (hEvent=0x12c) returned 1
	[0283.777] SetEvent (hEvent=0x14c) returned 1
	[0283.777] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0283.778] SetEvent (hEvent=0x168) returned 1
	[0283.778] SetEvent (hEvent=0x14c) returned 1
	[0283.778] SetEvent (hEvent=0x104) returned 1
	[0283.778] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0283.797] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0283.814] SetEvent (hEvent=0x104) returned 1
	[0283.814] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0283.815] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0283.856] SetEvent (hEvent=0x104) returned 1
	[0283.856] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0283.857] SetEvent (hEvent=0x14c) returned 1
	[0283.857] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0283.955] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0283.958] SetEvent (hEvent=0x14c) returned 1
	[0283.958] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0283.960] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0284.150] SetEvent (hEvent=0x124) returned 1
	[0284.150] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0284.151] SetEvent (hEvent=0x124) returned 1
	[0284.151] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0284.167] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0284.209] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0284.210] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0284.387] SetEvent (hEvent=0x104) returned 1
	[0284.387] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0284.387] SetEvent (hEvent=0x104) returned 1
	[0284.387] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0284.398] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0284.439] SetEvent (hEvent=0x12c) returned 1
	[0284.439] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0284.440] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0284.534] SetEvent (hEvent=0x124) returned 1
	[0284.534] SetEvent (hEvent=0x104) returned 1
	[0284.534] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0284.535] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0284.553] SetEvent (hEvent=0x12c) returned 1
	[0284.553] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0284.576] SetEvent (hEvent=0x12c) returned 1
	[0284.576] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0284.580] SetEvent (hEvent=0x12c) returned 1
	[0284.580] SwitchToThread () returned 1
	[0284.581] SetEvent (hEvent=0x12c) returned 1
	[0284.581] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0284.581] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0284.662] SetEvent (hEvent=0x14c) returned 1
	[0284.662] SetEvent (hEvent=0x124) returned 1
	[0284.662] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0284.669] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0284.699] SetEvent (hEvent=0x12c) returned 1
	[0284.699] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0284.724] SetEvent (hEvent=0x12c) returned 1
	[0284.724] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0284.728] SetEvent (hEvent=0x12c) returned 1
	[0284.728] SwitchToThread () returned 1
	[0284.728] SetEvent (hEvent=0x12c) returned 1
	[0284.728] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0284.729] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0284.818] SetEvent (hEvent=0x104) returned 1
	[0284.818] SetEvent (hEvent=0x14c) returned 1
	[0284.818] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0284.819] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0284.836] SetEvent (hEvent=0x12c) returned 1
	[0284.836] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0284.859] SetEvent (hEvent=0x12c) returned 1
	[0284.859] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0284.863] SetEvent (hEvent=0x12c) returned 1
	[0284.863] SwitchToThread () returned 1
	[0284.863] SetEvent (hEvent=0x12c) returned 1
	[0284.863] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0284.864] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0284.993] SetEvent (hEvent=0x124) returned 1
	[0284.993] SetEvent (hEvent=0x104) returned 1
	[0284.993] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0284.994] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0285.005] SetEvent (hEvent=0x12c) returned 1
	[0285.005] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0285.028] SetEvent (hEvent=0x12c) returned 1
	[0285.028] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0285.033] SetEvent (hEvent=0x12c) returned 1
	[0285.033] SwitchToThread () returned 1
	[0285.033] SetEvent (hEvent=0x12c) returned 1
	[0285.033] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0285.034] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0285.128] SetEvent (hEvent=0x14c) returned 1
	[0285.128] SetEvent (hEvent=0x124) returned 1
	[0285.128] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0285.167] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0285.185] SetEvent (hEvent=0x12c) returned 1
	[0285.185] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0285.205] SetEvent (hEvent=0x12c) returned 1
	[0285.205] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0285.207] SetEvent (hEvent=0x12c) returned 1
	[0285.207] SwitchToThread () returned 1
	[0285.207] SetEvent (hEvent=0x12c) returned 1
	[0285.207] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0285.208] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0285.304] SetEvent (hEvent=0x104) returned 1
	[0285.304] SetEvent (hEvent=0x14c) returned 1
	[0285.304] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0285.305] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0285.314] SetEvent (hEvent=0x12c) returned 1
	[0285.314] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0285.371] SetEvent (hEvent=0x12c) returned 1
	[0285.371] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0285.375] SetEvent (hEvent=0x12c) returned 1
	[0285.375] SwitchToThread () returned 1
	[0285.375] SetEvent (hEvent=0x12c) returned 1
	[0285.375] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0285.376] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0285.583] SetEvent (hEvent=0x124) returned 1
	[0285.583] SetEvent (hEvent=0x104) returned 1
	[0285.583] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0285.585] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0285.604] SetEvent (hEvent=0x12c) returned 1
	[0285.604] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0285.637] SetEvent (hEvent=0x12c) returned 1
	[0285.637] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0285.642] SetEvent (hEvent=0x12c) returned 1
	[0285.642] SwitchToThread () returned 1
	[0285.643] SetEvent (hEvent=0x12c) returned 1
	[0285.643] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0285.644] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0285.747] SetEvent (hEvent=0x14c) returned 1
	[0285.747] SetEvent (hEvent=0x124) returned 1
	[0285.747] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0285.749] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0285.762] SetEvent (hEvent=0x12c) returned 1
	[0285.762] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0285.787] SetEvent (hEvent=0x12c) returned 1
	[0285.787] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0285.789] SetEvent (hEvent=0x12c) returned 1
	[0285.790] SwitchToThread () returned 1
	[0285.790] SetEvent (hEvent=0x12c) returned 1
	[0285.790] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0285.790] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0285.875] SetEvent (hEvent=0x104) returned 1
	[0285.875] SetEvent (hEvent=0x14c) returned 1
	[0285.875] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0285.876] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0285.886] SetEvent (hEvent=0x12c) returned 1
	[0285.886] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0285.909] SetEvent (hEvent=0x12c) returned 1
	[0285.909] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0285.912] SetEvent (hEvent=0x12c) returned 1
	[0285.912] SwitchToThread () returned 1
	[0285.912] SetEvent (hEvent=0x12c) returned 1
	[0285.912] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0285.912] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0285.993] SetEvent (hEvent=0x124) returned 1
	[0285.993] SetEvent (hEvent=0x104) returned 1
	[0285.993] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0285.994] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0286.008] SetEvent (hEvent=0x12c) returned 1
	[0286.008] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0286.029] SetEvent (hEvent=0x12c) returned 1
	[0286.029] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0286.032] SetEvent (hEvent=0x12c) returned 1
	[0286.033] SwitchToThread () returned 1
	[0286.033] SetEvent (hEvent=0x12c) returned 1
	[0286.033] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0286.033] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0286.150] SetEvent (hEvent=0x14c) returned 1
	[0286.150] SetEvent (hEvent=0x124) returned 1
	[0286.150] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0286.153] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0286.172] SetEvent (hEvent=0x12c) returned 1
	[0286.172] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0286.210] SetEvent (hEvent=0x12c) returned 1
	[0286.210] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0286.233] SetEvent (hEvent=0x12c) returned 1
	[0286.233] SwitchToThread () returned 1
	[0286.234] SetEvent (hEvent=0x12c) returned 1
	[0286.234] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0286.234] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0286.417] SetEvent (hEvent=0x104) returned 1
	[0286.417] SetEvent (hEvent=0x14c) returned 1
	[0286.417] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0286.420] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0286.451] SetEvent (hEvent=0x12c) returned 1
	[0286.451] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0286.498] SetEvent (hEvent=0x12c) returned 1
	[0286.498] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0286.523] SetEvent (hEvent=0x12c) returned 1
	[0286.523] SwitchToThread () returned 1
	[0286.523] SetEvent (hEvent=0x12c) returned 1
	[0286.523] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0286.524] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0286.636] SetEvent (hEvent=0x124) returned 1
	[0286.636] SetEvent (hEvent=0x104) returned 1
	[0286.636] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0286.639] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0286.659] SetEvent (hEvent=0x12c) returned 1
	[0286.659] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0286.688] SetEvent (hEvent=0x12c) returned 1
	[0286.688] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0286.691] SetEvent (hEvent=0x12c) returned 1
	[0286.691] SwitchToThread () returned 1
	[0286.692] SetEvent (hEvent=0x12c) returned 1
	[0286.692] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0286.692] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0286.776] SetEvent (hEvent=0x14c) returned 1
	[0286.776] SetEvent (hEvent=0x124) returned 1
	[0286.776] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0286.777] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0286.789] SetEvent (hEvent=0x12c) returned 1
	[0286.789] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0286.811] SetEvent (hEvent=0x12c) returned 1
	[0286.811] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0286.817] SetEvent (hEvent=0x12c) returned 1
	[0286.817] SwitchToThread () returned 1
	[0286.817] SetEvent (hEvent=0x12c) returned 1
	[0286.817] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0286.817] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0286.906] SetEvent (hEvent=0x104) returned 1
	[0286.906] SetEvent (hEvent=0x14c) returned 1
	[0286.906] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0286.907] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0286.917] SetEvent (hEvent=0x12c) returned 1
	[0286.917] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0286.920] SwitchToThread () returned 1
	[0286.939] SetEvent (hEvent=0x12c) returned 1
	[0286.939] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0286.943] SetEvent (hEvent=0x12c) returned 1
	[0286.944] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0286.944] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0287.040] SetEvent (hEvent=0x124) returned 1
	[0287.040] SetEvent (hEvent=0x104) returned 1
	[0287.040] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0287.042] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0287.060] SetEvent (hEvent=0x12c) returned 1
	[0287.060] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0287.061] SwitchToThread () returned 1
	[0287.082] SetEvent (hEvent=0x12c) returned 1
	[0287.082] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0287.085] SetEvent (hEvent=0x12c) returned 1
	[0287.085] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0287.085] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0287.168] SetEvent (hEvent=0x14c) returned 1
	[0287.168] SetEvent (hEvent=0x124) returned 1
	[0287.168] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0287.170] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0287.178] SetEvent (hEvent=0x12c) returned 1
	[0287.178] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0287.190] SwitchToThread () returned 1
	[0287.203] SetEvent (hEvent=0x12c) returned 1
	[0287.203] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0287.206] SetEvent (hEvent=0x12c) returned 1
	[0287.206] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0287.206] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0287.305] SetEvent (hEvent=0x104) returned 1
	[0287.305] SetEvent (hEvent=0x14c) returned 1
	[0287.305] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0287.307] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0287.353] SetEvent (hEvent=0x12c) returned 1
	[0287.354] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0287.366] SwitchToThread () returned 1
	[0287.375] SetEvent (hEvent=0x12c) returned 1
	[0287.375] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0287.377] SetEvent (hEvent=0x12c) returned 1
	[0287.377] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0287.378] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0287.469] SetEvent (hEvent=0x124) returned 1
	[0287.469] SetEvent (hEvent=0x104) returned 1
	[0287.469] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0287.470] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0287.499] SetEvent (hEvent=0x12c) returned 1
	[0287.499] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0287.519] SwitchToThread () returned 1
	[0287.519] SetEvent (hEvent=0x12c) returned 1
	[0287.519] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0287.522] SetEvent (hEvent=0x12c) returned 1
	[0287.522] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0287.523] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0287.660] SetEvent (hEvent=0x14c) returned 1
	[0287.660] SetEvent (hEvent=0x124) returned 1
	[0287.660] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0287.667] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0287.690] SetEvent (hEvent=0x12c) returned 1
	[0287.690] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0287.712] SetEvent (hEvent=0x12c) returned 1
	[0287.712] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0287.714] SetEvent (hEvent=0x12c) returned 1
	[0287.714] SwitchToThread () returned 1
	[0287.714] SetEvent (hEvent=0x12c) returned 1
	[0287.714] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0287.715] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0287.803] SetEvent (hEvent=0x104) returned 1
	[0287.803] SetEvent (hEvent=0x14c) returned 1
	[0287.803] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0287.806] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0287.816] SetEvent (hEvent=0x12c) returned 1
	[0287.816] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0287.826] SwitchToThread () returned 1
	[0287.843] SetEvent (hEvent=0x12c) returned 1
	[0287.843] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0287.850] SetEvent (hEvent=0x12c) returned 1
	[0287.850] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0287.851] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0287.984] SetEvent (hEvent=0x124) returned 1
	[0287.984] SetEvent (hEvent=0x104) returned 1
	[0287.984] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0287.985] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0288.038] SetEvent (hEvent=0x12c) returned 1
	[0288.038] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0288.067] SetEvent (hEvent=0x12c) returned 1
	[0288.067] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0288.071] SetEvent (hEvent=0x12c) returned 1
	[0288.071] SwitchToThread () returned 1
	[0288.071] SetEvent (hEvent=0x12c) returned 1
	[0288.072] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0288.072] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0288.120] SetEvent (hEvent=0x124) returned 1
	[0288.120] SetEvent (hEvent=0x14c) returned 1
	[0288.121] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0288.123] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0288.141] SetEvent (hEvent=0x12c) returned 1
	[0288.141] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0288.169] SwitchToThread () returned 1
	[0288.173] SetEvent (hEvent=0x12c) returned 1
	[0288.173] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0288.177] SetEvent (hEvent=0x12c) returned 1
	[0288.177] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0288.179] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0288.243] SetEvent (hEvent=0x104) returned 1
	[0288.243] SetEvent (hEvent=0x124) returned 1
	[0288.243] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0288.260] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0288.275] SetEvent (hEvent=0x12c) returned 1
	[0288.275] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0288.304] SetEvent (hEvent=0x12c) returned 1
	[0288.304] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0288.308] SetEvent (hEvent=0x12c) returned 1
	[0288.308] SwitchToThread () returned 1
	[0288.308] SetEvent (hEvent=0x12c) returned 1
	[0288.308] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0288.308] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0288.366] SetEvent (hEvent=0x14c) returned 1
	[0288.366] SetEvent (hEvent=0x104) returned 1
	[0288.366] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0288.380] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0288.457] SetEvent (hEvent=0x12c) returned 1
	[0288.457] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0288.479] SetEvent (hEvent=0x12c) returned 1
	[0288.479] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0288.482] SetEvent (hEvent=0x12c) returned 1
	[0288.482] SwitchToThread () returned 1
	[0288.485] SetEvent (hEvent=0x12c) returned 1
	[0288.485] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0288.487] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0288.525] SetEvent (hEvent=0x124) returned 1
	[0288.525] SetEvent (hEvent=0x14c) returned 1
	[0288.525] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0288.527] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0288.606] SetEvent (hEvent=0x12c) returned 1
	[0288.606] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0288.626] SetEvent (hEvent=0x12c) returned 1
	[0288.626] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0288.632] SetEvent (hEvent=0x12c) returned 1
	[0288.632] SwitchToThread () returned 1
	[0288.632] SetEvent (hEvent=0x12c) returned 1
	[0288.632] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0288.632] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0288.774] SetEvent (hEvent=0x124) returned 1
	[0288.774] SetEvent (hEvent=0x104) returned 1
	[0288.774] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0288.775] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0288.953] SetEvent (hEvent=0x12c) returned 1
	[0288.953] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0288.989] SetEvent (hEvent=0x12c) returned 1
	[0288.989] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0288.997] SetEvent (hEvent=0x12c) returned 1
	[0288.997] SwitchToThread () returned 1
	[0288.997] SetEvent (hEvent=0x12c) returned 1
	[0288.998] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0289.001] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0289.096] SetEvent (hEvent=0x124) returned 1
	[0289.096] SetEvent (hEvent=0x14c) returned 1
	[0289.096] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0289.117] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0289.135] SetEvent (hEvent=0x12c) returned 1
	[0289.136] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0289.170] SetEvent (hEvent=0x12c) returned 1
	[0289.170] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0289.176] SetEvent (hEvent=0x12c) returned 1
	[0289.176] SwitchToThread () returned 1
	[0289.176] SetEvent (hEvent=0x12c) returned 1
	[0289.176] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0289.176] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0289.261] SetEvent (hEvent=0x104) returned 1
	[0289.261] SetEvent (hEvent=0x124) returned 1
	[0289.261] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0289.263] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0289.271] SetEvent (hEvent=0x12c) returned 1
	[0289.271] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0289.293] SwitchToThread () returned 1
	[0289.303] SetEvent (hEvent=0x12c) returned 1
	[0289.303] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0289.307] SetEvent (hEvent=0x12c) returned 1
	[0289.307] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0289.307] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0289.339] SetEvent (hEvent=0x14c) returned 1
	[0289.339] SetEvent (hEvent=0x104) returned 1
	[0289.339] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0289.339] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0289.384] SetEvent (hEvent=0x12c) returned 1
	[0289.384] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0289.407] SetEvent (hEvent=0x12c) returned 1
	[0289.407] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0289.447] SetEvent (hEvent=0x12c) returned 1
	[0289.447] SwitchToThread () returned 1
	[0289.447] SetEvent (hEvent=0x12c) returned 1
	[0289.447] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0289.447] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0289.499] SetEvent (hEvent=0x14c) returned 1
	[0289.499] SetEvent (hEvent=0x124) returned 1
	[0289.499] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0289.500] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0289.553] SetEvent (hEvent=0x12c) returned 1
	[0289.553] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0289.578] SetEvent (hEvent=0x12c) returned 1
	[0289.578] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0289.581] SetEvent (hEvent=0x12c) returned 1
	[0289.581] SwitchToThread () returned 1
	[0289.582] SetEvent (hEvent=0x12c) returned 1
	[0289.582] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0289.582] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0289.710] SetEvent (hEvent=0x14c) returned 1
	[0289.710] SetEvent (hEvent=0x104) returned 1
	[0289.710] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0289.711] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0289.726] SetEvent (hEvent=0x12c) returned 1
	[0289.726] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0289.750] SetEvent (hEvent=0x12c) returned 1
	[0289.750] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0289.754] SetEvent (hEvent=0x12c) returned 1
	[0289.754] SwitchToThread () returned 1
	[0289.754] SetEvent (hEvent=0x12c) returned 1
	[0289.754] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0289.755] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0289.809] SetEvent (hEvent=0x124) returned 1
	[0289.809] SetEvent (hEvent=0x14c) returned 1
	[0289.809] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0289.809] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0289.876] SetEvent (hEvent=0x12c) returned 1
	[0289.876] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0289.901] SetEvent (hEvent=0x12c) returned 1
	[0289.901] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0289.904] SetEvent (hEvent=0x12c) returned 1
	[0289.904] SwitchToThread () returned 1
	[0289.904] SetEvent (hEvent=0x12c) returned 1
	[0289.904] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0289.904] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0289.939] SetEvent (hEvent=0x124) returned 1
	[0289.939] SetEvent (hEvent=0x104) returned 1
	[0289.939] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0289.940] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0290.155] SetEvent (hEvent=0x12c) returned 1
	[0290.155] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0290.179] SetEvent (hEvent=0x12c) returned 1
	[0290.179] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0290.183] SetEvent (hEvent=0x12c) returned 1
	[0290.183] SwitchToThread () returned 1
	[0290.183] SetEvent (hEvent=0x12c) returned 1
	[0290.183] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0290.183] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0290.292] SetEvent (hEvent=0x124) returned 1
	[0290.292] SetEvent (hEvent=0x14c) returned 1
	[0290.292] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0290.294] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0290.315] SetEvent (hEvent=0x12c) returned 1
	[0290.315] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0290.336] SetEvent (hEvent=0x12c) returned 1
	[0290.336] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0290.339] SetEvent (hEvent=0x12c) returned 1
	[0290.339] SwitchToThread () returned 1
	[0290.339] SetEvent (hEvent=0x12c) returned 1
	[0290.339] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0290.339] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0290.388] SetEvent (hEvent=0x104) returned 1
	[0290.388] SetEvent (hEvent=0x124) returned 1
	[0290.388] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0290.389] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0290.470] SetEvent (hEvent=0x12c) returned 1
	[0290.470] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0290.489] SwitchToThread () returned 1
	[0290.492] SetEvent (hEvent=0x12c) returned 1
	[0290.492] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0290.496] SetEvent (hEvent=0x12c) returned 1
	[0290.496] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0290.496] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0290.533] SetEvent (hEvent=0x104) returned 1
	[0290.533] SetEvent (hEvent=0x14c) returned 1
	[0290.533] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0290.533] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0290.671] SetEvent (hEvent=0x12c) returned 1
	[0290.671] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0290.693] SetEvent (hEvent=0x12c) returned 1
	[0290.693] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0290.697] SetEvent (hEvent=0x12c) returned 1
	[0290.697] SwitchToThread () returned 1
	[0290.697] SetEvent (hEvent=0x12c) returned 1
	[0290.697] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0290.697] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0290.734] SetEvent (hEvent=0x104) returned 1
	[0290.734] SetEvent (hEvent=0x124) returned 1
	[0290.734] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0290.734] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0290.820] SetEvent (hEvent=0x12c) returned 1
	[0290.820] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0290.845] SetEvent (hEvent=0x12c) returned 1
	[0290.845] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0290.848] SetEvent (hEvent=0x12c) returned 1
	[0290.848] SwitchToThread () returned 1
	[0290.848] SetEvent (hEvent=0x12c) returned 1
	[0290.848] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0290.848] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0290.884] SetEvent (hEvent=0x104) returned 1
	[0290.884] SetEvent (hEvent=0x14c) returned 1
	[0290.884] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0290.885] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0290.925] SetEvent (hEvent=0x12c) returned 1
	[0290.925] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0290.949] SetEvent (hEvent=0x12c) returned 1
	[0290.949] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0290.951] SetEvent (hEvent=0x12c) returned 1
	[0290.951] SwitchToThread () returned 1
	[0290.951] SetEvent (hEvent=0x12c) returned 1
	[0290.951] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0290.951] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0290.987] SetEvent (hEvent=0x104) returned 1
	[0290.988] SetEvent (hEvent=0x124) returned 1
	[0290.988] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0290.988] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.083] SetEvent (hEvent=0x12c) returned 1
	[0291.083] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.107] SetEvent (hEvent=0x12c) returned 1
	[0291.107] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.111] SetEvent (hEvent=0x12c) returned 1
	[0291.111] SwitchToThread () returned 1
	[0291.111] SetEvent (hEvent=0x12c) returned 1
	[0291.111] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.111] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.180] SetEvent (hEvent=0x104) returned 1
	[0291.180] SetEvent (hEvent=0x14c) returned 1
	[0291.180] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.181] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.195] SetEvent (hEvent=0x12c) returned 1
	[0291.195] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.245] SetEvent (hEvent=0x12c) returned 1
	[0291.245] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.263] SetEvent (hEvent=0x12c) returned 1
	[0291.263] SwitchToThread () returned 1
	[0291.264] SetEvent (hEvent=0x12c) returned 1
	[0291.264] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.264] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.311] SetEvent (hEvent=0x124) returned 1
	[0291.311] SetEvent (hEvent=0x104) returned 1
	[0291.311] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.312] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.325] SetEvent (hEvent=0x12c) returned 1
	[0291.325] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.348] SetEvent (hEvent=0x12c) returned 1
	[0291.348] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.351] SetEvent (hEvent=0x12c) returned 1
	[0291.351] SwitchToThread () returned 1
	[0291.351] SetEvent (hEvent=0x12c) returned 1
	[0291.351] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.351] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.396] SetEvent (hEvent=0x14c) returned 1
	[0291.396] SetEvent (hEvent=0x124) returned 1
	[0291.396] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.397] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.453] SetEvent (hEvent=0x12c) returned 1
	[0291.453] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.486] SetEvent (hEvent=0x12c) returned 1
	[0291.486] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.489] SetEvent (hEvent=0x12c) returned 1
	[0291.489] SwitchToThread () returned 1
	[0291.489] SetEvent (hEvent=0x12c) returned 1
	[0291.489] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.489] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.548] SetEvent (hEvent=0x104) returned 1
	[0291.548] SetEvent (hEvent=0x14c) returned 1
	[0291.548] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.552] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.560] SetEvent (hEvent=0x12c) returned 1
	[0291.560] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.585] SetEvent (hEvent=0x12c) returned 1
	[0291.585] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.588] SetEvent (hEvent=0x12c) returned 1
	[0291.588] SwitchToThread () returned 1
	[0291.589] SetEvent (hEvent=0x12c) returned 1
	[0291.589] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.589] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.633] SetEvent (hEvent=0x124) returned 1
	[0291.633] SetEvent (hEvent=0x104) returned 1
	[0291.633] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.634] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.647] SetEvent (hEvent=0x12c) returned 1
	[0291.647] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.669] SetEvent (hEvent=0x12c) returned 1
	[0291.669] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.671] SetEvent (hEvent=0x12c) returned 1
	[0291.671] SwitchToThread () returned 1
	[0291.671] SetEvent (hEvent=0x12c) returned 1
	[0291.672] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.672] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.740] SetEvent (hEvent=0x14c) returned 1
	[0291.740] SetEvent (hEvent=0x124) returned 1
	[0291.740] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.744] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.755] SetEvent (hEvent=0x12c) returned 1
	[0291.755] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.776] SwitchToThread () returned 1
	[0291.781] SetEvent (hEvent=0x12c) returned 1
	[0291.781] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.784] SetEvent (hEvent=0x12c) returned 1
	[0291.784] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.785] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.832] SetEvent (hEvent=0x104) returned 1
	[0291.832] SetEvent (hEvent=0x14c) returned 1
	[0291.832] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.834] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.844] SetEvent (hEvent=0x12c) returned 1
	[0291.844] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.880] SetEvent (hEvent=0x12c) returned 1
	[0291.880] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.883] SetEvent (hEvent=0x12c) returned 1
	[0291.883] SwitchToThread () returned 1
	[0291.883] SetEvent (hEvent=0x12c) returned 1
	[0291.883] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0291.883] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0292.049] SetEvent (hEvent=0x124) returned 1
	[0292.049] SetEvent (hEvent=0x104) returned 1
	[0292.049] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0292.050] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0292.481] SetEvent (hEvent=0x12c) returned 1
	[0292.481] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0292.572] SetEvent (hEvent=0x12c) returned 1
	[0292.572] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0292.577] SetEvent (hEvent=0x12c) returned 1
	[0292.577] SwitchToThread () returned 1
	[0292.577] SetEvent (hEvent=0x12c) returned 1
	[0292.577] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0292.578] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0292.650] SetEvent (hEvent=0x124) returned 1
	[0292.650] SetEvent (hEvent=0x14c) returned 1
	[0292.650] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0292.651] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0292.664] SetEvent (hEvent=0x12c) returned 1
	[0292.664] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0292.704] SetEvent (hEvent=0x12c) returned 1
	[0292.704] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0292.709] SetEvent (hEvent=0x12c) returned 1
	[0292.709] SwitchToThread () returned 1
	[0292.709] SetEvent (hEvent=0x12c) returned 1
	[0292.709] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0292.710] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0292.792] SetEvent (hEvent=0x104) returned 1
	[0292.792] SetEvent (hEvent=0x124) returned 1
	[0292.792] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0292.793] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0292.803] SetEvent (hEvent=0x12c) returned 1
	[0292.803] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0292.819] SwitchToThread () returned 1
	[0292.832] SetEvent (hEvent=0x12c) returned 1
	[0292.832] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0292.836] SetEvent (hEvent=0x12c) returned 1
	[0292.836] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0292.836] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0292.882] SetEvent (hEvent=0x14c) returned 1
	[0292.882] SetEvent (hEvent=0x104) returned 1
	[0292.882] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0292.887] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0292.896] SetEvent (hEvent=0x12c) returned 1
	[0292.896] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0292.934] SetEvent (hEvent=0x12c) returned 1
	[0292.934] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0292.939] SetEvent (hEvent=0x12c) returned 1
	[0292.940] SwitchToThread () returned 1
	[0292.940] SetEvent (hEvent=0x12c) returned 1
	[0292.940] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0292.940] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.007] SetEvent (hEvent=0x124) returned 1
	[0293.007] SetEvent (hEvent=0x14c) returned 1
	[0293.007] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.009] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.021] SetEvent (hEvent=0x12c) returned 1
	[0293.021] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.041] SetEvent (hEvent=0x12c) returned 1
	[0293.041] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.044] SetEvent (hEvent=0x12c) returned 1
	[0293.044] SwitchToThread () returned 1
	[0293.048] SetEvent (hEvent=0x12c) returned 1
	[0293.048] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.048] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.093] SetEvent (hEvent=0x104) returned 1
	[0293.093] SetEvent (hEvent=0x124) returned 1
	[0293.093] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.094] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.105] SetEvent (hEvent=0x12c) returned 1
	[0293.105] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.129] SetEvent (hEvent=0x12c) returned 1
	[0293.129] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.132] SetEvent (hEvent=0x12c) returned 1
	[0293.132] SwitchToThread () returned 1
	[0293.132] SetEvent (hEvent=0x12c) returned 1
	[0293.132] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.132] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.201] SetEvent (hEvent=0x14c) returned 1
	[0293.201] SetEvent (hEvent=0x104) returned 1
	[0293.202] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.203] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.241] SetEvent (hEvent=0x12c) returned 1
	[0293.241] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.263] SetEvent (hEvent=0x12c) returned 1
	[0293.263] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.265] SetEvent (hEvent=0x12c) returned 1
	[0293.265] SwitchToThread () returned 1
	[0293.265] SetEvent (hEvent=0x12c) returned 1
	[0293.265] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.266] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.313] SetEvent (hEvent=0x124) returned 1
	[0293.313] SetEvent (hEvent=0x14c) returned 1
	[0293.314] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.314] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.378] SetEvent (hEvent=0x124) returned 1
	[0293.378] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.379] SetEvent (hEvent=0x104) returned 1
	[0293.379] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.474] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.475] SetEvent (hEvent=0x104) returned 1
	[0293.475] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.476] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.616] SetEvent (hEvent=0x14c) returned 1
	[0293.616] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.616] SetEvent (hEvent=0x14c) returned 1
	[0293.616] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.632] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.663] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.687] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.705] SetEvent (hEvent=0x14c) returned 1
	[0293.705] SetEvent (hEvent=0x12c) returned 1
	[0293.705] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0293.717] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.717] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x0
	[0293.718] SetEvent (hEvent=0x14c) returned 1
	[0293.718] SetEvent (hEvent=0x12c) returned 1
	[0293.718] SetEvent (hEvent=0x104) returned 1
	[0293.718] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.719] SetEvent (hEvent=0x168) returned 1
	[0293.719] SetEvent (hEvent=0x104) returned 1
	[0293.719] SetEvent (hEvent=0x124) returned 1
	[0293.719] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.721] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.746] SetEvent (hEvent=0x124) returned 1
	[0293.746] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.747] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.774] SetEvent (hEvent=0x124) returned 1
	[0293.774] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.775] SetEvent (hEvent=0x104) returned 1
	[0293.775] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.821] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.821] SetEvent (hEvent=0x104) returned 1
	[0293.821] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0293.822] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.005] SetEvent (hEvent=0x14c) returned 1
	[0294.005] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.006] SetEvent (hEvent=0x14c) returned 1
	[0294.006] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.023] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.086] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.118] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.140] SetEvent (hEvent=0x14c) returned 1
	[0294.141] SetEvent (hEvent=0x12c) returned 1
	[0294.141] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0294.161] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.161] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x0
	[0294.162] SetEvent (hEvent=0x14c) returned 1
	[0294.162] SetEvent (hEvent=0x12c) returned 1
	[0294.162] SetEvent (hEvent=0x104) returned 1
	[0294.162] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.163] SetEvent (hEvent=0x168) returned 1
	[0294.163] SetEvent (hEvent=0x104) returned 1
	[0294.163] SetEvent (hEvent=0x124) returned 1
	[0294.163] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.164] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.182] SetEvent (hEvent=0x124) returned 1
	[0294.182] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.182] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.232] SetEvent (hEvent=0x124) returned 1
	[0294.232] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.233] SetEvent (hEvent=0x104) returned 1
	[0294.233] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.275] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.277] SetEvent (hEvent=0x104) returned 1
	[0294.277] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.278] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.385] SetEvent (hEvent=0x14c) returned 1
	[0294.385] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.385] SetEvent (hEvent=0x14c) returned 1
	[0294.385] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.395] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.463] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.526] SetEvent (hEvent=0x124) returned 1
	[0294.526] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.531] SetEvent (hEvent=0x14c) returned 1
	[0294.531] SetEvent (hEvent=0x12c) returned 1
	[0294.531] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0294.532] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.532] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x0
	[0294.533] SetEvent (hEvent=0x14c) returned 1
	[0294.533] SetEvent (hEvent=0x12c) returned 1
	[0294.533] SetEvent (hEvent=0x104) returned 1
	[0294.533] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.533] SetEvent (hEvent=0x168) returned 1
	[0294.533] SetEvent (hEvent=0x104) returned 1
	[0294.533] SetEvent (hEvent=0x124) returned 1
	[0294.533] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.549] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.562] SetEvent (hEvent=0x124) returned 1
	[0294.562] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.563] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.594] SetEvent (hEvent=0x124) returned 1
	[0294.595] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.596] SetEvent (hEvent=0x104) returned 1
	[0294.596] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.669] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.670] SetEvent (hEvent=0x104) returned 1
	[0294.670] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.671] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.870] SetEvent (hEvent=0x14c) returned 1
	[0294.871] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.871] SetEvent (hEvent=0x14c) returned 1
	[0294.871] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.890] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.930] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.959] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.980] SetEvent (hEvent=0x14c) returned 1
	[0294.981] SetEvent (hEvent=0x12c) returned 1
	[0294.981] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0294.996] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.996] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x0
	[0294.997] SetEvent (hEvent=0x14c) returned 1
	[0294.997] SetEvent (hEvent=0x12c) returned 1
	[0294.997] SetEvent (hEvent=0x104) returned 1
	[0294.997] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.998] SetEvent (hEvent=0x168) returned 1
	[0294.998] SetEvent (hEvent=0x104) returned 1
	[0294.998] SetEvent (hEvent=0x124) returned 1
	[0294.998] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0294.999] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0295.006] SetEvent (hEvent=0x124) returned 1
	[0295.006] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0295.006] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0295.037] SetEvent (hEvent=0x124) returned 1
	[0295.037] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0295.038] SetEvent (hEvent=0x104) returned 1
	[0295.038] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0295.102] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0295.103] SetEvent (hEvent=0x104) returned 1
	[0295.103] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0295.104] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0295.265] SetEvent (hEvent=0x14c) returned 1
	[0295.265] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0295.266] SetEvent (hEvent=0x14c) returned 1
	[0295.266] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0295.280] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0295.310] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0295.367] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0295.368] SetEvent (hEvent=0x14c) returned 1
	[0295.368] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0295.368] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0295.570] SetEvent (hEvent=0x14c) returned 1
	[0295.570] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0295.575] SetEvent (hEvent=0x14c) returned 1
	[0295.575] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0295.585] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0295.612] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0295.635] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0295.647] SetEvent (hEvent=0x14c) returned 1
	[0295.647] SetEvent (hEvent=0x12c) returned 1
	[0295.647] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0295.661] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0295.661] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x0
	[0295.662] SetEvent (hEvent=0x14c) returned 1
	[0295.662] SetEvent (hEvent=0x12c) returned 1
	[0295.662] SetEvent (hEvent=0x104) returned 1
	[0295.662] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0295.663] SetEvent (hEvent=0x168) returned 1
	[0295.663] SetEvent (hEvent=0x104) returned 1
	[0295.663] SetEvent (hEvent=0x124) returned 1
	[0295.663] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0295.664] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0295.678] SetEvent (hEvent=0x124) returned 1
	[0295.678] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0295.679] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0295.706] SetEvent (hEvent=0x124) returned 1
	[0295.706] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0295.707] SetEvent (hEvent=0x104) returned 1
	[0295.707] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0295.752] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0295.752] SetEvent (hEvent=0x104) returned 1
	[0295.752] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0295.753] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0295.852] SetEvent (hEvent=0x14c) returned 1
	[0295.852] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0295.852] SetEvent (hEvent=0x14c) returned 1
	[0295.852] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0295.863] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0295.888] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0295.942] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0295.944] SetEvent (hEvent=0x14c) returned 1
	[0295.944] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0295.945] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0296.043] SetEvent (hEvent=0x104) returned 1
	[0296.043] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0296.044] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0296.081] SetEvent (hEvent=0x124) returned 1
	[0296.081] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0296.086] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0296.115] SetEvent (hEvent=0x124) returned 1
	[0296.115] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0296.146] SetEvent (hEvent=0x124) returned 1
	[0296.146] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0296.154] SetEvent (hEvent=0x104) returned 1
	[0296.154] SetEvent (hEvent=0x12c) returned 1
	[0296.154] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0296.173] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0296.173] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x0
	[0296.173] SetEvent (hEvent=0x104) returned 1
	[0296.173] SetEvent (hEvent=0x12c) returned 1
	[0296.174] SetEvent (hEvent=0x14c) returned 1
	[0296.174] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0296.175] SetEvent (hEvent=0x168) returned 1
	[0296.175] SetEvent (hEvent=0x14c) returned 1
	[0296.175] SetEvent (hEvent=0x124) returned 1
	[0296.175] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0296.177] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0296.194] SetEvent (hEvent=0x124) returned 1
	[0296.194] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0296.194] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0296.259] SetEvent (hEvent=0x124) returned 1
	[0296.259] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0296.261] SetEvent (hEvent=0x14c) returned 1
	[0296.261] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0296.338] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0296.339] SetEvent (hEvent=0x14c) returned 1
	[0296.339] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0296.340] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0296.567] SetEvent (hEvent=0x104) returned 1
	[0296.567] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0296.567] SetEvent (hEvent=0x104) returned 1
	[0296.568] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0296.589] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0296.630] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0296.641] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0296.705] SetEvent (hEvent=0x104) returned 1
	[0296.705] SetEvent (hEvent=0x12c) returned 1
	[0296.705] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0296.706] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0296.706] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x0
	[0296.707] SetEvent (hEvent=0x104) returned 1
	[0296.707] SetEvent (hEvent=0x12c) returned 1
	[0296.707] SetEvent (hEvent=0x14c) returned 1
	[0296.707] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0296.707] SetEvent (hEvent=0x168) returned 1
	[0296.707] SetEvent (hEvent=0x14c) returned 1
	[0296.707] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0296.744] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0296.772] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0296.796] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0296.807] SetEvent (hEvent=0x14c) returned 1
	[0296.807] SetEvent (hEvent=0x12c) returned 1
	[0296.807] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0296.821] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0296.821] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0296.825] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0296.826] SetEvent (hEvent=0x14c) returned 1
	[0296.826] SetEvent (hEvent=0x12c) returned 1
	[0296.826] SetEvent (hEvent=0x104) returned 1
	[0296.826] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0296.826] SetEvent (hEvent=0x168) returned 1
	[0296.826] SetEvent (hEvent=0x104) returned 1
	[0296.826] SetEvent (hEvent=0x124) returned 1
	[0296.826] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0296.830] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0296.838] SetEvent (hEvent=0x124) returned 1
	[0296.838] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0296.838] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0296.864] SetEvent (hEvent=0x124) returned 1
	[0296.865] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0296.866] SetEvent (hEvent=0x104) returned 1
	[0296.866] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0296.899] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0296.899] SetEvent (hEvent=0x104) returned 1
	[0296.899] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0296.900] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0297.112] SetEvent (hEvent=0x104) returned 1
	[0297.112] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0297.113] SetEvent (hEvent=0x104) returned 1
	[0297.113] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0297.129] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0297.166] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0297.188] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0297.201] SetEvent (hEvent=0x104) returned 1
	[0297.201] SetEvent (hEvent=0x12c) returned 1
	[0297.201] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0297.227] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0297.227] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x1) returned 0x102
	[0297.230] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0297.230] SetEvent (hEvent=0x104) returned 1
	[0297.230] SetEvent (hEvent=0x12c) returned 1
	[0297.230] SetEvent (hEvent=0x14c) returned 1
	[0297.230] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0297.230] SetEvent (hEvent=0x168) returned 1
	[0297.230] SetEvent (hEvent=0x14c) returned 1
	[0297.230] SetEvent (hEvent=0x124) returned 1
	[0297.230] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0297.232] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0297.245] SetEvent (hEvent=0x124) returned 1
	[0297.245] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0297.246] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0297.294] SetEvent (hEvent=0x124) returned 1
	[0297.294] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0297.296] SetEvent (hEvent=0x14c) returned 1
	[0297.296] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0297.369] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0297.370] SetEvent (hEvent=0x14c) returned 1
	[0297.370] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0297.371] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0297.540] SetEvent (hEvent=0x104) returned 1
	[0297.540] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0297.620] SetEvent (hEvent=0x104) returned 1
	[0297.621] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0297.674] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0297.731] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0297.765] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0297.788] SetEvent (hEvent=0x124) returned 1
	[0297.788] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0297.789] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0297.867] SetEvent (hEvent=0x124) returned 1
	[0297.867] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0297.872] SetEvent (hEvent=0x124) returned 1
	[0297.873] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0297.873] SetEvent (hEvent=0x124) returned 1
	[0297.874] SwitchToThread () returned 1
	[0297.874] SetEvent (hEvent=0x124) returned 1
	[0297.874] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0297.874] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0297.941] SetEvent (hEvent=0x12c) returned 1
	[0297.941] SetEvent (hEvent=0x104) returned 1
	[0297.941] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0297.944] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0297.957] SetEvent (hEvent=0x124) returned 1
	[0297.957] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0297.977] SwitchToThread () returned 1
	[0297.996] SetEvent (hEvent=0x124) returned 1
	[0297.996] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0298.000] SetEvent (hEvent=0x124) returned 1
	[0298.000] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0298.000] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0298.090] SetEvent (hEvent=0x14c) returned 1
	[0298.090] SetEvent (hEvent=0x12c) returned 1
	[0298.090] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0298.092] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0298.109] SetEvent (hEvent=0x124) returned 1
	[0298.109] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0298.138] SwitchToThread () returned 1
	[0298.139] SetEvent (hEvent=0x124) returned 1
	[0298.139] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0298.143] SetEvent (hEvent=0x124) returned 1
	[0298.143] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0298.143] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0298.209] SetEvent (hEvent=0x104) returned 1
	[0298.209] SetEvent (hEvent=0x14c) returned 1
	[0298.209] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0298.210] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0298.261] SetEvent (hEvent=0x124) returned 1
	[0298.261] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0298.296] SetEvent (hEvent=0x124) returned 1
	[0298.296] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0298.299] SetEvent (hEvent=0x124) returned 1
	[0298.299] SwitchToThread () returned 1
	[0298.300] SetEvent (hEvent=0x124) returned 1
	[0298.300] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0298.300] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0298.399] SetEvent (hEvent=0x12c) returned 1
	[0298.399] SetEvent (hEvent=0x104) returned 1
	[0298.399] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0298.400] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0298.468] SetEvent (hEvent=0x124) returned 1
	[0298.468] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0298.503] SetEvent (hEvent=0x124) returned 1
	[0298.503] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0298.507] SetEvent (hEvent=0x124) returned 1
	[0298.507] SwitchToThread () returned 1
	[0298.508] SetEvent (hEvent=0x124) returned 1
	[0298.508] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0298.508] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0298.600] SetEvent (hEvent=0x14c) returned 1
	[0298.600] SetEvent (hEvent=0x12c) returned 1
	[0298.600] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0298.606] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0298.616] SetEvent (hEvent=0x124) returned 1
	[0298.616] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0298.651] SetEvent (hEvent=0x124) returned 1
	[0298.651] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0298.656] SetEvent (hEvent=0x124) returned 1
	[0298.657] SwitchToThread () returned 1
	[0298.660] SetEvent (hEvent=0x124) returned 1
	[0298.661] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0298.661] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0298.720] SetEvent (hEvent=0x104) returned 1
	[0298.720] SetEvent (hEvent=0x14c) returned 1
	[0298.720] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0298.723] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0298.738] SetEvent (hEvent=0x124) returned 1
	[0298.738] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0298.749] SwitchToThread () returned 1
	[0298.762] SetEvent (hEvent=0x124) returned 1
	[0298.762] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0298.764] SetEvent (hEvent=0x124) returned 1
	[0298.764] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0298.765] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0298.818] SetEvent (hEvent=0x104) returned 1
	[0298.818] SetEvent (hEvent=0x12c) returned 1
	[0298.818] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0298.820] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0298.853] SetEvent (hEvent=0x124) returned 1
	[0298.853] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0298.874] SetEvent (hEvent=0x124) returned 1
	[0298.874] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0298.876] SetEvent (hEvent=0x124) returned 1
	[0298.876] SwitchToThread () returned 1
	[0298.876] SetEvent (hEvent=0x124) returned 1
	[0298.876] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0298.877] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0300.333] SetEvent (hEvent=0x124) returned 1
	[0300.333] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0300.335] SetEvent (hEvent=0x104) returned 1
	[0300.335] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0302.763] SetEvent (hEvent=0x124) returned 1
	[0302.763] SetEvent (hEvent=0x104) returned 1
	[0302.764] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Logo.scale-180.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\logo.scale-180.png"), fInfoLevelId=0x0, lpFileInformation=0x12448b98 | out: lpFileInformation=0x12448b98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab6967f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2ab6967f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2ab6967f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x13db)) returned 1
	[0302.766] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0
	[0302.768] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\SmallLogo.scale-180.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\smalllogo.scale-180.png"), fInfoLevelId=0x0, lpFileInformation=0x124a6008 | out: lpFileInformation=0x124a6008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab6967f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2ab6967f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2ab6967f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd08)) returned 1
	[0302.769] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\SplashScreen.scale-180.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\splashscreen.scale-180.png"), fInfoLevelId=0x0, lpFileInformation=0x124a6058 | out: lpFileInformation=0x124a6058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab6967f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2ab6967f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2ab6967f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x422f)) returned 1
	[0302.769] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Square310x310Logo.scale-180.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\square310x310logo.scale-180.png"), fInfoLevelId=0x0, lpFileInformation=0x124a60a8 | out: lpFileInformation=0x124a60a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab6967f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2ab6967f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2ab8f961, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1ee2)) returned 1
	[0302.770] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Square70x70Logo.scale-180.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\square70x70logo.scale-180.png"), fInfoLevelId=0x0, lpFileInformation=0x124a60f8 | out: lpFileInformation=0x124a60f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab8f961, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2ab8f961, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2ab8f961, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xf2e)) returned 1
	[0302.770] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\StoreLogo.scale-180.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\storelogo.scale-180.png"), fInfoLevelId=0x0, lpFileInformation=0x124a6148 | out: lpFileInformation=0x124a6148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab8f961, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2ab8f961, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2ab8f961, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xe2c)) returned 1
	[0302.770] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Wide310x150Logo.scale-180.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\wide310x150logo.scale-180.png"), fInfoLevelId=0x0, lpFileInformation=0x124a6198 | out: lpFileInformation=0x124a6198*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab8f961, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2ab8f961, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2ab8f961, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1576)) returned 1
	[0302.770] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\Assets\\Contrast\\Logo.scale-180.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\assets\\contrast\\logo.scale-180.png"), fInfoLevelId=0x0, lpFileInformation=0x124a6238 | out: lpFileInformation=0x124a6238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2abb5967, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2abb5967, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2abb5967, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x14d1)) returned 1
	[0302.770] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\Assets\\Contrast\\SmallLogo.scale-180.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\assets\\contrast\\smalllogo.scale-180.png"), fInfoLevelId=0x0, lpFileInformation=0x124a6288 | out: lpFileInformation=0x124a6288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2abb5967, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2abb5967, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2abb5967, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd3d)) returned 1
	[0302.771] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\Assets\\Contrast\\SplashScreen.scale-180.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\assets\\contrast\\splashscreen.scale-180.png"), fInfoLevelId=0x0, lpFileInformation=0x124a62d8 | out: lpFileInformation=0x124a62d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2abb5967, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2abb5967, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2abb5967, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x308d)) returned 1
	[0302.771] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\Assets\\Contrast\\Square310x310Logo.scale-180.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\assets\\contrast\\square310x310logo.scale-180.png"), fInfoLevelId=0x0, lpFileInformation=0x124a6328 | out: lpFileInformation=0x124a6328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2abb5967, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2abb5967, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2abb5967, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x20d6)) returned 1
	[0302.771] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\Assets\\Contrast\\Square70x70Logo.scale-180.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\assets\\contrast\\square70x70logo.scale-180.png"), fInfoLevelId=0x0, lpFileInformation=0x124a6378 | out: lpFileInformation=0x124a6378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2abb5967, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2abb5967, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2abb5967, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xfa1)) returned 1
	[0302.772] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\Assets\\Contrast\\StoreLogo.scale-180.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\assets\\contrast\\storelogo.scale-180.png"), fInfoLevelId=0x0, lpFileInformation=0x124a63c8 | out: lpFileInformation=0x124a63c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2abb5967, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2abb5967, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2abb5967, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xe60)) returned 1
	[0302.772] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\Assets\\Contrast\\Wide310x150Logo.scale-180.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\assets\\contrast\\wide310x150logo.scale-180.png"), fInfoLevelId=0x0, lpFileInformation=0x124a6418 | out: lpFileInformation=0x124a6418*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2abb5967, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2abb5967, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2abb5967, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1683)) returned 1
	[0302.772] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\assets\\contrast\\contrast-white"), fInfoLevelId=0x0, lpFileInformation=0x124a6468 | out: lpFileInformation=0x124a6468*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2abdbe13, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2ac02066, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2ac02066, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0302.773] CreateFileW (lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\assets\\contrast\\contrast-white"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0302.773] FindFirstFileW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2abdbe13, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2ac02066, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2ac02066, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fbe8
	[0302.775] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2abdbe13, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2ac02066, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2ac02066, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0302.776] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab8f961, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2ab8f961, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2ab8f961, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x13ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logo.scale-180.png", cAlternateFileName="")) returned 1
	[0302.776] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab8f961, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2ab8f961, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2ab8f961, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd02, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.scale-180.png", cAlternateFileName="")) returned 1
	[0302.776] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab8f961, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2ab8f961, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2ab8f961, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x4539, dwReserved0=0x0, dwReserved1=0x0, cFileName="SplashScreen.scale-180.png", cAlternateFileName="")) returned 1
	[0302.776] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab8f961, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2ab8f961, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2ab8f961, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1efe, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square310x310Logo.scale-180.png", cAlternateFileName="")) returned 1
	[0302.776] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab8f961, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2ab8f961, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2ab8f961, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xf2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square70x70Logo.scale-180.png", cAlternateFileName="")) returned 1
	[0302.776] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab8f961, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2ab8f961, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2ab8f961, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xe0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="StoreLogo.scale-180.png", cAlternateFileName="")) returned 1
	[0302.776] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab8f961, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2ab8f961, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2abb5967, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1584, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wide310x150Logo.scale-180.png", cAlternateFileName="")) returned 1
	[0302.776] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0302.776] FindClose (in: hFindFile=0x79fbe8 | out: hFindFile=0x79fbe8) returned 1
	[0302.777] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Logo.scale-180.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\logo.scale-180.png"), fInfoLevelId=0x0, lpFileInformation=0x124a66e8 | out: lpFileInformation=0x124a66e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab8f961, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2ab8f961, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2ab8f961, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x13ea)) returned 1
	[0302.778] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\SmallLogo.scale-180.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\smalllogo.scale-180.png"), fInfoLevelId=0x0, lpFileInformation=0x124a6738 | out: lpFileInformation=0x124a6738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab8f961, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2ab8f961, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2ab8f961, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd02)) returned 1
	[0302.778] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\SplashScreen.scale-180.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\splashscreen.scale-180.png"), fInfoLevelId=0x0, lpFileInformation=0x124a6788 | out: lpFileInformation=0x124a6788*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab8f961, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2ab8f961, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2ab8f961, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x4539)) returned 1
	[0302.779] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Square310x310Logo.scale-180.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\square310x310logo.scale-180.png"), fInfoLevelId=0x0, lpFileInformation=0x124a67d8 | out: lpFileInformation=0x124a67d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab8f961, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2ab8f961, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2ab8f961, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1efe)) returned 1
	[0302.779] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Square70x70Logo.scale-180.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\square70x70logo.scale-180.png"), fInfoLevelId=0x0, lpFileInformation=0x124a6828 | out: lpFileInformation=0x124a6828*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab8f961, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2ab8f961, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2ab8f961, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xf2e)) returned 1
	[0302.779] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\StoreLogo.scale-180.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\storelogo.scale-180.png"), fInfoLevelId=0x0, lpFileInformation=0x124a6878 | out: lpFileInformation=0x124a6878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab8f961, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2ab8f961, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2ab8f961, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xe0c)) returned 1
	[0302.779] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Wide310x150Logo.scale-180.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\wide310x150logo.scale-180.png"), fInfoLevelId=0x0, lpFileInformation=0x124a68c8 | out: lpFileInformation=0x124a68c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab8f961, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2ab8f961, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2abb5967, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1584)) returned 1
	[0302.780] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_neutral_split.scale-180_8wekyb3d8bbwe\\resources.pri"), fInfoLevelId=0x0, lpFileInformation=0x124a6918 | out: lpFileInformation=0x124a6918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2abb5967, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2abb5967, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2abb5967, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x5630)) returned 1
	[0302.780] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe"), fInfoLevelId=0x0, lpFileInformation=0x124a6968 | out: lpFileInformation=0x124a6968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aa38436, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2aaaa8fa, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2aaaa8fa, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0302.780] CreateFileW (lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0302.780] FindFirstFileW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aa38436, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2aaaa8fa, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2aaaa8fa, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ff28
	[0302.791] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aa38436, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2aaaa8fa, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2aaaa8fa, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0302.791] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0ae96d, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0ae96d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x8d7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1
	[0302.791] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0ae96d, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0ae96d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x11b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1
	[0302.791] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aa5e699, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2aa5e699, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2aa5e699, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1
	[0302.791] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0ae96d, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0ae96d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2992, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1
	[0302.791] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aa5e699, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2aaaa8fa, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2aaaa8fa, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1
	[0302.791] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3f6071, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3f6071, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a6584f3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x84f800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Builder3D.exe", cAlternateFileName="")) returned 1
	[0302.791] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aaaa8fa, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2aaaa8fa, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2aaaa8fa, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common", cAlternateFileName="")) returned 1
	[0302.791] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a6584f3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a6584f3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a6584f3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2fe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lib3mfUAP.dll", cAlternateFileName="")) returned 1
	[0302.791] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a99fbb2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a99fbb2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a9c5d29, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x51280, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 1
	[0302.791] FindNextFileW (in: hFindFile=0x79ff28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0302.791] FindClose (in: hFindFile=0x79ff28 | out: hFindFile=0x79ff28) returned 1
	[0302.796] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\appxblockmap.xml"), fInfoLevelId=0x0, lpFileInformation=0x124a6cd8 | out: lpFileInformation=0x124a6cd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0ae96d, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0ae96d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x8d7c)) returned 1
	[0302.797] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\appxmanifest.xml"), fInfoLevelId=0x0, lpFileInformation=0x124a6d28 | out: lpFileInformation=0x124a6d28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0ae96d, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0ae96d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x11b3)) returned 1
	[0302.798] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\AppxMetadata" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\appxmetadata"), fInfoLevelId=0x0, lpFileInformation=0x124a6d78 | out: lpFileInformation=0x124a6d78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aa5e699, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2aa5e699, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2aa5e699, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0302.798] CreateFileW (lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\AppxMetadata" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\appxmetadata"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0302.798] FindFirstFileW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aa5e699, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2aa5e699, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2aa5e699, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffe8
	[0302.799] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aa5e699, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2aa5e699, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2aa5e699, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0302.799] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0ae96d, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0ae96d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2a8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 1
	[0302.799] FindNextFileW (in: hFindFile=0x79ffe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0302.799] FindClose (in: hFindFile=0x79ffe8 | out: hFindFile=0x79ffe8) returned 1
	[0302.799] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\AppxMetadata\\CodeIntegrity.cat" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\appxmetadata\\codeintegrity.cat"), fInfoLevelId=0x0, lpFileInformation=0x124a6e18 | out: lpFileInformation=0x124a6e18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0ae96d, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0ae96d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2a8b)) returned 1
	[0302.799] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\appxsignature.p7x"), fInfoLevelId=0x0, lpFileInformation=0x124a6e68 | out: lpFileInformation=0x124a6e68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0ae96d, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0ae96d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2992)) returned 1
	[0302.800] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets"), fInfoLevelId=0x0, lpFileInformation=0x124a6eb8 | out: lpFileInformation=0x124a6eb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aa5e699, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2aaaa8fa, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2aaaa8fa, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0302.800] CreateFileW (lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0302.800] FindFirstFileW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aa5e699, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2aaaa8fa, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2aaaa8fa, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fda8
	[0302.803] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aa5e699, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2aaaa8fa, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2aaaa8fa, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0302.803] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0ae96d, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0ae96d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x7046, dwReserved0=0x0, dwReserved1=0x0, cFileName="3mf.ico", cAlternateFileName="")) returned 1
	[0302.803] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aa5e699, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2aa5e699, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2aa5e699, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Catalog", cAlternateFileName="")) returned 1
	[0302.803] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aa5e699, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2aa848b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2aa848b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Contrast", cAlternateFileName="")) returned 1
	[0302.803] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1455, dwReserved0=0x0, dwReserved1=0x0, cFileName="CubeTile_contrast-black.png", cAlternateFileName="")) returned 1
	[0302.803] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x139e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CubeTile_contrast-white.png", cAlternateFileName="")) returned 1
	[0302.803] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="DarkBlue.png", cAlternateFileName="")) returned 1
	[0302.803] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aa848b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2aaaa8fa, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2aaaa8fa, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EmbossBitmaps", cAlternateFileName="EMBOSS~1")) returned 1
	[0302.803] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xe5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="HelpIcon_contrast-black.png", cAlternateFileName="")) returned 1
	[0302.803] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xea1, dwReserved0=0x0, dwReserved1=0x0, cFileName="HelpIcon_contrast-white.png", cAlternateFileName="")) returned 1
	[0302.803] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="LightBlue.png", cAlternateFileName="")) returned 1
	[0302.803] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="LoadIconRTL_contrast-black.png", cAlternateFileName="")) returned 1
	[0302.803] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd72, dwReserved0=0x0, dwReserved1=0x0, cFileName="LoadIconRTL_contrast-white.png", cAlternateFileName="")) returned 1
	[0302.804] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd84, dwReserved0=0x0, dwReserved1=0x0, cFileName="LoadIcon_contrast-black.png", cAlternateFileName="")) returned 1
	[0302.804] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LoadIcon_contrast-white.png", cAlternateFileName="")) returned 1
	[0302.804] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="MediumBlue.png", cAlternateFileName="")) returned 1
	[0302.804] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3f6071, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3f6071, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3f6071, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd09, dwReserved0=0x0, dwReserved1=0x0, cFileName="ScanIcon_contrast-black.png", cAlternateFileName="")) returned 1
	[0302.804] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3f6071, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3f6071, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3f6071, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd13, dwReserved0=0x0, dwReserved1=0x0, cFileName="ScanIcon_contrast-white.png", cAlternateFileName="")) returned 1
	[0302.804] FindNextFileW (in: hFindFile=0x79fda8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0302.804] FindClose (in: hFindFile=0x79fda8 | out: hFindFile=0x79fda8) returned 1
	[0302.805] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\3mf.ico" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\3mf.ico"), fInfoLevelId=0x0, lpFileInformation=0x124a7458 | out: lpFileInformation=0x124a7458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0ae96d, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0ae96d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x7046)) returned 1
	[0302.826] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog"), fInfoLevelId=0x0, lpFileInformation=0x124a74a8 | out: lpFileInformation=0x124a74a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aa5e699, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2aa5e699, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2aa5e699, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0302.829] CreateFileW (lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0302.829] FindFirstFileW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aa5e699, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2aa5e699, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2aa5e699, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fd28
	[0302.832] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aa5e699, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2aa5e699, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2aa5e699, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0302.832] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0ae96d, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0ae96d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2f08e, dwReserved0=0x0, dwReserved1=0x0, cFileName="bulldozer.3mf", cAlternateFileName="")) returned 1
	[0302.833] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0d4e75, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0d4e75, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0d4e75, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1e17, dwReserved0=0x0, dwReserved1=0x0, cFileName="Catalog.json", cAlternateFileName="")) returned 1
	[0302.833] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0d4e75, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0d4e75, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0d4e75, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x26a27, dwReserved0=0x0, dwReserved1=0x0, cFileName="chess.3mf", cAlternateFileName="")) returned 1
	[0302.833] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0d4e75, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0d4e75, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0d4e75, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2e48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="giftbox.3mf", cAlternateFileName="")) returned 1
	[0302.833] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0d4e75, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0d4e75, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0fb0a6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x4ab3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="gimblekeychain.3mf", cAlternateFileName="")) returned 1
	[0302.833] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0fb0a6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0fb0a6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0fb0a6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcf95, dwReserved0=0x0, dwReserved1=0x0, cFileName="keychain.3mf", cAlternateFileName="")) returned 1
	[0302.833] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0fb0a6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0fb0a6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a121327, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="paperboat.3mf", cAlternateFileName="")) returned 1
	[0302.833] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a121327, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a121327, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a121327, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1d6ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="pencilbox.3mf", cAlternateFileName="")) returned 1
	[0302.833] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a121327, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a121327, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a121327, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x59ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="shape_cone.3mf", cAlternateFileName="")) returned 1
	[0302.833] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a121327, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a121327, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a121327, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2377, dwReserved0=0x0, dwReserved1=0x0, cFileName="shape_cube.3mf", cAlternateFileName="")) returned 1
	[0302.833] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a121327, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a121327, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a121327, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x58de, dwReserved0=0x0, dwReserved1=0x0, cFileName="shape_cylinder.3mf", cAlternateFileName="")) returned 1
	[0302.833] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a121327, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a121327, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a121327, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x202f, dwReserved0=0x0, dwReserved1=0x0, cFileName="shape_hexagon.3mf", cAlternateFileName="")) returned 1
	[0302.833] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a14757e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a14757e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a14757e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1271, dwReserved0=0x0, dwReserved1=0x0, cFileName="shape_pyramid.3mf", cAlternateFileName="")) returned 1
	[0302.833] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a14757e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a14757e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a14757e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x214c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="shape_sphere.3mf", cAlternateFileName="")) returned 1
	[0302.833] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a14757e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a14757e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a16d55e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3be62, dwReserved0=0x0, dwReserved1=0x0, cFileName="shape_torus.3mf", cAlternateFileName="")) returned 1
	[0302.833] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a16d55e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a16d55e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a16d55e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x173f, dwReserved0=0x0, dwReserved1=0x0, cFileName="shape_wedge.3mf", cAlternateFileName="")) returned 1
	[0302.833] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a16d55e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a16d55e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a16d55e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x33976, dwReserved0=0x0, dwReserved1=0x0, cFileName="shuttle.3mf", cAlternateFileName="")) returned 1
	[0302.833] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a16d55e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a16d55e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a1937b9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x346af, dwReserved0=0x0, dwReserved1=0x0, cFileName="spookytree.3mf", cAlternateFileName="")) returned 1
	[0302.833] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1937b9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a1937b9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a1937b9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x37936, dwReserved0=0x0, dwReserved1=0x0, cFileName="traincarcaboose.3mf", cAlternateFileName="")) returned 1
	[0302.834] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1937b9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a1937b9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a1937b9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x4acbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="trainengine.3mf", cAlternateFileName="")) returned 1
	[0302.834] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1937b9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a1937b9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a1b9a1f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x295d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="traintrackconnector.3mf", cAlternateFileName="")) returned 1
	[0302.834] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1b9a1f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a1b9a1f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a1b9a1f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2b16d, dwReserved0=0x0, dwReserved1=0x0, cFileName="traintrackleftturn.3mf", cAlternateFileName="")) returned 1
	[0302.834] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1b9a1f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a1b9a1f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a1b9a1f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x23e72, dwReserved0=0x0, dwReserved1=0x0, cFileName="traintrackrightturn.3mf", cAlternateFileName="")) returned 1
	[0302.834] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1dfc7e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a1dfc7e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a1dfc7e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x39d3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="traintracksplit.3mf", cAlternateFileName="")) returned 1
	[0302.834] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1dfc7e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a1dfc7e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a1dfc7e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1f7ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="traintrackstraight.3mf", cAlternateFileName="")) returned 1
	[0302.834] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1dfc7e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a1dfc7e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a205ee1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x38dfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="trophycylinder.3mf", cAlternateFileName="")) returned 1
	[0302.834] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a205ee1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a205ee1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a205ee1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x48280, dwReserved0=0x0, dwReserved1=0x0, cFileName="trophystar.3mf", cAlternateFileName="")) returned 1
	[0302.834] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a205ee1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a205ee1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1cb0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="windmill.3mf", cAlternateFileName="")) returned 1
	[0302.834] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0302.834] FindClose (in: hFindFile=0x79fd28 | out: hFindFile=0x79fd28) returned 1
	[0302.836] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\Catalog.json" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\catalog.json"), fInfoLevelId=0x0, lpFileInformation=0x124a7db8 | out: lpFileInformation=0x124a7db8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0d4e75, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0d4e75, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0d4e75, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1e17)) returned 1
	[0302.837] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\bulldozer.3mf" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\bulldozer.3mf"), fInfoLevelId=0x0, lpFileInformation=0x124a7e08 | out: lpFileInformation=0x124a7e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0ae96d, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0ae96d, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0ae96d, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2f08e)) returned 1
	[0302.837] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\chess.3mf" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\chess.3mf"), fInfoLevelId=0x0, lpFileInformation=0x124a7e58 | out: lpFileInformation=0x124a7e58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0d4e75, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0d4e75, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0d4e75, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x26a27)) returned 1
	[0302.838] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\giftbox.3mf" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\giftbox.3mf"), fInfoLevelId=0x0, lpFileInformation=0x124a7ea8 | out: lpFileInformation=0x124a7ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0d4e75, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0d4e75, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0d4e75, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2e48e)) returned 1
	[0302.838] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\gimblekeychain.3mf" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\gimblekeychain.3mf"), fInfoLevelId=0x0, lpFileInformation=0x124a7ef8 | out: lpFileInformation=0x124a7ef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0d4e75, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0d4e75, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0fb0a6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x4ab3d)) returned 1
	[0302.838] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\keychain.3mf" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\keychain.3mf"), fInfoLevelId=0x0, lpFileInformation=0x124a7f48 | out: lpFileInformation=0x124a7f48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0fb0a6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0fb0a6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a0fb0a6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcf95)) returned 1
	[0302.838] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\paperboat.3mf" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\paperboat.3mf"), fInfoLevelId=0x0, lpFileInformation=0x124a7f98 | out: lpFileInformation=0x124a7f98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0fb0a6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a0fb0a6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a121327, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0e2)) returned 1
	[0302.839] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\pencilbox.3mf" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\pencilbox.3mf"), fInfoLevelId=0x0, lpFileInformation=0x12430058 | out: lpFileInformation=0x12430058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a121327, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a121327, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a121327, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1d6ce)) returned 1
	[0302.839] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_cone.3mf" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_cone.3mf"), fInfoLevelId=0x0, lpFileInformation=0x124300a8 | out: lpFileInformation=0x124300a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a121327, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a121327, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a121327, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x59ff)) returned 1
	[0302.839] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_cube.3mf" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_cube.3mf"), fInfoLevelId=0x0, lpFileInformation=0x124300f8 | out: lpFileInformation=0x124300f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a121327, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a121327, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a121327, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2377)) returned 1
	[0302.839] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_cylinder.3mf" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_cylinder.3mf"), fInfoLevelId=0x0, lpFileInformation=0x12430148 | out: lpFileInformation=0x12430148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a121327, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a121327, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a121327, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x58de)) returned 1
	[0302.840] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_hexagon.3mf" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_hexagon.3mf"), fInfoLevelId=0x0, lpFileInformation=0x12430198 | out: lpFileInformation=0x12430198*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a121327, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a121327, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a121327, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x202f)) returned 1
	[0302.840] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_pyramid.3mf" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_pyramid.3mf"), fInfoLevelId=0x0, lpFileInformation=0x124301e8 | out: lpFileInformation=0x124301e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a14757e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a14757e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a14757e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1271)) returned 1
	[0302.840] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_sphere.3mf" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_sphere.3mf"), fInfoLevelId=0x0, lpFileInformation=0x12430238 | out: lpFileInformation=0x12430238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a14757e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a14757e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a14757e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x214c7)) returned 1
	[0302.841] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_torus.3mf" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_torus.3mf"), fInfoLevelId=0x0, lpFileInformation=0x12430288 | out: lpFileInformation=0x12430288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a14757e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a14757e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a16d55e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3be62)) returned 1
	[0302.841] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shape_wedge.3mf" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shape_wedge.3mf"), fInfoLevelId=0x0, lpFileInformation=0x124302d8 | out: lpFileInformation=0x124302d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a16d55e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a16d55e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a16d55e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x173f)) returned 1
	[0302.841] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\shuttle.3mf" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\shuttle.3mf"), fInfoLevelId=0x0, lpFileInformation=0x12430328 | out: lpFileInformation=0x12430328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a16d55e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a16d55e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a16d55e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x33976)) returned 1
	[0302.842] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\spookytree.3mf" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\spookytree.3mf"), fInfoLevelId=0x0, lpFileInformation=0x12430378 | out: lpFileInformation=0x12430378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a16d55e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a16d55e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a1937b9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x346af)) returned 1
	[0302.842] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traincarcaboose.3mf" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\traincarcaboose.3mf"), fInfoLevelId=0x0, lpFileInformation=0x124303c8 | out: lpFileInformation=0x124303c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1937b9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a1937b9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a1937b9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x37936)) returned 1
	[0302.842] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\trainengine.3mf" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\trainengine.3mf"), fInfoLevelId=0x0, lpFileInformation=0x12430418 | out: lpFileInformation=0x12430418*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1937b9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a1937b9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a1937b9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x4acbb)) returned 1
	[0302.843] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traintrackconnector.3mf" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\traintrackconnector.3mf"), fInfoLevelId=0x0, lpFileInformation=0x12430468 | out: lpFileInformation=0x12430468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1937b9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a1937b9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a1b9a1f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x295d0)) returned 1
	[0302.843] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traintrackleftturn.3mf" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\traintrackleftturn.3mf"), fInfoLevelId=0x0, lpFileInformation=0x124304b8 | out: lpFileInformation=0x124304b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1b9a1f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a1b9a1f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a1b9a1f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2b16d)) returned 1
	[0302.843] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traintrackrightturn.3mf" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\traintrackrightturn.3mf"), fInfoLevelId=0x0, lpFileInformation=0x12430508 | out: lpFileInformation=0x12430508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1b9a1f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a1b9a1f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a1b9a1f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x23e72)) returned 1
	[0302.844] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traintracksplit.3mf" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\traintracksplit.3mf"), fInfoLevelId=0x0, lpFileInformation=0x12430558 | out: lpFileInformation=0x12430558*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1dfc7e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a1dfc7e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a1dfc7e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x39d3a)) returned 1
	[0302.844] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\traintrackstraight.3mf" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\traintrackstraight.3mf"), fInfoLevelId=0x0, lpFileInformation=0x124305a8 | out: lpFileInformation=0x124305a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1dfc7e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a1dfc7e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a1dfc7e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1f7ca)) returned 1
	[0302.844] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\trophycylinder.3mf" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\trophycylinder.3mf"), fInfoLevelId=0x0, lpFileInformation=0x124305f8 | out: lpFileInformation=0x124305f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1dfc7e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a1dfc7e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a205ee1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x38dfd)) returned 1
	[0302.844] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\trophystar.3mf" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\trophystar.3mf"), fInfoLevelId=0x0, lpFileInformation=0x12430648 | out: lpFileInformation=0x12430648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a205ee1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a205ee1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a205ee1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x48280)) returned 1
	[0302.845] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\windmill.3mf" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\catalog\\windmill.3mf"), fInfoLevelId=0x0, lpFileInformation=0x12430698 | out: lpFileInformation=0x12430698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a205ee1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a205ee1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1cb0a)) returned 1
	[0302.845] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast"), fInfoLevelId=0x0, lpFileInformation=0x124306e8 | out: lpFileInformation=0x124306e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aa5e699, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2aa848b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2aa848b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0302.845] CreateFileW (lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0302.845] FindFirstFileW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aa5e699, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2aa848b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2aa848b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f968
	[0302.848] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aa5e699, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2aa848b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2aa848b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0302.848] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a22c330, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1530, dwReserved0=0x0, dwReserved1=0x0, cFileName="BuilderLogo.png", cAlternateFileName="")) returned 1
	[0302.848] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aa5e699, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2aa848b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2aa848b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Contrast-black", cAlternateFileName="CONTRA~1")) returned 1
	[0302.848] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aa848b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2aa848b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2aa848b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 1
	[0302.848] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xbe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icon.targetsize-16.png", cAlternateFileName="")) returned 1
	[0302.848] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x16f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icon.targetsize-256.png", cAlternateFileName="")) returned 1
	[0302.848] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcae, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icon.targetsize-32.png", cAlternateFileName="")) returned 1
	[0302.848] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icon.targetsize-48.png", cAlternateFileName="")) returned 1
	[0302.848] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x108d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logo.scale-100.png", cAlternateFileName="")) returned 1
	[0302.848] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xf68, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logo.scale-80.png", cAlternateFileName="")) returned 1
	[0302.848] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc45, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.scale-100.png", cAlternateFileName="")) returned 1
	[0302.848] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.scale-80.png", cAlternateFileName="")) returned 1
	[0302.849] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.targetsize-16.png", cAlternateFileName="")) returned 1
	[0302.849] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x148e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.targetsize-256.png", cAlternateFileName="")) returned 1
	[0302.849] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc71, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.targetsize-32.png", cAlternateFileName="")) returned 1
	[0302.849] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd03, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.targetsize-48.png", cAlternateFileName="")) returned 1
	[0302.849] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1d49, dwReserved0=0x0, dwReserved1=0x0, cFileName="SplashScreen.scale-100.png", cAlternateFileName="")) returned 1
	[0302.849] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x165a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square310x310Logo.scale-100.png", cAlternateFileName="")) returned 1
	[0302.849] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x13d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square310x310Logo.scale-80.png", cAlternateFileName="")) returned 1
	[0302.849] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xdc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square70x70Logo.scale-100.png", cAlternateFileName="")) returned 1
	[0302.849] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd39, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square70x70Logo.scale-80.png", cAlternateFileName="")) returned 1
	[0302.849] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd19, dwReserved0=0x0, dwReserved1=0x0, cFileName="StoreLogo.scale-100.png", cAlternateFileName="")) returned 1
	[0302.849] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x112b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wide310x150Logo.scale-100.png", cAlternateFileName="")) returned 1
	[0302.849] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xfd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wide310x150Logo.scale-80.png", cAlternateFileName="")) returned 1
	[0302.850] FindNextFileW (in: hFindFile=0x79f968, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0302.850] FindClose (in: hFindFile=0x79f968 | out: hFindFile=0x79f968) returned 1
	[0302.851] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\BuilderLogo.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\builderlogo.png"), fInfoLevelId=0x0, lpFileInformation=0x12430e68 | out: lpFileInformation=0x12430e68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a22c330, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1530)) returned 1
	[0302.852] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black"), fInfoLevelId=0x0, lpFileInformation=0x12430eb8 | out: lpFileInformation=0x12430eb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aa5e699, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2aa848b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2aa848b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0302.853] CreateFileW (lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0302.853] FindFirstFileW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aa5e699, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2aa848b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2aa848b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79faa8
	[0302.855] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aa5e699, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2aa848b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2aa848b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0302.855] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a22c330, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1461, dwReserved0=0x0, dwReserved1=0x0, cFileName="BuilderLogo.png", cAlternateFileName="")) returned 1
	[0302.855] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a22c330, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xbab, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icon.targetsize-16.png", cAlternateFileName="")) returned 1
	[0302.855] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a22c330, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x153c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icon.targetsize-256.png", cAlternateFileName="")) returned 1
	[0302.856] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a22c330, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icon.targetsize-32.png", cAlternateFileName="")) returned 1
	[0302.856] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a22c330, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd08, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icon.targetsize-48.png", cAlternateFileName="")) returned 1
	[0302.856] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a22c330, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1026, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logo.scale-100.png", cAlternateFileName="")) returned 1
	[0302.856] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a22c330, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xebc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logo.scale-80.png", cAlternateFileName="")) returned 1
	[0302.856] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc04, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.scale-100.png", cAlternateFileName="")) returned 1
	[0302.856] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xbfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.scale-80.png", cAlternateFileName="")) returned 1
	[0302.856] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xb8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.targetsize-16.png", cAlternateFileName="")) returned 1
	[0302.856] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x13bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.targetsize-256.png", cAlternateFileName="")) returned 1
	[0302.856] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc35, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.targetsize-32.png", cAlternateFileName="")) returned 1
	[0302.857] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.targetsize-48.png", cAlternateFileName="")) returned 1
	[0302.857] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x27a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SplashScreen.scale-100.png", cAlternateFileName="")) returned 1
	[0302.857] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x153d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square310x310Logo.scale-100.png", cAlternateFileName="")) returned 1
	[0302.857] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x12d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square310x310Logo.scale-80.png", cAlternateFileName="")) returned 1
	[0302.857] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square70x70Logo.scale-100.png", cAlternateFileName="")) returned 1
	[0302.857] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square70x70Logo.scale-80.png", cAlternateFileName="")) returned 1
	[0302.857] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xccb, dwReserved0=0x0, dwReserved1=0x0, cFileName="StoreLogo.scale-100.png", cAlternateFileName="")) returned 1
	[0302.857] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x10b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wide310x150Logo.scale-100.png", cAlternateFileName="")) returned 1
	[0302.857] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xf2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wide310x150Logo.scale-80.png", cAlternateFileName="")) returned 1
	[0302.857] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0302.857] FindClose (in: hFindFile=0x79faa8 | out: hFindFile=0x79faa8) returned 1
	[0302.859] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\BuilderLogo.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\builderlogo.png"), fInfoLevelId=0x0, lpFileInformation=0x12431598 | out: lpFileInformation=0x12431598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a22c330, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1461)) returned 1
	[0302.861] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Icon.targetsize-16.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\icon.targetsize-16.png"), fInfoLevelId=0x0, lpFileInformation=0x124315e8 | out: lpFileInformation=0x124315e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a22c330, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xbab)) returned 1
	[0302.884] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Icon.targetsize-256.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\icon.targetsize-256.png"), fInfoLevelId=0x0, lpFileInformation=0x12431638 | out: lpFileInformation=0x12431638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a22c330, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x153c)) returned 1
	[0302.884] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Icon.targetsize-32.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\icon.targetsize-32.png"), fInfoLevelId=0x0, lpFileInformation=0x12431688 | out: lpFileInformation=0x12431688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a22c330, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc6c)) returned 1
	[0302.885] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Icon.targetsize-48.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\icon.targetsize-48.png"), fInfoLevelId=0x0, lpFileInformation=0x124316d8 | out: lpFileInformation=0x124316d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a22c330, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd08)) returned 1
	[0302.885] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Logo.scale-100.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\logo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x12431728 | out: lpFileInformation=0x12431728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a22c330, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a22c330, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1026)) returned 1
	[0302.885] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Logo.scale-80.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\logo.scale-80.png"), fInfoLevelId=0x0, lpFileInformation=0x12431778 | out: lpFileInformation=0x12431778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a22c330, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a22c330, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xebc)) returned 1
	[0302.886] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\SmallLogo.scale-100.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\smalllogo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x124317c8 | out: lpFileInformation=0x124317c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc04)) returned 1
	[0302.886] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\SmallLogo.scale-80.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\smalllogo.scale-80.png"), fInfoLevelId=0x0, lpFileInformation=0x12431818 | out: lpFileInformation=0x12431818*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xbfc)) returned 1
	[0302.886] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\SmallLogo.targetsize-16.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\smalllogo.targetsize-16.png"), fInfoLevelId=0x0, lpFileInformation=0x12431868 | out: lpFileInformation=0x12431868*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xb8f)) returned 1
	[0302.887] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\SmallLogo.targetsize-256.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\smalllogo.targetsize-256.png"), fInfoLevelId=0x0, lpFileInformation=0x124318b8 | out: lpFileInformation=0x124318b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x13bc)) returned 1
	[0302.887] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\SmallLogo.targetsize-32.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\smalllogo.targetsize-32.png"), fInfoLevelId=0x0, lpFileInformation=0x12431908 | out: lpFileInformation=0x12431908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc35)) returned 1
	[0302.887] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\SmallLogo.targetsize-48.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\smalllogo.targetsize-48.png"), fInfoLevelId=0x0, lpFileInformation=0x12431958 | out: lpFileInformation=0x12431958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcbd)) returned 1
	[0302.888] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\SplashScreen.scale-100.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\splashscreen.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x124319a8 | out: lpFileInformation=0x124319a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x27a0)) returned 1
	[0302.888] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Square310x310Logo.scale-100.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\square310x310logo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x124319f8 | out: lpFileInformation=0x124319f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x153d)) returned 1
	[0302.889] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Square310x310Logo.scale-80.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\square310x310logo.scale-80.png"), fInfoLevelId=0x0, lpFileInformation=0x12431a48 | out: lpFileInformation=0x12431a48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a25239e, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a25239e, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a25239e, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x12d5)) returned 1
	[0302.889] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Square70x70Logo.scale-100.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\square70x70logo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x12431a98 | out: lpFileInformation=0x12431a98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd8e)) returned 1
	[0302.889] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Square70x70Logo.scale-80.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\square70x70logo.scale-80.png"), fInfoLevelId=0x0, lpFileInformation=0x12431ae8 | out: lpFileInformation=0x12431ae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xce0)) returned 1
	[0302.890] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\StoreLogo.scale-100.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\storelogo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x12431b38 | out: lpFileInformation=0x12431b38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xccb)) returned 1
	[0302.892] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Wide310x150Logo.scale-100.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\wide310x150logo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x12431b88 | out: lpFileInformation=0x12431b88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x10b6)) returned 1
	[0302.893] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\Wide310x150Logo.scale-80.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-black\\wide310x150logo.scale-80.png"), fInfoLevelId=0x0, lpFileInformation=0x12431bd8 | out: lpFileInformation=0x12431bd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xf2f)) returned 1
	[0302.908] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Icon.targetsize-16.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\icon.targetsize-16.png"), fInfoLevelId=0x0, lpFileInformation=0x12431c28 | out: lpFileInformation=0x12431c28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xbe1)) returned 1
	[0302.908] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Icon.targetsize-256.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\icon.targetsize-256.png"), fInfoLevelId=0x0, lpFileInformation=0x12431c78 | out: lpFileInformation=0x12431c78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x16f3)) returned 1
	[0302.908] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Icon.targetsize-32.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\icon.targetsize-32.png"), fInfoLevelId=0x0, lpFileInformation=0x12431cc8 | out: lpFileInformation=0x12431cc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcae)) returned 1
	[0302.908] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Icon.targetsize-48.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\icon.targetsize-48.png"), fInfoLevelId=0x0, lpFileInformation=0x12431d18 | out: lpFileInformation=0x12431d18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd6e)) returned 1
	[0302.909] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Logo.scale-100.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\logo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x12431d68 | out: lpFileInformation=0x12431d68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x108d)) returned 1
	[0302.909] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Logo.scale-80.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\logo.scale-80.png"), fInfoLevelId=0x0, lpFileInformation=0x12431db8 | out: lpFileInformation=0x12431db8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xf68)) returned 1
	[0302.909] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\SmallLogo.scale-100.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\smalllogo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x12431e08 | out: lpFileInformation=0x12431e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc45)) returned 1
	[0302.909] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\SmallLogo.scale-80.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\smalllogo.scale-80.png"), fInfoLevelId=0x0, lpFileInformation=0x12431e58 | out: lpFileInformation=0x12431e58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc2a)) returned 1
	[0302.910] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\SmallLogo.targetsize-16.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\smalllogo.targetsize-16.png"), fInfoLevelId=0x0, lpFileInformation=0x12431ea8 | out: lpFileInformation=0x12431ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xbc4)) returned 1
	[0302.910] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\SmallLogo.targetsize-256.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\smalllogo.targetsize-256.png"), fInfoLevelId=0x0, lpFileInformation=0x12431ef8 | out: lpFileInformation=0x12431ef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x148e)) returned 1
	[0302.910] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\SmallLogo.targetsize-32.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\smalllogo.targetsize-32.png"), fInfoLevelId=0x0, lpFileInformation=0x12431f48 | out: lpFileInformation=0x12431f48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc71)) returned 1
	[0302.911] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\SmallLogo.targetsize-48.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\smalllogo.targetsize-48.png"), fInfoLevelId=0x0, lpFileInformation=0x12431f98 | out: lpFileInformation=0x12431f98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd03)) returned 1
	[0302.911] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\SplashScreen.scale-100.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\splashscreen.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x12596008 | out: lpFileInformation=0x12596008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1d49)) returned 1
	[0302.911] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Square310x310Logo.scale-100.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\square310x310logo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x12596058 | out: lpFileInformation=0x12596058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x165a)) returned 1
	[0302.911] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Square310x310Logo.scale-80.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\square310x310logo.scale-80.png"), fInfoLevelId=0x0, lpFileInformation=0x125960a8 | out: lpFileInformation=0x125960a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x13d2)) returned 1
	[0302.911] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Square70x70Logo.scale-100.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\square70x70logo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x125960f8 | out: lpFileInformation=0x125960f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xdc0)) returned 1
	[0302.912] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Square70x70Logo.scale-80.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\square70x70logo.scale-80.png"), fInfoLevelId=0x0, lpFileInformation=0x12596148 | out: lpFileInformation=0x12596148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd39)) returned 1
	[0302.912] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\StoreLogo.scale-100.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\storelogo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x12596198 | out: lpFileInformation=0x12596198*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd19)) returned 1
	[0302.912] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Wide310x150Logo.scale-100.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\wide310x150logo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x125961e8 | out: lpFileInformation=0x125961e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2eafc6, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x112b)) returned 1
	[0302.913] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Wide310x150Logo.scale-80.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\wide310x150logo.scale-80.png"), fInfoLevelId=0x0, lpFileInformation=0x12596238 | out: lpFileInformation=0x12596238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2eafc6, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2eafc6, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xfd5)) returned 1
	[0302.913] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white"), fInfoLevelId=0x0, lpFileInformation=0x12596288 | out: lpFileInformation=0x12596288*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aa848b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2aa848b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2aa848b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0302.913] CreateFileW (lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0302.913] FindFirstFileW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aa848b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2aa848b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2aa848b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fba8
	[0302.966] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aa848b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2aa848b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2aa848b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0302.966] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1493, dwReserved0=0x0, dwReserved1=0x0, cFileName="BuilderLogo.png", cAlternateFileName="")) returned 1
	[0302.966] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xb9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icon.targetsize-16.png", cAlternateFileName="")) returned 1
	[0302.967] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1530, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icon.targetsize-256.png", cAlternateFileName="")) returned 1
	[0302.967] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc68, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icon.targetsize-32.png", cAlternateFileName="")) returned 1
	[0302.967] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd12, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icon.targetsize-48.png", cAlternateFileName="")) returned 1
	[0302.967] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1028, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logo.scale-100.png", cAlternateFileName="")) returned 1
	[0302.967] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xecf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logo.scale-80.png", cAlternateFileName="")) returned 1
	[0302.967] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xbf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.scale-100.png", cAlternateFileName="")) returned 1
	[0302.967] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xbed, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.scale-80.png", cAlternateFileName="")) returned 1
	[0302.967] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xb8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.targetsize-16.png", cAlternateFileName="")) returned 1
	[0302.967] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x13b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.targetsize-256.png", cAlternateFileName="")) returned 1
	[0302.967] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.targetsize-32.png", cAlternateFileName="")) returned 1
	[0302.967] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcac, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmallLogo.targetsize-48.png", cAlternateFileName="")) returned 1
	[0302.967] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1d49, dwReserved0=0x0, dwReserved1=0x0, cFileName="SplashScreen.scale-100.png", cAlternateFileName="")) returned 1
	[0302.967] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x152b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square310x310Logo.scale-100.png", cAlternateFileName="")) returned 1
	[0302.967] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x12dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square310x310Logo.scale-80.png", cAlternateFileName="")) returned 1
	[0302.967] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square70x70Logo.scale-100.png", cAlternateFileName="")) returned 1
	[0302.967] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcde, dwReserved0=0x0, dwReserved1=0x0, cFileName="Square70x70Logo.scale-80.png", cAlternateFileName="")) returned 1
	[0302.967] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="StoreLogo.scale-100.png", cAlternateFileName="")) returned 1
	[0302.967] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x10b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wide310x150Logo.scale-100.png", cAlternateFileName="")) returned 1
	[0302.968] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xf3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wide310x150Logo.scale-80.png", cAlternateFileName="")) returned 1
	[0302.968] FindNextFileW (in: hFindFile=0x79fba8, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0302.968] FindClose (in: hFindFile=0x79fba8 | out: hFindFile=0x79fba8) returned 1
	[0302.969] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\BuilderLogo.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\builderlogo.png"), fInfoLevelId=0x0, lpFileInformation=0x12596968 | out: lpFileInformation=0x12596968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1493)) returned 1
	[0302.970] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Icon.targetsize-16.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\icon.targetsize-16.png"), fInfoLevelId=0x0, lpFileInformation=0x125969b8 | out: lpFileInformation=0x125969b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xb9c)) returned 1
	[0302.971] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Icon.targetsize-256.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\icon.targetsize-256.png"), fInfoLevelId=0x0, lpFileInformation=0x12596a08 | out: lpFileInformation=0x12596a08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1530)) returned 1
	[0302.971] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Icon.targetsize-32.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\icon.targetsize-32.png"), fInfoLevelId=0x0, lpFileInformation=0x12596a58 | out: lpFileInformation=0x12596a58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc68)) returned 1
	[0302.971] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Icon.targetsize-48.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\icon.targetsize-48.png"), fInfoLevelId=0x0, lpFileInformation=0x12596aa8 | out: lpFileInformation=0x12596aa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd12)) returned 1
	[0302.971] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Logo.scale-100.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\logo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x12596af8 | out: lpFileInformation=0x12596af8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1028)) returned 1
	[0302.972] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Logo.scale-80.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\logo.scale-80.png"), fInfoLevelId=0x0, lpFileInformation=0x12596b48 | out: lpFileInformation=0x12596b48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xecf)) returned 1
	[0302.972] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\SmallLogo.scale-100.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\smalllogo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x12596b98 | out: lpFileInformation=0x12596b98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2785f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xbf4)) returned 1
	[0302.972] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\SmallLogo.scale-80.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\smalllogo.scale-80.png"), fInfoLevelId=0x0, lpFileInformation=0x12596be8 | out: lpFileInformation=0x12596be8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2785f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2785f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xbed)) returned 1
	[0302.972] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\SmallLogo.targetsize-16.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\smalllogo.targetsize-16.png"), fInfoLevelId=0x0, lpFileInformation=0x12596c38 | out: lpFileInformation=0x12596c38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xb8d)) returned 1
	[0302.972] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\SmallLogo.targetsize-256.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\smalllogo.targetsize-256.png"), fInfoLevelId=0x0, lpFileInformation=0x12596c88 | out: lpFileInformation=0x12596c88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x13b1)) returned 1
	[0302.973] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\SmallLogo.targetsize-32.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\smalllogo.targetsize-32.png"), fInfoLevelId=0x0, lpFileInformation=0x12596cd8 | out: lpFileInformation=0x12596cd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc2b)) returned 1
	[0302.973] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\SmallLogo.targetsize-48.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\smalllogo.targetsize-48.png"), fInfoLevelId=0x0, lpFileInformation=0x12596d28 | out: lpFileInformation=0x12596d28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcac)) returned 1
	[0302.974] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\SplashScreen.scale-100.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\splashscreen.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x12596d78 | out: lpFileInformation=0x12596d78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1d49)) returned 1
	[0302.974] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Square310x310Logo.scale-100.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\square310x310logo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x12596dc8 | out: lpFileInformation=0x12596dc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x152b)) returned 1
	[0302.974] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Square310x310Logo.scale-80.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\square310x310logo.scale-80.png"), fInfoLevelId=0x0, lpFileInformation=0x12596e18 | out: lpFileInformation=0x12596e18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x12dc)) returned 1
	[0302.974] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Square70x70Logo.scale-100.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\square70x70logo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x12596e68 | out: lpFileInformation=0x12596e68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd8b)) returned 1
	[0302.975] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Square70x70Logo.scale-80.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\square70x70logo.scale-80.png"), fInfoLevelId=0x0, lpFileInformation=0x12596eb8 | out: lpFileInformation=0x12596eb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcde)) returned 1
	[0302.975] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\StoreLogo.scale-100.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\storelogo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x12596f08 | out: lpFileInformation=0x12596f08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcbf)) returned 1
	[0302.975] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Wide310x150Logo.scale-100.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\wide310x150logo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x12596f58 | out: lpFileInformation=0x12596f58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a29e877, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a29e877, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a29e877, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x10b0)) returned 1
	[0302.975] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\Wide310x150Logo.scale-80.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\contrast\\contrast-white\\wide310x150logo.scale-80.png"), fInfoLevelId=0x0, lpFileInformation=0x12596fa8 | out: lpFileInformation=0x12596fa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2c4ae1, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a2c4ae1, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a2c4ae1, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xf3b)) returned 1
	[0302.976] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\CubeTile_contrast-black.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\cubetile_contrast-black.png"), fInfoLevelId=0x0, lpFileInformation=0x12596ff8 | out: lpFileInformation=0x12596ff8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1455)) returned 1
	[0302.976] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\CubeTile_contrast-white.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\cubetile_contrast-white.png"), fInfoLevelId=0x0, lpFileInformation=0x12597048 | out: lpFileInformation=0x12597048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x139e)) returned 1
	[0302.976] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\DarkBlue.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\darkblue.png"), fInfoLevelId=0x0, lpFileInformation=0x12597098 | out: lpFileInformation=0x12597098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcbe)) returned 1
	[0302.977] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps"), fInfoLevelId=0x0, lpFileInformation=0x125970e8 | out: lpFileInformation=0x125970e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aa848b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2aaaa8fa, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2aaaa8fa, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0302.978] CreateFileW (lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0302.978] FindFirstFileW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aa848b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2aaaa8fa, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2aaaa8fa, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f8e8
	[0302.980] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aa848b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2aaaa8fa, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2aaaa8fa, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0302.981] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x257a, dwReserved0=0x0, dwReserved1=0x0, cFileName="4-Point Star.png", cAlternateFileName="")) returned 1
	[0302.982] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2a2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="4-Point Star_render.png", cAlternateFileName="")) returned 1
	[0302.982] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="8-Point Star.png", cAlternateFileName="")) returned 1
	[0302.982] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2f76, dwReserved0=0x0, dwReserved1=0x0, cFileName="8-Point Star_render.png", cAlternateFileName="")) returned 1
	[0302.982] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1ca9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Arrow.png", cAlternateFileName="")) returned 1
	[0302.982] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1e41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Arrow_render.png", cAlternateFileName="")) returned 1
	[0302.982] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a337abe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a337abe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a337abe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2f0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chevron.png", cAlternateFileName="")) returned 1
	[0302.982] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a337abe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a337abe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a337abe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2633, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chevron_render.png", cAlternateFileName="")) returned 1
	[0302.982] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a337abe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a337abe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a337abe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x336c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cloud.png", cAlternateFileName="")) returned 1
	[0302.982] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a337abe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a337abe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a337abe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2b7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cloud_render.png", cAlternateFileName="")) returned 1
	[0302.982] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a337abe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a337abe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a337abe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3de9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Donut.png", cAlternateFileName="")) returned 1
	[0302.982] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a337abe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a337abe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a337abe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3b09, dwReserved0=0x0, dwReserved1=0x0, cFileName="Donut_render.png", cAlternateFileName="")) returned 1
	[0302.982] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a337abe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a337abe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a337abe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x24c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Double Wave.png", cAlternateFileName="")) returned 1
	[0302.982] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a337abe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a337abe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a337abe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1f9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Double Wave_render.png", cAlternateFileName="")) returned 1
	[0302.982] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a35d6d3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a35d6d3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a35d6d3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3479, dwReserved0=0x0, dwReserved1=0x0, cFileName="heart.png", cAlternateFileName="")) returned 1
	[0302.982] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a35d6d3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a35d6d3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a35d6d3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2bb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="heart_render.png", cAlternateFileName="")) returned 1
	[0302.982] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a35d6d3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a35d6d3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a35d6d3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3d07, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lightning bolt.png", cAlternateFileName="")) returned 1
	[0302.983] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a35d6d3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a35d6d3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a35d6d3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3324, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lightning bolt_render.png", cAlternateFileName="")) returned 1
	[0302.983] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a35d6d3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a35d6d3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a35d6d3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Moon.png", cAlternateFileName="")) returned 1
	[0302.983] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a35d6d3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a35d6d3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a35d6d3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x28d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Moon_render.png", cAlternateFileName="")) returned 1
	[0302.983] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a35d6d3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a35d6d3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a35d6d3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2d4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multiply.png", cAlternateFileName="")) returned 1
	[0302.983] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a35d6d3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a35d6d3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a35d6d3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2996, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multiply_render.png", cAlternateFileName="")) returned 1
	[0302.983] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x4544, dwReserved0=0x0, dwReserved1=0x0, cFileName="No Symbol.png", cAlternateFileName="")) returned 1
	[0302.983] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x4728, dwReserved0=0x0, dwReserved1=0x0, cFileName="No Symbol_render.png", cAlternateFileName="")) returned 1
	[0302.983] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2962, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oval.png", cAlternateFileName="")) returned 1
	[0302.983] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2a06, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oval_render.png", cAlternateFileName="")) returned 1
	[0302.983] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1384, dwReserved0=0x0, dwReserved1=0x0, cFileName="plus.png", cAlternateFileName="")) returned 1
	[0302.983] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x12c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="plus_render.png", cAlternateFileName="")) returned 1
	[0302.983] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xf7d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rectangle.png", cAlternateFileName="")) returned 1
	[0302.983] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xef7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rectangle_render.png", cAlternateFileName="")) returned 1
	[0302.983] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x17e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rounded  Rectangle.png", cAlternateFileName="")) returned 1
	[0302.983] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3a9bbf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3a9bbf, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3a9bbf, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x18a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rounded  Rectangle_render.png", cAlternateFileName="")) returned 1
	[0302.983] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3a9bbf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3a9bbf, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3a9bbf, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x4921, dwReserved0=0x0, dwReserved1=0x0, cFileName="Smiley face.png", cAlternateFileName="")) returned 1
	[0302.984] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3a9bbf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3a9bbf, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3a9bbf, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x380c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Smiley face_render.png", cAlternateFileName="")) returned 1
	[0302.984] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3a9bbf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3a9bbf, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3a9bbf, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x337b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sun.png", cAlternateFileName="")) returned 1
	[0302.984] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3a9bbf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3a9bbf, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3a9bbf, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3b76, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sun_render.png", cAlternateFileName="")) returned 1
	[0302.984] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3a9bbf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3a9bbf, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3a9bbf, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2e87, dwReserved0=0x0, dwReserved1=0x0, cFileName="Triangle.png", cAlternateFileName="")) returned 1
	[0302.984] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3a9bbf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3a9bbf, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3a9bbf, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2419, dwReserved0=0x0, dwReserved1=0x0, cFileName="Triangle_render.png", cAlternateFileName="")) returned 1
	[0302.984] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3a9bbf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3a9bbf, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x26ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wave.png", cAlternateFileName="")) returned 1
	[0302.984] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x226d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wave_render.png", cAlternateFileName="")) returned 1
	[0302.984] FindNextFileW (in: hFindFile=0x79f8e8, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0302.984] FindClose (in: hFindFile=0x79f8e8 | out: hFindFile=0x79f8e8) returned 1
	[0302.985] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\4-Point Star.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\4-point star.png"), fInfoLevelId=0x0, lpFileInformation=0x12597e08 | out: lpFileInformation=0x12597e08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x257a)) returned 1
	[0302.987] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\4-Point Star_render.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\4-point star_render.png"), fInfoLevelId=0x0, lpFileInformation=0x12597e58 | out: lpFileInformation=0x12597e58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2a2b)) returned 1
	[0302.987] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\8-Point Star.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\8-point star.png"), fInfoLevelId=0x0, lpFileInformation=0x12597ea8 | out: lpFileInformation=0x12597ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2da8)) returned 1
	[0302.988] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\8-Point Star_render.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\8-point star_render.png"), fInfoLevelId=0x0, lpFileInformation=0x12597ef8 | out: lpFileInformation=0x12597ef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2f76)) returned 1
	[0302.988] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Arrow.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\arrow.png"), fInfoLevelId=0x0, lpFileInformation=0x12597f48 | out: lpFileInformation=0x12597f48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1ca9)) returned 1
	[0302.988] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Arrow_render.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\arrow_render.png"), fInfoLevelId=0x0, lpFileInformation=0x12597f98 | out: lpFileInformation=0x12597f98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3111b2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3111b2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3111b2, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1e41)) returned 1
	[0302.988] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Chevron.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\chevron.png"), fInfoLevelId=0x0, lpFileInformation=0x1278c008 | out: lpFileInformation=0x1278c008*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a337abe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a337abe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a337abe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2f0a)) returned 1
	[0302.992] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Chevron_render.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\chevron_render.png"), fInfoLevelId=0x0, lpFileInformation=0x1278c058 | out: lpFileInformation=0x1278c058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a337abe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a337abe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a337abe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2633)) returned 1
	[0302.992] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Cloud.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\cloud.png"), fInfoLevelId=0x0, lpFileInformation=0x1278c0f8 | out: lpFileInformation=0x1278c0f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a337abe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a337abe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a337abe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x336c)) returned 1
	[0302.992] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Cloud_render.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\cloud_render.png"), fInfoLevelId=0x0, lpFileInformation=0x1278c148 | out: lpFileInformation=0x1278c148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a337abe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a337abe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a337abe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2b7f)) returned 1
	[0302.992] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Donut.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\donut.png"), fInfoLevelId=0x0, lpFileInformation=0x1278c198 | out: lpFileInformation=0x1278c198*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a337abe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a337abe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a337abe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3de9)) returned 1
	[0302.993] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Donut_render.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\donut_render.png"), fInfoLevelId=0x0, lpFileInformation=0x1278c1e8 | out: lpFileInformation=0x1278c1e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a337abe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a337abe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a337abe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3b09)) returned 1
	[0302.993] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Double Wave.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\double wave.png"), fInfoLevelId=0x0, lpFileInformation=0x1278c238 | out: lpFileInformation=0x1278c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a337abe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a337abe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a337abe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x24c8)) returned 1
	[0302.993] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Double Wave_render.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\double wave_render.png"), fInfoLevelId=0x0, lpFileInformation=0x1278c288 | out: lpFileInformation=0x1278c288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a337abe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a337abe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a337abe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1f9c)) returned 1
	[0302.993] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Lightning bolt.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\lightning bolt.png"), fInfoLevelId=0x0, lpFileInformation=0x1278c2d8 | out: lpFileInformation=0x1278c2d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a35d6d3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a35d6d3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a35d6d3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3d07)) returned 1
	[0302.993] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Lightning bolt_render.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\lightning bolt_render.png"), fInfoLevelId=0x0, lpFileInformation=0x1278c328 | out: lpFileInformation=0x1278c328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a35d6d3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a35d6d3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a35d6d3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3324)) returned 1
	[0302.994] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Moon.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\moon.png"), fInfoLevelId=0x0, lpFileInformation=0x1278c378 | out: lpFileInformation=0x1278c378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a35d6d3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a35d6d3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a35d6d3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x31e8)) returned 1
	[0302.994] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Moon_render.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\moon_render.png"), fInfoLevelId=0x0, lpFileInformation=0x1278c3c8 | out: lpFileInformation=0x1278c3c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a35d6d3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a35d6d3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a35d6d3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x28d5)) returned 1
	[0302.995] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Multiply.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\multiply.png"), fInfoLevelId=0x0, lpFileInformation=0x1278c418 | out: lpFileInformation=0x1278c418*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a35d6d3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a35d6d3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a35d6d3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2d4a)) returned 1
	[0302.995] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Multiply_render.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\multiply_render.png"), fInfoLevelId=0x0, lpFileInformation=0x1278c468 | out: lpFileInformation=0x1278c468*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a35d6d3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a35d6d3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a35d6d3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2996)) returned 1
	[0302.995] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\No Symbol.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\no symbol.png"), fInfoLevelId=0x0, lpFileInformation=0x1278c4b8 | out: lpFileInformation=0x1278c4b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x4544)) returned 1
	[0302.995] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\No Symbol_render.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\no symbol_render.png"), fInfoLevelId=0x0, lpFileInformation=0x1278c508 | out: lpFileInformation=0x1278c508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x4728)) returned 1
	[0302.995] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Oval.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\oval.png"), fInfoLevelId=0x0, lpFileInformation=0x1278c558 | out: lpFileInformation=0x1278c558*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2962)) returned 1
	[0302.996] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Oval_render.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\oval_render.png"), fInfoLevelId=0x0, lpFileInformation=0x1278c5a8 | out: lpFileInformation=0x1278c5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2a06)) returned 1
	[0302.996] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Rectangle.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\rectangle.png"), fInfoLevelId=0x0, lpFileInformation=0x1278c5f8 | out: lpFileInformation=0x1278c5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xf7d)) returned 1
	[0302.996] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Rectangle_render.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\rectangle_render.png"), fInfoLevelId=0x0, lpFileInformation=0x1278c648 | out: lpFileInformation=0x1278c648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xef7)) returned 1
	[0302.997] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Rounded  Rectangle.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\rounded  rectangle.png"), fInfoLevelId=0x0, lpFileInformation=0x1278c698 | out: lpFileInformation=0x1278c698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x17e0)) returned 1
	[0302.997] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Rounded  Rectangle_render.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\rounded  rectangle_render.png"), fInfoLevelId=0x0, lpFileInformation=0x1278c6e8 | out: lpFileInformation=0x1278c6e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3a9bbf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3a9bbf, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3a9bbf, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x18a2)) returned 1
	[0302.997] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Smiley face.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\smiley face.png"), fInfoLevelId=0x0, lpFileInformation=0x1278c738 | out: lpFileInformation=0x1278c738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3a9bbf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3a9bbf, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3a9bbf, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x4921)) returned 1
	[0302.997] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Smiley face_render.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\smiley face_render.png"), fInfoLevelId=0x0, lpFileInformation=0x1278c788 | out: lpFileInformation=0x1278c788*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3a9bbf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3a9bbf, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3a9bbf, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x380c)) returned 1
	[0302.998] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Sun.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\sun.png"), fInfoLevelId=0x0, lpFileInformation=0x1278c7d8 | out: lpFileInformation=0x1278c7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3a9bbf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3a9bbf, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3a9bbf, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x337b)) returned 1
	[0302.998] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Sun_render.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\sun_render.png"), fInfoLevelId=0x0, lpFileInformation=0x1278c828 | out: lpFileInformation=0x1278c828*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3a9bbf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3a9bbf, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3a9bbf, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3b76)) returned 1
	[0302.998] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Triangle.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\triangle.png"), fInfoLevelId=0x0, lpFileInformation=0x1278c878 | out: lpFileInformation=0x1278c878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3a9bbf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3a9bbf, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3a9bbf, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2e87)) returned 1
	[0302.998] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Triangle_render.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\triangle_render.png"), fInfoLevelId=0x0, lpFileInformation=0x1278c8c8 | out: lpFileInformation=0x1278c8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3a9bbf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3a9bbf, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3a9bbf, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2419)) returned 1
	[0302.998] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Wave.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\wave.png"), fInfoLevelId=0x0, lpFileInformation=0x1278c918 | out: lpFileInformation=0x1278c918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3a9bbf, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3a9bbf, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x26ab)) returned 1
	[0302.999] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\Wave_render.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\wave_render.png"), fInfoLevelId=0x0, lpFileInformation=0x1278c968 | out: lpFileInformation=0x1278c968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x226d)) returned 1
	[0302.999] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\heart.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\heart.png"), fInfoLevelId=0x0, lpFileInformation=0x1278c9b8 | out: lpFileInformation=0x1278c9b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a35d6d3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a35d6d3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a35d6d3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3479)) returned 1
	[0302.999] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\heart_render.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\heart_render.png"), fInfoLevelId=0x0, lpFileInformation=0x1278ca08 | out: lpFileInformation=0x1278ca08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a35d6d3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a35d6d3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a35d6d3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2bb3)) returned 1
	[0302.999] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\plus.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\plus.png"), fInfoLevelId=0x0, lpFileInformation=0x1278ca58 | out: lpFileInformation=0x1278ca58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x1384)) returned 1
	[0302.999] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\plus_render.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\embossbitmaps\\plus_render.png"), fInfoLevelId=0x0, lpFileInformation=0x1278caa8 | out: lpFileInformation=0x1278caa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3836a4, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3836a4, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3836a4, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x12c2)) returned 1
	[0303.000] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\HelpIcon_contrast-black.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\helpicon_contrast-black.png"), fInfoLevelId=0x0, lpFileInformation=0x1278caf8 | out: lpFileInformation=0x1278caf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xe5a)) returned 1
	[0303.000] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\HelpIcon_contrast-white.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\helpicon_contrast-white.png"), fInfoLevelId=0x0, lpFileInformation=0x1278cb48 | out: lpFileInformation=0x1278cb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xea1)) returned 1
	[0303.000] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\LightBlue.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\lightblue.png"), fInfoLevelId=0x0, lpFileInformation=0x1278cb98 | out: lpFileInformation=0x1278cb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcbf)) returned 1
	[0303.002] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\LoadIconRTL_contrast-black.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\loadiconrtl_contrast-black.png"), fInfoLevelId=0x0, lpFileInformation=0x1278cbe8 | out: lpFileInformation=0x1278cbe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd6b)) returned 1
	[0303.002] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\LoadIconRTL_contrast-white.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\loadiconrtl_contrast-white.png"), fInfoLevelId=0x0, lpFileInformation=0x1278cc38 | out: lpFileInformation=0x1278cc38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd72)) returned 1
	[0303.002] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\LoadIcon_contrast-black.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\loadicon_contrast-black.png"), fInfoLevelId=0x0, lpFileInformation=0x1278cc88 | out: lpFileInformation=0x1278cc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd84)) returned 1
	[0303.003] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\LoadIcon_contrast-white.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\loadicon_contrast-white.png"), fInfoLevelId=0x0, lpFileInformation=0x1278ccd8 | out: lpFileInformation=0x1278ccd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd9e)) returned 1
	[0303.003] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\MediumBlue.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\mediumblue.png"), fInfoLevelId=0x0, lpFileInformation=0x1278cd28 | out: lpFileInformation=0x1278cd28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3cfb69, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3cfb69, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3cfb69, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcbe)) returned 1
	[0303.003] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\ScanIcon_contrast-black.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\scanicon_contrast-black.png"), fInfoLevelId=0x0, lpFileInformation=0x1278cd78 | out: lpFileInformation=0x1278cd78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3f6071, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3f6071, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3f6071, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd09)) returned 1
	[0303.003] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Assets\\ScanIcon_contrast-white.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\assets\\scanicon_contrast-white.png"), fInfoLevelId=0x0, lpFileInformation=0x1278cdc8 | out: lpFileInformation=0x1278cdc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3f6071, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3f6071, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a3f6071, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xd13)) returned 1
	[0303.003] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Builder3D.exe" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\builder3d.exe"), fInfoLevelId=0x0, lpFileInformation=0x1278ce18 | out: lpFileInformation=0x1278ce18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3f6071, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a3f6071, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a6584f3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x84f800)) returned 1
	[0303.009] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Common" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\common"), fInfoLevelId=0x0, lpFileInformation=0x1278ce68 | out: lpFileInformation=0x1278ce68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aaaa8fa, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2aaaa8fa, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2aaaa8fa, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0303.009] CreateFileW (lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Common" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\common"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0303.010] FindFirstFileW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Common\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aaaa8fa, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2aaaa8fa, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2aaaa8fa, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79f9e8
	[0303.010] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2aaaa8fa, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2aaaa8fa, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2aaaa8fa, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0303.010] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a6584f3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a6584f3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a6584f3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe.txt", cAlternateFileName="")) returned 1
	[0303.010] FindNextFileW (in: hFindFile=0x79f9e8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0303.010] FindClose (in: hFindFile=0x79f9e8 | out: hFindFile=0x79f9e8) returned 1
	[0303.010] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Common\\ReadMe.txt" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\common\\readme.txt"), fInfoLevelId=0x0, lpFileInformation=0x1278cf08 | out: lpFileInformation=0x1278cf08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a6584f3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a6584f3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a6584f3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x3cf)) returned 1
	[0303.012] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\Lib3mfUAP.dll" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\lib3mfuap.dll"), fInfoLevelId=0x0, lpFileInformation=0x1278cf58 | out: lpFileInformation=0x1278cf58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a6584f3, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a6584f3, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a6584f3, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x2fe00)) returned 1
	[0303.013] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.3DBuilder_10.9.50.0_x64__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.3dbuilder_10.9.50.0_x64__8wekyb3d8bbwe\\resources.pri"), fInfoLevelId=0x0, lpFileInformation=0x1278cfa8 | out: lpFileInformation=0x1278cfa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a99fbb2, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2a99fbb2, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2a9c5d29, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x51280)) returned 1
	[0303.013] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe"), fInfoLevelId=0x0, lpFileInformation=0x1278cff8 | out: lpFileInformation=0x1278cff8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f827f1c, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f827f1c, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f827f1c, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0303.016] CreateFileW (lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0303.016] FindFirstFileW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f827f1c, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f827f1c, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f827f1c, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fde8
	[0303.018] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f827f1c, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f827f1c, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f827f1c, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0303.018] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f78f56f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f78f56f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f78f56f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1
	[0303.018] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f59f46a, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f59f46a, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f78f56f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xab8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1
	[0303.018] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f78f56f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f78f56f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f78f56f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x296b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1
	[0303.019] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f827f1c, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f827f1c, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f827f1c, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1
	[0303.019] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f78f56f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f78f56f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f78f56f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x127, dwReserved0=0x0, dwReserved1=0x0, cFileName="default.html", cAlternateFileName="")) returned 1
	[0303.019] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f827f1c, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f827f1c, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f827f1c, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1
	[0303.019] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f827f1c, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f827f1c, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f827f1c, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1
	[0303.019] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f801cbe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f801cbe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f801cbe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 1
	[0303.019] FindNextFileW (in: hFindFile=0x79fde8, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0303.019] FindClose (in: hFindFile=0x79fde8 | out: hFindFile=0x79fde8) returned 1
	[0303.020] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\appxblockmap.xml"), fInfoLevelId=0x0, lpFileInformation=0x1278d2c8 | out: lpFileInformation=0x1278d2c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f78f56f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f78f56f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f78f56f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xbc4)) returned 1
	[0303.022] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\appxmanifest.xml"), fInfoLevelId=0x0, lpFileInformation=0x1278d318 | out: lpFileInformation=0x1278d318*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f59f46a, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f59f46a, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f78f56f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xab8)) returned 1
	[0303.022] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\appxsignature.p7x"), fInfoLevelId=0x0, lpFileInformation=0x1278d368 | out: lpFileInformation=0x1278d368*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f78f56f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f78f56f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f78f56f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x296b)) returned 1
	[0303.023] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css"), fInfoLevelId=0x0, lpFileInformation=0x1278d3b8 | out: lpFileInformation=0x1278d3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f827f1c, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f827f1c, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f827f1c, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0303.027] CreateFileW (lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0303.027] FindFirstFileW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f827f1c, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f827f1c, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f827f1c, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fd28
	[0303.027] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f827f1c, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f827f1c, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f827f1c, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0303.027] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f78f56f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f78f56f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f78f56f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xe, dwReserved0=0x0, dwReserved1=0x0, cFileName="default.css", cAlternateFileName="")) returned 1
	[0303.027] FindNextFileW (in: hFindFile=0x79fd28, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0303.027] FindClose (in: hFindFile=0x79fd28 | out: hFindFile=0x79fd28) returned 1
	[0303.028] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css\\default.css" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css\\default.css"), fInfoLevelId=0x0, lpFileInformation=0x1278d458 | out: lpFileInformation=0x1278d458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f78f56f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f78f56f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f78f56f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xe)) returned 1
	[0303.028] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\default.html" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\default.html"), fInfoLevelId=0x0, lpFileInformation=0x1278d4a8 | out: lpFileInformation=0x1278d4a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f78f56f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f78f56f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f78f56f, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x127)) returned 1
	[0303.028] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images"), fInfoLevelId=0x0, lpFileInformation=0x1278d4f8 | out: lpFileInformation=0x1278d4f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f827f1c, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f827f1c, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f827f1c, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0303.029] CreateFileW (lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0303.029] FindFirstFileW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f827f1c, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f827f1c, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f827f1c, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fb68
	[0303.033] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f827f1c, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f827f1c, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f827f1c, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0303.033] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f78f56f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f78f56f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7b5810, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConnectorAppList.scale-100.png", cAlternateFileName="")) returned 1
	[0303.033] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7b5810, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7b5810, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7b5810, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConnectorAppList.targetsize-16.png", cAlternateFileName="")) returned 1
	[0303.033] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7b5810, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7b5810, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7b5810, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConnectorAppList.targetsize-20.png", cAlternateFileName="")) returned 1
	[0303.033] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7b5810, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7b5810, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7b5810, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConnectorAppList.targetsize-24.png", cAlternateFileName="")) returned 1
	[0303.033] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7b5810, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7b5810, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7b5810, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConnectorAppList.targetsize-256.png", cAlternateFileName="")) returned 1
	[0303.033] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7b5810, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7b5810, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7b5810, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConnectorAppList.targetsize-32.png", cAlternateFileName="")) returned 1
	[0303.033] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7b5810, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7b5810, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7b5810, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConnectorAppList.targetsize-40.png", cAlternateFileName="")) returned 1
	[0303.033] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7dbaf9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7dbaf9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7dbaf9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConnectorAppList.targetsize-48.png", cAlternateFileName="")) returned 1
	[0303.033] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7dbaf9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7dbaf9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7dbaf9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConnectorAppList.targetsize-64.png", cAlternateFileName="")) returned 1
	[0303.034] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7dbaf9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7dbaf9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7dbaf9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x12a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConnectorAppList.targetsize-80.png", cAlternateFileName="")) returned 1
	[0303.034] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7dbaf9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7dbaf9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7dbaf9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x16c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConnectorAppList.targetsize-96.png", cAlternateFileName="")) returned 1
	[0303.034] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7dbaf9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7dbaf9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7dbaf9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x299, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.scale-100.png", cAlternateFileName="")) returned 1
	[0303.034] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7dbaf9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7dbaf9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7dbaf9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0x0, dwReserved1=0x0, cFileName="smalllogo.scale-100.png", cAlternateFileName="")) returned 1
	[0303.034] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7dbaf9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7dbaf9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7dbaf9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x477, dwReserved0=0x0, dwReserved1=0x0, cFileName="splashscreen.scale-100.png", cAlternateFileName="")) returned 1
	[0303.034] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f801cbe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f801cbe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f801cbe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="storelogo.scale-100.png", cAlternateFileName="")) returned 1
	[0303.034] FindNextFileW (in: hFindFile=0x79fb68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0303.034] FindClose (in: hFindFile=0x79fb68 | out: hFindFile=0x79fb68) returned 1
	[0303.035] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.scale-100.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x1278d9f8 | out: lpFileInformation=0x1278d9f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f78f56f, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f78f56f, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7b5810, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xc5)) returned 1
	[0303.037] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-16.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-16.png"), fInfoLevelId=0x0, lpFileInformation=0x1278da48 | out: lpFileInformation=0x1278da48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7b5810, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7b5810, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7b5810, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xa2)) returned 1
	[0303.038] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-20.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-20.png"), fInfoLevelId=0x0, lpFileInformation=0x1278da98 | out: lpFileInformation=0x1278da98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7b5810, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7b5810, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7b5810, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x9f)) returned 1
	[0303.038] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-24.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-24.png"), fInfoLevelId=0x0, lpFileInformation=0x1278dae8 | out: lpFileInformation=0x1278dae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7b5810, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7b5810, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7b5810, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xa8)) returned 1
	[0303.038] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-256.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-256.png"), fInfoLevelId=0x0, lpFileInformation=0x1278db38 | out: lpFileInformation=0x1278db38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7b5810, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7b5810, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7b5810, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x384)) returned 1
	[0303.038] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-32.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-32.png"), fInfoLevelId=0x0, lpFileInformation=0x1278db88 | out: lpFileInformation=0x1278db88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7b5810, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7b5810, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7b5810, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xb2)) returned 1
	[0303.038] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-40.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-40.png"), fInfoLevelId=0x0, lpFileInformation=0x1278dbd8 | out: lpFileInformation=0x1278dbd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7b5810, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7b5810, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7b5810, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xcc)) returned 1
	[0303.039] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-48.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-48.png"), fInfoLevelId=0x0, lpFileInformation=0x1278dc28 | out: lpFileInformation=0x1278dc28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7dbaf9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7dbaf9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7dbaf9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xdf)) returned 1
	[0303.039] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-64.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-64.png"), fInfoLevelId=0x0, lpFileInformation=0x1278dc78 | out: lpFileInformation=0x1278dc78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7dbaf9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7dbaf9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7dbaf9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xf8)) returned 1
	[0303.039] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-80.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-80.png"), fInfoLevelId=0x0, lpFileInformation=0x1278dcc8 | out: lpFileInformation=0x1278dcc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7dbaf9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7dbaf9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7dbaf9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x12a)) returned 1
	[0303.040] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\AppConnectorAppList.targetsize-96.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\appconnectorapplist.targetsize-96.png"), fInfoLevelId=0x0, lpFileInformation=0x1278dd18 | out: lpFileInformation=0x1278dd18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7dbaf9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7dbaf9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7dbaf9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x16c)) returned 1
	[0303.040] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\logo.scale-100.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\logo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x1278dd68 | out: lpFileInformation=0x1278dd68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7dbaf9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7dbaf9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7dbaf9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x299)) returned 1
	[0303.040] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\smalllogo.scale-100.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\smalllogo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x1278ddb8 | out: lpFileInformation=0x1278ddb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7dbaf9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7dbaf9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7dbaf9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x12c)) returned 1
	[0303.040] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\splashscreen.scale-100.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\splashscreen.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x1278de08 | out: lpFileInformation=0x1278de08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7dbaf9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f7dbaf9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f7dbaf9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x477)) returned 1
	[0303.040] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\storelogo.scale-100.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\storelogo.scale-100.png"), fInfoLevelId=0x0, lpFileInformation=0x1278de58 | out: lpFileInformation=0x1278de58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f801cbe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f801cbe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f801cbe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x16a)) returned 1
	[0303.041] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js"), fInfoLevelId=0x0, lpFileInformation=0x1278dea8 | out: lpFileInformation=0x1278dea8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f827f1c, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f827f1c, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f827f1c, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0303.041] CreateFileW (lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0303.041] FindFirstFileW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f827f1c, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f827f1c, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f827f1c, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ffa8
	[0303.041] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f827f1c, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f827f1c, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f827f1c, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0303.041] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f801cbe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f801cbe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f801cbe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x233, dwReserved0=0x0, dwReserved1=0x0, cFileName="default.js", cAlternateFileName="")) returned 1
	[0303.041] FindNextFileW (in: hFindFile=0x79ffa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0303.041] FindClose (in: hFindFile=0x79ffa8 | out: hFindFile=0x79ffa8) returned 1
	[0303.042] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js\\default.js" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js\\default.js"), fInfoLevelId=0x0, lpFileInformation=0x1278df48 | out: lpFileInformation=0x1278df48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f801cbe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f801cbe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f801cbe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x233)) returned 1
	[0303.042] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\resources.pri"), fInfoLevelId=0x0, lpFileInformation=0x1278df98 | out: lpFileInformation=0x1278df98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f801cbe, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f801cbe, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f801cbe, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xef8)) returned 1
	[0303.042] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral_split.scale-125_8wekyb3d8bbwe" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral_split.scale-125_8wekyb3d8bbwe"), fInfoLevelId=0x0, lpFileInformation=0x1279e008 | out: lpFileInformation=0x1279e008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f84e18b, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f84e18b, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f84e18b, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0303.042] CreateFileW (lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral_split.scale-125_8wekyb3d8bbwe" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral_split.scale-125_8wekyb3d8bbwe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0303.043] FindFirstFileW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral_split.scale-125_8wekyb3d8bbwe\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f84e18b, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f84e18b, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f84e18b, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ff68
	[0303.046] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f84e18b, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f84e18b, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f84e18b, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0303.046] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f827f1c, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f827f1c, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f827f1c, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x251, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1
	[0303.046] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f827f1c, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f827f1c, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f827f1c, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x33a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1
	[0303.046] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f84e18b, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f84e18b, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f84e18b, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x296b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1
	[0303.047] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f84e18b, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f84e18b, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f84e18b, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1
	[0303.047] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f84e18b, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f84e18b, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f84e18b, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x530, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 1
	[0303.047] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0303.047] FindClose (in: hFindFile=0x79ff68 | out: hFindFile=0x79ff68) returned 1
	[0303.048] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral_split.scale-125_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral_split.scale-125_8wekyb3d8bbwe\\appxblockmap.xml"), fInfoLevelId=0x0, lpFileInformation=0x1279e1e8 | out: lpFileInformation=0x1279e1e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f827f1c, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f827f1c, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f827f1c, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x251)) returned 1
	[0303.050] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral_split.scale-125_8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral_split.scale-125_8wekyb3d8bbwe\\appxmanifest.xml"), fInfoLevelId=0x0, lpFileInformation=0x1279e238 | out: lpFileInformation=0x1279e238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f827f1c, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f827f1c, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f827f1c, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x33a)) returned 1
	[0303.051] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral_split.scale-125_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral_split.scale-125_8wekyb3d8bbwe\\appxsignature.p7x"), fInfoLevelId=0x0, lpFileInformation=0x1279e288 | out: lpFileInformation=0x1279e288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f84e18b, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f84e18b, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f84e18b, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x296b)) returned 1
	[0303.051] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral_split.scale-125_8wekyb3d8bbwe\\images" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral_split.scale-125_8wekyb3d8bbwe\\images"), fInfoLevelId=0x0, lpFileInformation=0x1279e2d8 | out: lpFileInformation=0x1279e2d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f84e18b, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f84e18b, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f84e18b, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0303.051] CreateFileW (lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral_split.scale-125_8wekyb3d8bbwe\\images" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral_split.scale-125_8wekyb3d8bbwe\\images"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0303.051] FindFirstFileW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral_split.scale-125_8wekyb3d8bbwe\\images\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f84e18b, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f84e18b, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f84e18b, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fbe8
	[0303.052] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f84e18b, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f84e18b, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f84e18b, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0303.052] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f84e18b, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f84e18b, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f84e18b, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConnectorAppList.scale-125.png", cAlternateFileName="")) returned 1
	[0303.052] FindNextFileW (in: hFindFile=0x79fbe8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0303.052] FindClose (in: hFindFile=0x79fbe8 | out: hFindFile=0x79fbe8) returned 1
	[0303.052] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral_split.scale-125_8wekyb3d8bbwe\\images\\AppConnectorAppList.scale-125.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral_split.scale-125_8wekyb3d8bbwe\\images\\appconnectorapplist.scale-125.png"), fInfoLevelId=0x0, lpFileInformation=0x1279e378 | out: lpFileInformation=0x1279e378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f84e18b, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f84e18b, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f84e18b, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0xeb)) returned 1
	[0303.052] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral_split.scale-125_8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral_split.scale-125_8wekyb3d8bbwe\\resources.pri"), fInfoLevelId=0x0, lpFileInformation=0x1279e3c8 | out: lpFileInformation=0x1279e3c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f84e18b, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f84e18b, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f84e18b, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x530)) returned 1
	[0303.053] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral_split.scale-200_8wekyb3d8bbwe" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral_split.scale-200_8wekyb3d8bbwe"), fInfoLevelId=0x0, lpFileInformation=0x1279e418 | out: lpFileInformation=0x1279e418*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f8743f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f89a625, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f89a625, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0303.053] CreateFileW (lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral_split.scale-200_8wekyb3d8bbwe" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral_split.scale-200_8wekyb3d8bbwe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0303.053] FindFirstFileW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral_split.scale-200_8wekyb3d8bbwe\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f8743f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f89a625, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f89a625, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fb28
	[0303.057] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f8743f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f89a625, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f89a625, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0303.057] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8743f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f8743f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f8743f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x251, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1
	[0303.057] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f84e18b, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f84e18b, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f84e18b, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x33a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1
	[0303.057] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8743f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f8743f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f8743f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x296b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1
	[0303.057] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f8743f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f8743f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f8743f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1
	[0303.057] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8743f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f8743f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f8743f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x530, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 1
	[0303.058] FindNextFileW (in: hFindFile=0x79fb28, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0303.058] FindClose (in: hFindFile=0x79fb28 | out: hFindFile=0x79fb28) returned 1
	[0303.059] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral_split.scale-200_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral_split.scale-200_8wekyb3d8bbwe\\appxblockmap.xml"), fInfoLevelId=0x0, lpFileInformation=0x1279e5f8 | out: lpFileInformation=0x1279e5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8743f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f8743f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f8743f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x251)) returned 1
	[0303.062] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral_split.scale-200_8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral_split.scale-200_8wekyb3d8bbwe\\appxmanifest.xml"), fInfoLevelId=0x0, lpFileInformation=0x1279e648 | out: lpFileInformation=0x1279e648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f84e18b, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f84e18b, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f84e18b, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x33a)) returned 1
	[0303.062] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral_split.scale-200_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral_split.scale-200_8wekyb3d8bbwe\\appxsignature.p7x"), fInfoLevelId=0x0, lpFileInformation=0x1279e698 | out: lpFileInformation=0x1279e698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8743f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f8743f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f8743f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x296b)) returned 1
	[0303.062] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral_split.scale-200_8wekyb3d8bbwe\\images" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral_split.scale-200_8wekyb3d8bbwe\\images"), fInfoLevelId=0x0, lpFileInformation=0x1279e6e8 | out: lpFileInformation=0x1279e6e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f8743f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f8743f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f8743f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0303.062] CreateFileW (lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral_split.scale-200_8wekyb3d8bbwe\\images" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral_split.scale-200_8wekyb3d8bbwe\\images"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0303.062] FindFirstFileW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral_split.scale-200_8wekyb3d8bbwe\\images\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f8743f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f8743f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f8743f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fa68
	[0303.063] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f8743f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f8743f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f8743f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0303.063] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8743f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f8743f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f8743f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x12d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConnectorAppList.scale-200.png", cAlternateFileName="")) returned 1
	[0303.063] FindNextFileW (in: hFindFile=0x79fa68, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0303.063] FindClose (in: hFindFile=0x79fa68 | out: hFindFile=0x79fa68) returned 1
	[0303.063] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral_split.scale-200_8wekyb3d8bbwe\\images\\AppConnectorAppList.scale-200.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral_split.scale-200_8wekyb3d8bbwe\\images\\appconnectorapplist.scale-200.png"), fInfoLevelId=0x0, lpFileInformation=0x1279e788 | out: lpFileInformation=0x1279e788*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8743f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f8743f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f8743f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x12d)) returned 1
	[0303.063] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral_split.scale-200_8wekyb3d8bbwe\\resources.pri" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.appconnector_1.3.3.0_neutral_split.scale-200_8wekyb3d8bbwe\\resources.pri"), fInfoLevelId=0x0, lpFileInformation=0x1279e7d8 | out: lpFileInformation=0x1279e7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8743f9, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x2f8743f9, ftLastAccessTime.dwHighDateTime=0x1d112f3, ftLastWriteTime.dwLowDateTime=0x2f8743f9, ftLastWriteTime.dwHighDateTime=0x1d112f3, nFileSizeHigh=0x0, nFileSizeLow=0x530)) returned 1
	[0303.064] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.bingfinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe"), fInfoLevelId=0x0, lpFileInformation=0x1279e828 | out: lpFileInformation=0x1279e828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcfea322c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfec9493, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfec9493, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0303.064] CreateFileW (lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.bingfinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0303.064] FindFirstFileW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\*", lpFindFileData=0x12423918 | out: lpFindFileData=0x12423918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcfea322c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfec9493, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfec9493, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a0028
	[0303.066] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcfea322c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfec9493, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfec9493, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0303.066] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfde478e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfde478e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfde478e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xd4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1
	[0303.066] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfa2aaf7, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfa2aaf7, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfa2aaf7, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x34e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1
	[0303.067] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe0a896, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfe0a896, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfe0a896, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x296a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1
	[0303.067] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcfea322c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfea322c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfea322c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1
	[0303.067] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe7d01e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfe7d01e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfe7d01e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xace8, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 1
	[0303.067] FindNextFileW (in: hFindFile=0x7a0028, lpFindFileData=0x12423938 | out: lpFindFileData=0x12423938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0303.067] FindClose (in: hFindFile=0x7a0028 | out: hFindFile=0x7a0028) returned 1
	[0303.068] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\AppxBlockMap.xml" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.bingfinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\appxblockmap.xml"), fInfoLevelId=0x0, lpFileInformation=0x1279ea58 | out: lpFileInformation=0x1279ea58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfde478e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfde478e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfde478e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xd4e)) returned 1
	[0303.070] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\AppxManifest.xml" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.bingfinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\appxmanifest.xml"), fInfoLevelId=0x0, lpFileInformation=0x1279eaa8 | out: lpFileInformation=0x1279eaa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfa2aaf7, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfa2aaf7, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfa2aaf7, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x34e)) returned 1
	[0303.070] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\AppxSignature.p7x" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.bingfinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\appxsignature.p7x"), fInfoLevelId=0x0, lpFileInformation=0x1279eaf8 | out: lpFileInformation=0x1279eaf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe0a896, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfe0a896, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfe0a896, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x296a)) returned 1
	[0303.070] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.bingfinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets"), fInfoLevelId=0x0, lpFileInformation=0x1279eb48 | out: lpFileInformation=0x1279eb48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcfea322c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfea322c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfea322c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0303.070] CreateFileW (lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.bingfinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0303.071] FindFirstFileW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x124238b4 | out: lpFindFileData=0x124238b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcfea322c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfea322c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfea322c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79faa8
	[0303.071] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcfea322c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfea322c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfea322c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0303.071] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcfea322c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfec9493, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfec9493, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppTiles", cAlternateFileName="")) returned 1
	[0303.071] FindNextFileW (in: hFindFile=0x79faa8, lpFindFileData=0x124238d4 | out: lpFindFileData=0x124238d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0303.071] FindClose (in: hFindFile=0x79faa8 | out: hFindFile=0x79faa8) returned 1
	[0303.071] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\AppTiles" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.bingfinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\apptiles"), fInfoLevelId=0x0, lpFileInformation=0x1279ec38 | out: lpFileInformation=0x1279ec38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcfea322c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfec9493, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfec9493, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0303.073] CreateFileW (lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\AppTiles" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.bingfinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\apptiles"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0303.073] FindFirstFileW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\AppTiles\\*", lpFindFileData=0x12423850 | out: lpFindFileData=0x12423850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcfea322c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfec9493, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfec9493, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79ff68
	[0303.075] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcfea322c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfec9493, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfec9493, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0303.075] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcfea322c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfea322c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfea322c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-black", cAlternateFileName="CONTRA~1")) returned 1
	[0303.075] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcfea322c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfec9493, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfec9493, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 1
	[0303.075] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe7d01e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfe7d01e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfe7d01e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_LogoSmall.scale-200.png", cAlternateFileName="")) returned 1
	[0303.075] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe7d01e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfe7d01e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfe7d01e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xc9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_SplashScreen.scale-200.png", cAlternateFileName="")) returned 1
	[0303.075] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe7d01e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfe7d01e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfe7d01e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_TileLargeSquare.scale-200.png", cAlternateFileName="")) returned 1
	[0303.075] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe7d01e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfe7d01e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfe7d01e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x415, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_TileMediumSquare.scale-200.png", cAlternateFileName="")) returned 1
	[0303.075] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe7d01e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfe7d01e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfe7d01e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x247, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_TileSmallSquare.scale-200.png", cAlternateFileName="")) returned 1
	[0303.075] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe7d01e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfe7d01e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfe7d01e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x508, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_TileWide.scale-200.png", cAlternateFileName="")) returned 1
	[0303.075] FindNextFileW (in: hFindFile=0x79ff68, lpFindFileData=0x12423870 | out: lpFindFileData=0x12423870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0303.075] FindClose (in: hFindFile=0x79ff68 | out: hFindFile=0x79ff68) returned 1
	[0303.077] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\AppTiles\\Money_LogoSmall.scale-200.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.bingfinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\apptiles\\money_logosmall.scale-200.png"), fInfoLevelId=0x0, lpFileInformation=0x1279ef58 | out: lpFileInformation=0x1279ef58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe7d01e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfe7d01e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfe7d01e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1a7)) returned 1
	[0303.079] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\AppTiles\\Money_SplashScreen.scale-200.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.bingfinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\apptiles\\money_splashscreen.scale-200.png"), fInfoLevelId=0x0, lpFileInformation=0x1279f048 | out: lpFileInformation=0x1279f048*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe7d01e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfe7d01e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfe7d01e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xc9c)) returned 1
	[0303.080] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\AppTiles\\Money_TileLargeSquare.scale-200.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.bingfinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\apptiles\\money_tilelargesquare.scale-200.png"), fInfoLevelId=0x0, lpFileInformation=0x1279f098 | out: lpFileInformation=0x1279f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe7d01e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfe7d01e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfe7d01e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9d5)) returned 1
	[0303.081] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\AppTiles\\Money_TileMediumSquare.scale-200.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.bingfinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\apptiles\\money_tilemediumsquare.scale-200.png"), fInfoLevelId=0x0, lpFileInformation=0x1279f0e8 | out: lpFileInformation=0x1279f0e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe7d01e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfe7d01e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfe7d01e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x415)) returned 1
	[0303.083] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\AppTiles\\Money_TileSmallSquare.scale-200.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.bingfinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\apptiles\\money_tilesmallsquare.scale-200.png"), fInfoLevelId=0x0, lpFileInformation=0x1279f138 | out: lpFileInformation=0x1279f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe7d01e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfe7d01e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfe7d01e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x247)) returned 1
	[0303.083] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\AppTiles\\Money_TileWide.scale-200.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.bingfinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\apptiles\\money_tilewide.scale-200.png"), fInfoLevelId=0x0, lpFileInformation=0x1279f188 | out: lpFileInformation=0x1279f188*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe7d01e, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfe7d01e, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfe7d01e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x508)) returned 1
	[0303.083] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.bingfinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\apptiles\\contrast-black"), fInfoLevelId=0x0, lpFileInformation=0x1279f1d8 | out: lpFileInformation=0x1279f1d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcfea322c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfea322c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfea322c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0303.084] CreateFileW (lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.bingfinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\apptiles\\contrast-black"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0303.084] FindFirstFileW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcfea322c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfea322c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfea322c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fe68
	[0303.086] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcfea322c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfea322c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfea322c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0303.086] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe0a896, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfe0a896, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfe30b59, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_LogoSmall.scale-200.png", cAlternateFileName="")) returned 1
	[0303.086] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe30b59, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfe30b59, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfe30b59, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xc9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_SplashScreen.scale-200.png", cAlternateFileName="")) returned 1
	[0303.086] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe30b59, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfe30b59, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfe30b59, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_TileLargeSquare.scale-200.png", cAlternateFileName="")) returned 1
	[0303.086] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe56dcb, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfe56dcb, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfe56dcb, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x415, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_TileMediumSquare.scale-200.png", cAlternateFileName="")) returned 1
	[0303.086] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe56dcb, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfe56dcb, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfe56dcb, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x247, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_TileSmallSquare.scale-200.png", cAlternateFileName="")) returned 1
	[0303.086] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe56dcb, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfe56dcb, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfe56dcb, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x508, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_TileWide.scale-200.png", cAlternateFileName="")) returned 1
	[0303.087] FindNextFileW (in: hFindFile=0x79fe68, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0303.087] FindClose (in: hFindFile=0x79fe68 | out: hFindFile=0x79fe68) returned 1
	[0303.088] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_LogoSmall.scale-200.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.bingfinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_logosmall.scale-200.png"), fInfoLevelId=0x0, lpFileInformation=0x1279f408 | out: lpFileInformation=0x1279f408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe0a896, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfe0a896, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfe30b59, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1a7)) returned 1
	[0303.089] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_SplashScreen.scale-200.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.bingfinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_splashscreen.scale-200.png"), fInfoLevelId=0x0, lpFileInformation=0x1279f458 | out: lpFileInformation=0x1279f458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe30b59, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfe30b59, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfe30b59, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xc9c)) returned 1
	[0303.090] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileLargeSquare.scale-200.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.bingfinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_tilelargesquare.scale-200.png"), fInfoLevelId=0x0, lpFileInformation=0x1279f4a8 | out: lpFileInformation=0x1279f4a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe30b59, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfe30b59, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfe30b59, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9d5)) returned 1
	[0303.090] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileMediumSquare.scale-200.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.bingfinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_tilemediumsquare.scale-200.png"), fInfoLevelId=0x0, lpFileInformation=0x1279f4f8 | out: lpFileInformation=0x1279f4f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe56dcb, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfe56dcb, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfe56dcb, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x415)) returned 1
	[0303.090] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileSmallSquare.scale-200.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.bingfinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_tilesmallsquare.scale-200.png"), fInfoLevelId=0x0, lpFileInformation=0x1279f548 | out: lpFileInformation=0x1279f548*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe56dcb, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfe56dcb, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfe56dcb, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x247)) returned 1
	[0303.093] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\Money_TileWide.scale-200.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.bingfinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\apptiles\\contrast-black\\money_tilewide.scale-200.png"), fInfoLevelId=0x0, lpFileInformation=0x1279f598 | out: lpFileInformation=0x1279f598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe56dcb, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfe56dcb, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfe56dcb, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x508)) returned 1
	[0303.093] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.bingfinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\apptiles\\contrast-white"), fInfoLevelId=0x0, lpFileInformation=0x1279f5e8 | out: lpFileInformation=0x1279f5e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcfea322c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfec9493, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfec9493, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1
	[0303.094] CreateFileW (lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.bingfinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\apptiles\\contrast-white"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff
	[0303.094] FindFirstFileW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\*", lpFindFileData=0x124237ec | out: lpFindFileData=0x124237ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcfea322c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfec9493, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfec9493, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x79fe28
	[0303.096] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcfea322c, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfec9493, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfec9493, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0303.096] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe56dcb, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfe56dcb, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfe56dcb, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x199, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_LogoSmall.scale-200.png", cAlternateFileName="")) returned 1
	[0303.096] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe56dcb, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfe56dcb, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfe56dcb, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xc83, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_SplashScreen.scale-200.png", cAlternateFileName="")) returned 1
	[0303.096] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe56dcb, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfe56dcb, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfe56dcb, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_TileLargeSquare.scale-200.png", cAlternateFileName="")) returned 1
	[0303.096] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe56dcb, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfe56dcb, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfe56dcb, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x406, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_TileMediumSquare.scale-200.png", cAlternateFileName="")) returned 1
	[0303.096] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe56dcb, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfe56dcb, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfe56dcb, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x23d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_TileSmallSquare.scale-200.png", cAlternateFileName="")) returned 1
	[0303.096] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe56dcb, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfe56dcb, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfe7d01e, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x4f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Money_TileWide.scale-200.png", cAlternateFileName="")) returned 1
	[0303.097] FindNextFileW (in: hFindFile=0x79fe28, lpFindFileData=0x1242380c | out: lpFindFileData=0x1242380c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0303.097] FindClose (in: hFindFile=0x79fe28 | out: hFindFile=0x79fe28) returned 1
	[0303.098] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_LogoSmall.scale-200.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.bingfinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_logosmall.scale-200.png"), fInfoLevelId=0x0, lpFileInformation=0x1279f818 | out: lpFileInformation=0x1279f818*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe56dcb, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfe56dcb, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfe56dcb, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x199)) returned 1
	[0303.100] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_SplashScreen.scale-200.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.bingfinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_splashscreen.scale-200.png"), fInfoLevelId=0x0, lpFileInformation=0x1279f868 | out: lpFileInformation=0x1279f868*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe56dcb, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfe56dcb, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfe56dcb, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0xc83)) returned 1
	[0303.101] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileLargeSquare.scale-200.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.bingfinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_tilelargesquare.scale-200.png"), fInfoLevelId=0x0, lpFileInformation=0x1279f8b8 | out: lpFileInformation=0x1279f8b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe56dcb, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfe56dcb, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfe56dcb, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x9b7)) returned 1
	[0303.101] GetFileAttributesExW (in: lpFileName="C:\\Windows\\InfusedApps\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\Money_TileMediumSquare.scale-200.png" (normalized: "c:\\windows\\infusedapps\\packages\\microsoft.bingfinance_4.6.169.0_neutral_split.scale-200_8wekyb3d8bbwe\\assets\\apptiles\\contrast-white\\money_tilemediumsquare.scale-200.png"), fInfoLevelId=0x0, lpFileInformation=0x1279f908 | out: lpFileInformation=0x1279f908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe56dcb, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xcfe56dcb, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0xcfe56dcb, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x406)) returned 1

Process:
	id = "2"
	image_name = "conhost.exe"
	filename = "c:\\windows\\system32\\conhost.exe"
	page_root = "0x49903000"
	os_pid = "0xba0"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x614"
	cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1"
	cur_dir = "C:\\Windows"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 286
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 287
	        start_va = 0x30000
	          end_va = 0x44fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 288
	        start_va = 0x50000
	          end_va = 0x8ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000050000"
	        filename = ""

Region:
	              id = 289
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 290
	        start_va = 0x400000
	          end_va = 0x5fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 291
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 292
	        start_va = 0x7df5fffc0000
	          end_va = 0x7df5fffe2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df5fffc0000"
	        filename = ""

Region:
	              id = 293
	        start_va = 0x7df5ffff0000
	          end_va = 0x7ff5fffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df5ffff0000"
	        filename = ""

Region:
	              id = 294
	        start_va = 0x7ff642880000
	          end_va = 0x7ff642890fff
	       monitored = 0
	     entry_point = 0x7ff6428816b0
	     region_type = mapped_file
	            name = "conhost.exe"
	        filename = "\\Windows\\System32\\conhost.exe" (normalized: "c:\\windows\\system32\\conhost.exe")

Region:
	              id = 295
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 296
	        start_va = 0x730000
	          end_va = 0x82ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000730000"
	        filename = ""

Region:
	              id = 297
	        start_va = 0x7ff87ce40000
	          end_va = 0x7ff87d027fff
	       monitored = 0
	     entry_point = 0x7ff87ce6ba70
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 298
	        start_va = 0x7ff87f640000
	          end_va = 0x7ff87f6ecfff
	       monitored = 0
	     entry_point = 0x7ff87f6581a0
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 299
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 300
	        start_va = 0x7df5ffec0000
	          end_va = 0x7df5fffbffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df5ffec0000"
	        filename = ""

Region:
	              id = 301
	        start_va = 0x90000
	          end_va = 0x14dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 302
	        start_va = 0x7ff87fde0000
	          end_va = 0x7ff87fe7cfff
	       monitored = 0
	     entry_point = 0x7ff87fde78a0
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 303
	        start_va = 0x150000
	          end_va = 0x18ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000150000"
	        filename = ""

Region:
	              id = 304
	        start_va = 0x830000
	          end_va = 0x98ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000830000"
	        filename = ""

Region:
	              id = 305
	        start_va = 0x20000
	          end_va = 0x26fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 306
	        start_va = 0x7ff865180000
	          end_va = 0x7ff8651d8fff
	       monitored = 0
	     entry_point = 0x7ff86518fbf0
	     region_type = mapped_file
	            name = "conhostv2.dll"
	        filename = "\\Windows\\System32\\ConhostV2.dll" (normalized: "c:\\windows\\system32\\conhostv2.dll")

Region:
	              id = 307
	        start_va = 0x190000
	          end_va = 0x190fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000190000"
	        filename = ""

Region:
	              id = 308
	        start_va = 0x7ff87f6f0000
	          end_va = 0x7ff87f96cfff
	       monitored = 0
	     entry_point = 0x7ff87f7c4970
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")

Region:
	              id = 309
	        start_va = 0x7ff87fe80000
	          end_va = 0x7ff87ff9bfff
	       monitored = 0
	     entry_point = 0x7ff87fec02b0
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 310
	        start_va = 0x7ff87d030000
	          end_va = 0x7ff87d099fff
	       monitored = 0
	     entry_point = 0x7ff87d066d50
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")

Region:
	              id = 311
	        start_va = 0x7ff87ed60000
	          end_va = 0x7ff87eeb5fff
	       monitored = 0
	     entry_point = 0x7ff87ed6a8d0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 312
	        start_va = 0x7ff87f3e0000
	          end_va = 0x7ff87f565fff
	       monitored = 0
	     entry_point = 0x7ff87f42ffc0
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 313
	        start_va = 0x1a0000
	          end_va = 0x1a6fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001a0000"
	        filename = ""

Region:
	              id = 314
	        start_va = 0x7ff87d3a0000
	          end_va = 0x7ff87d4e2fff
	       monitored = 0
	     entry_point = 0x7ff87d3c8210
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")

Region:
	              id = 315
	        start_va = 0x7ff87f970000
	          end_va = 0x7ff87f9cafff
	       monitored = 0
	     entry_point = 0x7ff87f9838b0
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 316
	        start_va = 0x7ff87d4f0000
	          end_va = 0x7ff87d52afff
	       monitored = 0
	     entry_point = 0x7ff87d4f12f0
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")

Region:
	              id = 317
	        start_va = 0x7ff87fa80000
	          end_va = 0x7ff87fb40fff
	       monitored = 0
	     entry_point = 0x7ff87faa0da0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 318
	        start_va = 0x7ff87ab10000
	          end_va = 0x7ff87ac95fff
	       monitored = 0
	     entry_point = 0x7ff87ab5d700
	     region_type = mapped_file
	            name = "propsys.dll"
	        filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll")

Region:
	              id = 319
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001b0000"
	        filename = ""

Region:
	              id = 320
	        start_va = 0x1c0000
	          end_va = 0x1c0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 321
	        start_va = 0x990000
	          end_va = 0xb17fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000990000"
	        filename = ""

Region:
	              id = 322
	        start_va = 0xb20000
	          end_va = 0xca0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000b20000"
	        filename = ""

Region:
	              id = 323
	        start_va = 0xcb0000
	          end_va = 0x20affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000cb0000"
	        filename = ""

Region:
	              id = 324
	        start_va = 0x20b0000
	          end_va = 0x221ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000020b0000"
	        filename = ""

Region:
	              id = 325
	        start_va = 0x600000
	          end_va = 0x63ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000600000"
	        filename = ""

Region:
	              id = 326
	        start_va = 0x7ff87d650000
	          end_va = 0x7ff87ebaefff
	       monitored = 0
	     entry_point = 0x7ff87d7b11f0
	     region_type = mapped_file
	            name = "shell32.dll"
	        filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")

Region:
	              id = 327
	        start_va = 0x7ff87c710000
	          end_va = 0x7ff87c752fff
	       monitored = 0
	     entry_point = 0x7ff87c724b50
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")

Region:
	              id = 328
	        start_va = 0x7ff87c760000
	          end_va = 0x7ff87cda3fff
	       monitored = 0
	     entry_point = 0x7ff87c9264b0
	     region_type = mapped_file
	            name = "windows.storage.dll"
	        filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll")

Region:
	              id = 329
	        start_va = 0x7ff87fd30000
	          end_va = 0x7ff87fdd6fff
	       monitored = 0
	     entry_point = 0x7ff87fd458d0
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 330
	        start_va = 0x7ff87fb50000
	          end_va = 0x7ff87fba1fff
	       monitored = 0
	     entry_point = 0x7ff87fb5f530
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")

Region:
	              id = 331
	        start_va = 0x7ff87c640000
	          end_va = 0x7ff87c64efff
	       monitored = 0
	     entry_point = 0x7ff87c643210
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")

Region:
	              id = 332
	        start_va = 0x7ff87c650000
	          end_va = 0x7ff87c704fff
	       monitored = 0
	     entry_point = 0x7ff87c6922e0
	     region_type = mapped_file
	            name = "shcore.dll"
	        filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll")

Region:
	              id = 333
	        start_va = 0x7ff87c5f0000
	          end_va = 0x7ff87c63afff
	       monitored = 0
	     entry_point = 0x7ff87c5f35f0
	     region_type = mapped_file
	            name = "powrprof.dll"
	        filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")

Region:
	              id = 334
	        start_va = 0x7ff87c5d0000
	          end_va = 0x7ff87c5e3fff
	       monitored = 0
	     entry_point = 0x7ff87c5d52e0
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")

Region:
	              id = 335
	        start_va = 0x7ff87af40000
	          end_va = 0x7ff87afd5fff
	       monitored = 0
	     entry_point = 0x7ff87af65570
	     region_type = mapped_file
	            name = "uxtheme.dll"
	        filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")

Region:
	              id = 336
	        start_va = 0x640000
	          end_va = 0x68ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000640000"
	        filename = ""

Region:
	              id = 337
	        start_va = 0x2220000
	          end_va = 0x2556fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 338
	        start_va = 0x2560000
	          end_va = 0x2776fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002560000"
	        filename = ""

Region:
	              id = 339
	        start_va = 0x2780000
	          end_va = 0x2991fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002780000"
	        filename = ""

Region:
	              id = 340
	        start_va = 0x830000
	          end_va = 0x944fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000830000"
	        filename = ""

Region:
	              id = 341
	        start_va = 0x980000
	          end_va = 0x98ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000980000"
	        filename = ""

Region:
	              id = 342
	        start_va = 0x29a0000
	          end_va = 0x2bb4fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000029a0000"
	        filename = ""

Region:
	              id = 343
	        start_va = 0x20b0000
	          end_va = 0x21bafff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000020b0000"
	        filename = ""

Region:
	              id = 344
	        start_va = 0x2210000
	          end_va = 0x221ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002210000"
	        filename = ""

Region:
	              id = 345
	        start_va = 0x640000
	          end_va = 0x67ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000640000"
	        filename = ""

Region:
	              id = 346
	        start_va = 0x680000
	          end_va = 0x68ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000680000"
	        filename = ""

Region:
	              id = 347
	        start_va = 0x7ff87fbb0000
	          end_va = 0x7ff87fd09fff
	       monitored = 0
	     entry_point = 0x7ff87fbf38e0
	     region_type = mapped_file
	            name = "msctf.dll"
	        filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")

Region:
	              id = 348
	        start_va = 0x50000
	          end_va = 0x50fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000050000"
	        filename = ""

Region:
	              id = 349
	        start_va = 0x2bc0000
	          end_va = 0x2c7bfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002bc0000"
	        filename = ""

Region:
	              id = 350
	        start_va = 0x50000
	          end_va = 0x53fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000050000"
	        filename = ""

Region:
	              id = 351
	        start_va = 0x7ff87a590000
	          end_va = 0x7ff87a5b1fff
	       monitored = 0
	     entry_point = 0x7ff87a591a40
	     region_type = mapped_file
	            name = "dwmapi.dll"
	        filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll")

Region:
	              id = 352
	        start_va = 0x7ff87ad00000
	          end_va = 0x7ff87ad12fff
	       monitored = 0
	     entry_point = 0x7ff87ad02760
	     region_type = mapped_file
	            name = "wtsapi32.dll"
	        filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll")

Region:
	              id = 353
	        start_va = 0x7ff87c3d0000
	          end_va = 0x7ff87c425fff
	       monitored = 0
	     entry_point = 0x7ff87c3e0bf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll")

Region:
	              id = 354
	        start_va = 0x60000
	          end_va = 0x66fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 355
	        start_va = 0x70000
	          end_va = 0x70fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000070000"
	        filename = ""

Region:
	              id = 356
	        start_va = 0x80000
	          end_va = 0x80fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000080000"
	        filename = ""

Region:
	              id = 357
	        start_va = 0x1d0000
	          end_va = 0x1d1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001d0000"
	        filename = ""

Region:
	              id = 358
	        start_va = 0x1e0000
	          end_va = 0x1e0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001e0000"
	        filename = ""

Region:
	              id = 359
	        start_va = 0x1f0000
	          end_va = 0x1f4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "user32.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui")

Region:
	              id = 360
	        start_va = 0x690000
	          end_va = 0x690fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "conhostv2.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\ConhostV2.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\conhostv2.dll.mui")

Region:
	              id = 361
	        start_va = 0x6a0000
	          end_va = 0x6a1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000006a0000"
	        filename = ""

Region:
	              id = 362
	        start_va = 0x2c80000
	          end_va = 0x2e75fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002c80000"
	        filename = ""

Region:
	              id = 363
	        start_va = 0x7ff872050000
	          end_va = 0x7ff8722c3fff
	       monitored = 0
	     entry_point = 0x7ff8720c0400
	     region_type = mapped_file
	            name = "comctl32.dll"
	        filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll")

Region:
	              id = 364
	        start_va = 0x6b0000
	          end_va = 0x6b0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "windowsshell.manifest"
	        filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest")

Region:
	              id = 365
	        start_va = 0x6c0000
	          end_va = 0x6c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000006c0000"
	        filename = ""

Region:
	              id = 366
	        start_va = 0x2e80000
	          end_va = 0x2f5cfff
	       monitored = 0
	     entry_point = 0x2ede0b0
	     region_type = mapped_file
	            name = "rpcss.dll"
	        filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll")

Region:
	              id = 367
	        start_va = 0x6b0000
	          end_va = 0x6b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000006b0000"
	        filename = ""

Region:
	              id = 368
	        start_va = 0x2e80000
	          end_va = 0x2f7ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002e80000"
	        filename = ""

Region:
	              id = 369
	        start_va = 0x2f80000
	          end_va = 0x317efff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002f80000"
	        filename = ""


Thread:
	id = 2
	os_tid = 0x460


Thread:
	id = 3
	os_tid = 0x868


Thread:
	id = 4
	os_tid = 0xe20


Thread:
	id = 5
	os_tid = 0xb04


Process:
	id = "3"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x55c8f000"
	os_pid = "0x1210"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x614"
	cmd_line = "cmd.exe /c \"taskkill /f /im msftesql.exe \""
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 415
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 416
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 417
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 418
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 419
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 420
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 421
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 422
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 423
	        start_va = 0x13a0000
	          end_va = 0x13f1fff
	       monitored = 1
	     entry_point = 0x13b4fd0
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")

Region:
	              id = 424
	        start_va = 0x1400000
	          end_va = 0x53fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001400000"
	        filename = ""

Region:
	              id = 425
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 426
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 427
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 428
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 429
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 430
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 431
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 432
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 433
	        start_va = 0x440000
	          end_va = 0x44ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000440000"
	        filename = ""

Region:
	              id = 434
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 435
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 436
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 437
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 438
	        start_va = 0x450000
	          end_va = 0x6effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000450000"
	        filename = ""

Region:
	              id = 439
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 440
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 441
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 442
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 443
	        start_va = 0x450000
	          end_va = 0x50dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 444
	        start_va = 0x5f0000
	          end_va = 0x6effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005f0000"
	        filename = ""

Region:
	              id = 445
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 446
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 447
	        start_va = 0x6f0000
	          end_va = 0x7effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006f0000"
	        filename = ""

Region:
	              id = 448
	        start_va = 0x510000
	          end_va = 0x5dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000510000"
	        filename = ""

Region:
	              id = 449
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 450
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 451
	        start_va = 0x7f0000
	          end_va = 0xb26fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 11
	os_tid = 0xdd8

	[0110.211] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000
	[0110.211] __set_app_type (_Type=0x1) 
	[0110.211] __p__fmode () returned 0x74974d6c
	[0110.211] __p__commode () returned 0x74975b1c
	[0110.211] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13b5200) returned 0x0
	[0110.211] __getmainargs (in: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0, _DoWildCard=0, _StartInfo=0x13c60fc | out: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0) returned 0
	[0110.213] GetCurrentThreadId () returned 0xdd8
	[0110.213] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xdd8) returned 0x78
	[0110.213] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0110.213] GetProcAddress (hModule=0x75600000, lpProcName="SetThreadUILanguage") returned 0x75642510
	[0110.213] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0110.222] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0110.222] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2
	[0110.223] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0110.223] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0110.223] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0110.223] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0110.223] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0110.223] GetConsoleOutputCP () returned 0x1b5
	[0110.225] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0110.225] SetConsoleCtrlHandler (HandlerRoutine=0x13c0e40, Add=1) returned 1
	[0110.225] _get_osfhandle (_FileHandle=1) returned 0x140
	[0110.225] SetConsoleMode (hConsoleHandle=0x140, dwMode=0x0) returned 0
	[0110.225] _get_osfhandle (_FileHandle=1) returned 0x140
	[0110.225] GetConsoleMode (in: hConsoleHandle=0x140, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0110.225] _get_osfhandle (_FileHandle=0) returned 0x13c
	[0110.225] GetConsoleMode (in: hConsoleHandle=0x13c, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0110.225] GetEnvironmentStringsW () returned 0x5f7d60*
	[0110.225] GetProcessHeap () returned 0x5f0000
	[0110.225] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xa1a) returned 0x5f8788
	[0110.226] FreeEnvironmentStringsA (penv="A") returned 1
	[0110.226] GetProcessHeap () returned 0x5f0000
	[0110.226] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x4) returned 0x5f4440
	[0110.226] GetEnvironmentStringsW () returned 0x5f7d60*
	[0110.226] GetProcessHeap () returned 0x5f0000
	[0110.226] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xa1a) returned 0x5f91b0
	[0110.226] FreeEnvironmentStringsA (penv="A") returned 1
	[0110.226] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0110.226] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0110.226] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0110.227] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0110.227] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0110.227] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0110.227] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0110.227] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0110.227] RegCloseKey (hKey=0x88) returned 0x0
	[0110.227] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0110.227] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0110.227] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0110.227] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0110.227] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0110.228] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0110.228] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0110.228] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0110.228] RegCloseKey (hKey=0x88) returned 0x0
	[0110.228] time (in: timer=0x0 | out: timer=0x0) returned 0x623441f8
	[0110.228] srand (_Seed=0x623441f8) 
	[0110.228] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im msftesql.exe \""
	[0110.228] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im msftesql.exe \""
	[0110.228] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0110.229] GetProcessHeap () returned 0x5f0000
	[0110.229] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x210) returned 0x5f9bd8
	[0110.229] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5f9be0, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0110.229] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0110.229] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0110.229] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0110.230] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0110.230] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0110.230] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0110.230] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0110.230] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0110.230] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0110.230] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0110.230] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0110.230] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0110.230] GetProcessHeap () returned 0x5f0000
	[0110.231] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5f8788) returned 1
	[0110.231] GetEnvironmentStringsW () returned 0x5f7d60*
	[0110.231] GetProcessHeap () returned 0x5f0000
	[0110.231] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xa32) returned 0x5fa830
	[0110.231] FreeEnvironmentStringsA (penv="A") returned 1
	[0110.231] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b
	[0110.231] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0110.231] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0110.231] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0110.231] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0110.231] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0110.232] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0110.232] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0110.232] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0110.232] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0110.232] GetProcessHeap () returned 0x5f0000
	[0110.232] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x44) returned 0x5f42e0
	[0110.232] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0110.232] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19fc4c*="Desktop") returned 0x1d
	[0110.232] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0110.232] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x5f4330
	[0110.233] FindClose (in: hFindFile=0x5f4330 | out: hFindFile=0x5f4330) returned 1
	[0110.233] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x5f4330
	[0110.233] FindClose (in: hFindFile=0x5f4330 | out: hFindFile=0x5f4330) returned 1
	[0110.233] _wcsnicmp (_String1="RDHJ0C~1", _String2="RDhJ0CNFevzX", _MaxCount=0xc) returned 16
	[0110.233] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x5f4330
	[0110.233] FindClose (in: hFindFile=0x5f4330 | out: hFindFile=0x5f4330) returned 1
	[0110.234] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0110.234] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1
	[0110.234] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 1
	[0110.234] GetProcessHeap () returned 0x5f0000
	[0110.234] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5fa830) returned 1
	[0110.234] GetEnvironmentStringsW () returned 0x5f7d60*
	[0110.234] GetProcessHeap () returned 0x5f0000
	[0110.234] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xa76) returned 0x5f9df0
	[0110.234] FreeEnvironmentStringsA (penv="=") returned 1
	[0110.234] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0110.234] GetProcessHeap () returned 0x5f0000
	[0110.235] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5f42e0) returned 1
	[0110.235] GetProcessHeap () returned 0x5f0000
	[0110.235] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x400e) returned 0x5fbcf0
	[0110.235] GetProcessHeap () returned 0x5f0000
	[0110.235] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x4c) returned 0x5f42e0
	[0110.235] GetProcessHeap () returned 0x5f0000
	[0110.235] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x4008) returned 0x5ffd08
	[0110.236] GetProcessHeap () returned 0x5f0000
	[0110.236] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x4008) returned 0x603d18
	[0110.237] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0110.237] GetProcessHeap () returned 0x5f0000
	[0110.237] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x418) returned 0x5fa870
	[0110.238] SetErrorMode (uMode=0x0) returned 0x8003
	[0110.238] SetErrorMode (uMode=0x1) returned 0x0
	[0110.238] GetFullPathNameW (in: lpFileName="taskkill \\f \\.", nBufferLength=0x208, lpBuffer=0x5fa878, lpFilePart=0x19fbac | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f", lpFilePart=0x19fbac*="f") returned 0x29
	[0110.238] SetErrorMode (uMode=0x8003) returned 0x1
	[0110.238] GetProcessHeap () returned 0x5f0000
	[0110.238] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x5fa870, Size=0x7e) returned 0x5fa870
	[0110.238] GetProcessHeap () returned 0x5f0000
	[0110.238] RtlSizeHeap (HeapHandle=0x5f0000, Flags=0x0, MemoryPointer=0x5fa870) returned 0x7e
	[0110.238] NeedCurrentDirectoryForExePathW (ExeName="taskkill \\f \\.") returned 1
	[0110.238] GetProcessHeap () returned 0x5f0000
	[0110.238] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x62) returned 0x5fa8f8
	[0110.238] GetProcessHeap () returned 0x5f0000
	[0110.238] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xb8) returned 0x5fa968
	[0110.238] GetProcessHeap () returned 0x5f0000
	[0110.238] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x5fa968, Size=0x62) returned 0x5fa968
	[0110.238] GetProcessHeap () returned 0x5f0000
	[0110.238] RtlSizeHeap (HeapHandle=0x5f0000, Flags=0x0, MemoryPointer=0x5fa968) returned 0x62
	[0110.238] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0110.239] GetProcessHeap () returned 0x5f0000
	[0110.239] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xe0) returned 0x5fa9d8
	[0110.243] GetProcessHeap () returned 0x5f0000
	[0110.243] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x5fa9d8, Size=0x76) returned 0x5fa9d8
	[0110.243] GetProcessHeap () returned 0x5f0000
	[0110.243] RtlSizeHeap (HeapHandle=0x5f0000, Flags=0x0, MemoryPointer=0x5fa9d8) returned 0x76
	[0110.243] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0110.244] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f\\im msftesql.exe ", fInfoLevelId=0x1, lpFindFileData=0x19f958, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f958) returned 0xffffffff
	[0110.244] GetLastError () returned 0x3
	[0110.244] GetProcessHeap () returned 0x5f0000
	[0110.245] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5ffd08) returned 1
	[0110.245] GetProcessHeap () returned 0x5f0000
	[0110.245] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x603d18) returned 1
	[0110.245] GetProcessHeap () returned 0x5f0000
	[0110.245] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5fbcf0) returned 1
	[0110.245] GetConsoleOutputCP () returned 0x1b5
	[0110.247] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0110.247] GetUserDefaultLCID () returned 0x409
	[0110.247] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x13d34a0, cchData=8 | out: lpLCData=":") returned 2
	[0110.247] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0110.247] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0110.247] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2
	[0110.247] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x13d34b0, cchData=8 | out: lpLCData="/") returned 2
	[0110.248] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x13d3500, cchData=32 | out: lpLCData="Mon") returned 4
	[0110.248] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x13d3540, cchData=32 | out: lpLCData="Tue") returned 4
	[0110.248] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x13d3580, cchData=32 | out: lpLCData="Wed") returned 4
	[0110.248] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x13d35c0, cchData=32 | out: lpLCData="Thu") returned 4
	[0110.248] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x13d3600, cchData=32 | out: lpLCData="Fri") returned 4
	[0110.248] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x13d3640, cchData=32 | out: lpLCData="Sat") returned 4
	[0110.248] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x13d3680, cchData=32 | out: lpLCData="Sun") returned 4
	[0110.248] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x13d34c0, cchData=8 | out: lpLCData=".") returned 2
	[0110.248] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x13d34e0, cchData=8 | out: lpLCData=",") returned 2
	[0110.248] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0110.250] GetProcessHeap () returned 0x5f0000
	[0110.250] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x20c) returned 0x5faa58
	[0110.250] GetConsoleTitleW (in: lpConsoleTitle=0x5faa58, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0110.253] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0110.253] GetProcAddress (hModule=0x75600000, lpProcName="CopyFileExW") returned 0x7561ffc0
	[0110.253] GetProcAddress (hModule=0x75600000, lpProcName="IsDebuggerPresent") returned 0x7561b0b0
	[0110.253] GetProcAddress (hModule=0x75600000, lpProcName="SetConsoleInputExeNameW") returned 0x7559b440
	[0110.253] GetProcessHeap () returned 0x5f0000
	[0110.253] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x400a) returned 0x5fbcf0
	[0110.253] GetProcessHeap () returned 0x5f0000
	[0110.254] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5fbcf0) returned 1
	[0110.256] _wcsicmp (_String1="taskkill", _String2=")") returned 75
	[0110.256] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14
	[0110.256] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14
	[0110.256] _wcsicmp (_String1="IF", _String2="taskkill") returned -11
	[0110.256] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11
	[0110.256] _wcsicmp (_String1="REM", _String2="taskkill") returned -2
	[0110.256] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2
	[0110.256] GetProcessHeap () returned 0x5f0000
	[0110.256] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x58) returned 0x5fac70
	[0110.256] GetProcessHeap () returned 0x5f0000
	[0110.256] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x1a) returned 0x5facd0
	[0110.258] GetProcessHeap () returned 0x5f0000
	[0110.258] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x34) returned 0x5facf8
	[0110.259] GetConsoleTitleW (in: lpConsoleTitle=0x19fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0110.263] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0110.263] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0110.263] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0110.263] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0110.263] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0110.263] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0110.263] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0110.263] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0110.263] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0110.263] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0110.263] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0110.263] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0110.263] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0110.263] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0110.263] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0110.263] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0110.264] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0110.264] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0110.264] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0110.264] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0110.264] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0110.264] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0110.264] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0110.264] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0110.264] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0110.264] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0110.264] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0110.264] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0110.264] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0110.264] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0110.264] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0110.264] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0110.264] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0110.264] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0110.264] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0110.264] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0110.264] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0110.264] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0110.264] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0110.264] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0110.264] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0110.264] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0110.264] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0110.264] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0110.265] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0110.265] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0110.265] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0110.265] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0110.265] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0110.265] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0110.265] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0110.265] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0110.265] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0110.265] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0110.265] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0110.265] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0110.265] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0110.265] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0110.265] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0110.265] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0110.265] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0110.265] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0110.265] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0110.265] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0110.265] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0110.265] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0110.265] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0110.265] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0110.265] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0110.265] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0110.266] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0110.266] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0110.266] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0110.266] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0110.266] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0110.266] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0110.266] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0110.266] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0110.266] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0110.266] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0110.266] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0110.266] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0110.266] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0110.266] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0110.266] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14
	[0110.266] _wcsicmp (_String1="taskkill", _String2="IF") returned 11
	[0110.266] _wcsicmp (_String1="taskkill", _String2="REM") returned 2
	[0110.267] GetProcessHeap () returned 0x5f0000
	[0110.267] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x210) returned 0x5fad38
	[0110.267] GetProcessHeap () returned 0x5f0000
	[0110.267] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x46) returned 0x5faf50
	[0110.267] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0110.267] GetProcessHeap () returned 0x5f0000
	[0110.267] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x418) returned 0x5f05c8
	[0110.267] SetErrorMode (uMode=0x0) returned 0x8003
	[0110.267] SetErrorMode (uMode=0x1) returned 0x0
	[0110.267] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x5f05d0, lpFilePart=0x19f57c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19f57c*="Desktop") returned 0x1d
	[0110.267] SetErrorMode (uMode=0x8003) returned 0x1
	[0110.268] GetProcessHeap () returned 0x5f0000
	[0110.268] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x5f05c8, Size=0x56) returned 0x5f05c8
	[0110.268] GetProcessHeap () returned 0x5f0000
	[0110.268] RtlSizeHeap (HeapHandle=0x5f0000, Flags=0x0, MemoryPointer=0x5f05c8) returned 0x56
	[0110.268] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0110.268] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0110.268] GetProcessHeap () returned 0x5f0000
	[0110.268] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x110) returned 0x5fafa0
	[0110.268] GetProcessHeap () returned 0x5f0000
	[0110.268] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x218) returned 0x5f0628
	[0110.273] GetProcessHeap () returned 0x5f0000
	[0110.273] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x5f0628, Size=0x112) returned 0x5f0628
	[0110.273] GetProcessHeap () returned 0x5f0000
	[0110.273] RtlSizeHeap (HeapHandle=0x5f0000, Flags=0x0, MemoryPointer=0x5f0628) returned 0x112
	[0110.273] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0110.273] GetProcessHeap () returned 0x5f0000
	[0110.273] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xe0) returned 0x5fb0b8
	[0110.275] GetProcessHeap () returned 0x5f0000
	[0110.275] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x5fb0b8, Size=0x76) returned 0x5fb0b8
	[0110.275] GetProcessHeap () returned 0x5f0000
	[0110.275] RtlSizeHeap (HeapHandle=0x5f0000, Flags=0x0, MemoryPointer=0x5fb0b8) returned 0x76
	[0110.275] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0110.276] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0110.276] GetLastError () returned 0x2
	[0110.276] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0110.276] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x5fb138
	[0110.276] GetProcessHeap () returned 0x5f0000
	[0110.276] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x14) returned 0x5f41d8
	[0110.276] FindClose (in: hFindFile=0x5fb138 | out: hFindFile=0x5fb138) returned 1
	[0110.277] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0110.277] GetLastError () returned 0x2
	[0110.277] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x5fb138
	[0110.277] GetProcessHeap () returned 0x5f0000
	[0110.277] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x5f41d8, Size=0x4) returned 0x5f4380
	[0110.277] FindClose (in: hFindFile=0x5fb138 | out: hFindFile=0x5fb138) returned 1
	[0110.277] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0110.277] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0110.277] GetConsoleTitleW (in: lpConsoleTitle=0x19f7fc, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0110.281] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f728, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f70c | out: lpAttributeList=0x19f728, lpSize=0x19f70c) returned 1
	[0110.281] UpdateProcThreadAttribute (in: lpAttributeList=0x19f728, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f714, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f728, lpPreviousValue=0x0) returned 1
	[0110.281] GetStartupInfoW (in: lpStartupInfo=0x19f760 | out: lpStartupInfo=0x19f760*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x13c, hStdOutput=0x140, hStdError=0x144)) 
	[0110.281] GetProcessHeap () returned 0x5f0000
	[0110.281] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x18) returned 0x5f4078
	[0110.281] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0110.281] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0110.282] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0110.282] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0110.282] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0110.282] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0110.282] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0110.282] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0110.282] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0110.282] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0110.282] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0110.282] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0110.282] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0110.282] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0110.282] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0110.282] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0110.282] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0110.282] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0110.282] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0110.282] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0110.282] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0110.282] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0110.282] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0110.282] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0110.282] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0110.282] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0110.283] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0110.283] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0110.283] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0110.283] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0110.283] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0110.283] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0110.283] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0110.283] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0110.283] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0110.283] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0110.283] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0110.283] GetProcessHeap () returned 0x5f0000
	[0110.283] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5f4078) returned 1
	[0110.283] GetProcessHeap () returned 0x5f0000
	[0110.283] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xa) returned 0x5fb138
	[0110.283] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1
	[0110.302] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill  /f /im msftesql.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x19f6b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill  /f /im msftesql.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f6fc | out: lpCommandLine="taskkill  /f /im msftesql.exe ", lpProcessInformation=0x19f6fc*(hProcess=0x9c, hThread=0x98, dwProcessId=0x120c, dwThreadId=0x134c)) returned 1
	[0110.671] CloseHandle (hObject=0x98) returned 1
	[0110.671] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0110.671] GetProcessHeap () returned 0x5f0000
	[0110.671] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5f9df0) returned 1
	[0110.671] GetEnvironmentStringsW () returned 0x5f9df0*
	[0110.671] GetProcessHeap () returned 0x5f0000
	[0110.671] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xa76) returned 0x5f7d60
	[0110.671] FreeEnvironmentStringsA (penv="=") returned 1
	[0110.671] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0
	[0119.882] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x19f694 | out: lpExitCode=0x19f694*=0x80) returned 1
	[0119.882] CloseHandle (hObject=0x9c) returned 1
	[0119.883] _vsnwprintf (in: _Buffer=0x19f77c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f69c | out: _Buffer="00000080") returned 8
	[0119.883] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1
	[0119.884] GetProcessHeap () returned 0x5f0000
	[0119.884] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5f7d60) returned 1
	[0119.885] GetEnvironmentStringsW () returned 0x5f7d60*
	[0119.885] GetProcessHeap () returned 0x5f0000
	[0119.885] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xa9c) returned 0x5fc798
	[0119.886] FreeEnvironmentStringsA (penv="=") returned 1
	[0119.886] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0119.886] GetProcessHeap () returned 0x5f0000
	[0119.886] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5fc798) returned 1
	[0119.886] GetEnvironmentStringsW () returned 0x5f7d60*
	[0119.887] GetProcessHeap () returned 0x5f0000
	[0119.887] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xa9c) returned 0x5fc798
	[0119.887] FreeEnvironmentStringsA (penv="=") returned 1
	[0119.887] GetProcessHeap () returned 0x5f0000
	[0119.887] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5fb138) returned 1
	[0119.887] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f728 | out: lpAttributeList=0x19f728) 
	[0119.888] _get_osfhandle (_FileHandle=1) returned 0x140
	[0119.888] SetConsoleMode (hConsoleHandle=0x140, dwMode=0x0) returned 0
	[0119.888] _get_osfhandle (_FileHandle=1) returned 0x140
	[0119.888] GetConsoleMode (in: hConsoleHandle=0x140, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0119.888] _get_osfhandle (_FileHandle=0) returned 0x13c
	[0119.888] GetConsoleMode (in: hConsoleHandle=0x13c, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0119.888] GetConsoleOutputCP () returned 0x1b5
	[0119.890] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0119.890] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0119.892] exit (_Code=128) 

Thread:
	id = 12
	os_tid = 0x1274


Process:
	id = "4"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\syswow64\\taskkill.exe"
	page_root = "0x48b89000"
	os_pid = "0x120c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "3"
	os_parent_pid = "0x1210"
	cmd_line = "taskkill  /f /im msftesql.exe "
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 452
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 453
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 454
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 455
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 456
	        start_va = 0xa0000
	          end_va = 0xdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 457
	        start_va = 0xe0000
	          end_va = 0xe3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 458
	        start_va = 0xf0000
	          end_va = 0xf0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 459
	        start_va = 0x100000
	          end_va = 0x101fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 460
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 461
	        start_va = 0x13b0000
	          end_va = 0x13c5fff
	       monitored = 0
	     entry_point = 0x13bde80
	     region_type = mapped_file
	            name = "taskkill.exe"
	        filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe")

Region:
	              id = 462
	        start_va = 0x13d0000
	          end_va = 0x53cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000013d0000"
	        filename = ""

Region:
	              id = 463
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 464
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 465
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 466
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 467
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 468
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 469
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 470
	        start_va = 0x580000
	          end_va = 0x58ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000580000"
	        filename = ""

Region:
	              id = 471
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 472
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 473
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 474
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 475
	        start_va = 0x590000
	          end_va = 0x86ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000590000"
	        filename = ""

Region:
	              id = 476
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 477
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 478
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 479
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 480
	        start_va = 0x110000
	          end_va = 0x1cdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 481
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 482
	        start_va = 0x74650000
	          end_va = 0x746cafff
	       monitored = 0
	     entry_point = 0x7466e970
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 483
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 484
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 485
	        start_va = 0x440000
	          end_va = 0x47ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000440000"
	        filename = ""

Region:
	              id = 486
	        start_va = 0x76ae0000
	          end_va = 0x76b23fff
	       monitored = 0
	     entry_point = 0x76af9d80
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 487
	        start_va = 0x75260000
	          end_va = 0x7530cfff
	       monitored = 0
	     entry_point = 0x75274f00
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 488
	        start_va = 0x74450000
	          end_va = 0x7446dfff
	       monitored = 0
	     entry_point = 0x7445b640
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 489
	        start_va = 0x74440000
	          end_va = 0x74449fff
	       monitored = 0
	     entry_point = 0x74442a00
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 490
	        start_va = 0x74590000
	          end_va = 0x745e7fff
	       monitored = 0
	     entry_point = 0x745d25c0
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 491
	        start_va = 0x77450000
	          end_va = 0x77596fff
	       monitored = 0
	     entry_point = 0x77461cf0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 492
	        start_va = 0x76b30000
	          end_va = 0x76c7efff
	       monitored = 0
	     entry_point = 0x76be6820
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 493
	        start_va = 0x6cc90000
	          end_va = 0x6cc97fff
	       monitored = 0
	     entry_point = 0x6cc917b0
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 494
	        start_va = 0x753c0000
	          end_va = 0x75451fff
	       monitored = 0
	     entry_point = 0x753f8cf0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 495
	        start_va = 0x6cc70000
	          end_va = 0x6cc85fff
	       monitored = 0
	     entry_point = 0x6cc721d0
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")

Region:
	              id = 496
	        start_va = 0x77290000
	          end_va = 0x7744cfff
	       monitored = 0
	     entry_point = 0x77372a10
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")

Region:
	              id = 497
	        start_va = 0x75310000
	          end_va = 0x7536efff
	       monitored = 0
	     entry_point = 0x75314af0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 498
	        start_va = 0x77240000
	          end_va = 0x77284fff
	       monitored = 0
	     entry_point = 0x7725de90
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 499
	        start_va = 0x480000
	          end_va = 0x4bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 500
	        start_va = 0x4c0000
	          end_va = 0x4fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004c0000"
	        filename = ""

Region:
	              id = 501
	        start_va = 0x6cc30000
	          end_va = 0x6cc6efff
	       monitored = 0
	     entry_point = 0x6cc446c0
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll")

Region:
	              id = 502
	        start_va = 0x6cad0000
	          end_va = 0x6caebfff
	       monitored = 0
	     entry_point = 0x6cad4720
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")

Region:
	              id = 503
	        start_va = 0x6cac0000
	          end_va = 0x6cac9fff
	       monitored = 0
	     entry_point = 0x6cac28d0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")

Region:
	              id = 504
	        start_va = 0x6caf0000
	          end_va = 0x6cc2efff
	       monitored = 0
	     entry_point = 0x6cb1d880
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll")

Region:
	              id = 505
	        start_va = 0x590000
	          end_va = 0x75ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000590000"
	        filename = ""

Region:
	              id = 506
	        start_va = 0x770000
	          end_va = 0x86ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000770000"
	        filename = ""

Region:
	              id = 507
	        start_va = 0x1d0000
	          end_va = 0x1f9fff
	       monitored = 0
	     entry_point = 0x1d5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 508
	        start_va = 0x590000
	          end_va = 0x717fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000590000"
	        filename = ""

Region:
	              id = 509
	        start_va = 0x750000
	          end_va = 0x75ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000750000"
	        filename = ""

Region:
	              id = 510
	        start_va = 0x74ea0000
	          end_va = 0x74ecafff
	       monitored = 0
	     entry_point = 0x74ea5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 511
	        start_va = 0x870000
	          end_va = 0x9f0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000870000"
	        filename = ""

Region:
	              id = 512
	        start_va = 0x53d0000
	          end_va = 0x67cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000053d0000"
	        filename = ""

Region:
	              id = 513
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 514
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001d0000"
	        filename = ""

Region:
	              id = 515
	        start_va = 0x1e0000
	          end_va = 0x1e4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taskkill.exe.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui")

Region:
	              id = 516
	        start_va = 0x1f0000
	          end_va = 0x1f0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001f0000"
	        filename = ""

Region:
	              id = 517
	        start_va = 0x500000
	          end_va = 0x500fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000500000"
	        filename = ""

Region:
	              id = 518
	        start_va = 0xa00000
	          end_va = 0xd36fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 519
	        start_va = 0xd40000
	          end_va = 0xe29fff
	       monitored = 0
	     entry_point = 0xd7d650
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 520
	        start_va = 0x510000
	          end_va = 0x513fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000510000"
	        filename = ""

Region:
	              id = 521
	        start_va = 0xd40000
	          end_va = 0xe1ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 522
	        start_va = 0x76e20000
	          end_va = 0x76e2bfff
	       monitored = 0
	     entry_point = 0x76e23930
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")

Region:
	              id = 523
	        start_va = 0x520000
	          end_va = 0x520fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000520000"
	        filename = ""

Region:
	              id = 524
	        start_va = 0x76c80000
	          end_va = 0x76d03fff
	       monitored = 0
	     entry_point = 0x76ca6220
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 525
	        start_va = 0x530000
	          end_va = 0x530fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000530000"
	        filename = ""

Region:
	              id = 526
	        start_va = 0x6cab0000
	          end_va = 0x6cabcfff
	       monitored = 0
	     entry_point = 0x6cab3520
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 527
	        start_va = 0x6ca40000
	          end_va = 0x6caa6fff
	       monitored = 0
	     entry_point = 0x6ca5b610
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 528
	        start_va = 0x740f0000
	          end_va = 0x7410afff
	       monitored = 0
	     entry_point = 0x740f9050
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 529
	        start_va = 0x6c9f0000
	          end_va = 0x6ca33fff
	       monitored = 0
	     entry_point = 0x6ca0aaf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")

Region:
	              id = 530
	        start_va = 0x540000
	          end_va = 0x57ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000540000"
	        filename = ""

Region:
	              id = 531
	        start_va = 0xe20000
	          end_va = 0xe5ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e20000"
	        filename = ""

Region:
	              id = 532
	        start_va = 0xe60000
	          end_va = 0xe9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e60000"
	        filename = ""

Region:
	              id = 533
	        start_va = 0xea0000
	          end_va = 0xedffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ea0000"
	        filename = ""

Region:
	              id = 534
	        start_va = 0xee0000
	          end_va = 0xf1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ee0000"
	        filename = ""

Region:
	              id = 535
	        start_va = 0xf20000
	          end_va = 0xf5ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000f20000"
	        filename = ""

Region:
	              id = 536
	        start_va = 0x6c9d0000
	          end_va = 0x6c9e0fff
	       monitored = 0
	     entry_point = 0x6c9d8fa0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 938
	        start_va = 0x6c910000
	          end_va = 0x6c9cefff
	       monitored = 0
	     entry_point = 0x6c941e80
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 945
	        start_va = 0x720000
	          end_va = 0x725fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000720000"
	        filename = ""


Thread:
	id = 13
	os_tid = 0x134c


Thread:
	id = 14
	os_tid = 0x85c


Thread:
	id = 15
	os_tid = 0x634


Thread:
	id = 16
	os_tid = 0x139c


Thread:
	id = 17
	os_tid = 0x1348


Thread:
	id = 18
	os_tid = 0x17c


Process:
	id = "5"
	image_name = "svchost.exe"
	filename = "c:\\windows\\system32\\svchost.exe"
	page_root = "0x7496b000"
	os_pid = "0x3e8"
	os_integrity_level = "0x4000"
	os_privileges = "0xe60b1e890"
	monitor_reason = "rpc_server"
	parent_id = "4"
	os_parent_pid = "0x214"
	cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\SYSTEM"
	bitness = "32"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000c9f4" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]

Region:
	              id = 537
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 538
	        start_va = 0x20000
	          end_va = 0x21fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000020000"
	        filename = ""

Region:
	              id = 539
	        start_va = 0x30000
	          end_va = 0x44fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 540
	        start_va = 0x50000
	          end_va = 0xcffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000050000"
	        filename = ""

Region:
	              id = 541
	        start_va = 0xd0000
	          end_va = 0xd3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000d0000"
	        filename = ""

Region:
	              id = 542
	        start_va = 0xe0000
	          end_va = 0xe0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 543
	        start_va = 0xf0000
	          end_va = 0xf1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000f0000"
	        filename = ""

Region:
	              id = 544
	        start_va = 0x100000
	          end_va = 0x1bdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 545
	        start_va = 0x1c0000
	          end_va = 0x1c0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001c0000"
	        filename = ""

Region:
	              id = 546
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001d0000"
	        filename = ""

Region:
	              id = 547
	        start_va = 0x1e0000
	          end_va = 0x1e0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001e0000"
	        filename = ""

Region:
	              id = 548
	        start_va = 0x1f0000
	          end_va = 0x1f0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001f0000"
	        filename = ""

Region:
	              id = 549
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 550
	        start_va = 0x400000
	          end_va = 0x47ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 551
	        start_va = 0x480000
	          end_va = 0x53ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000480000"
	        filename = ""

Region:
	              id = 552
	        start_va = 0x540000
	          end_va = 0x540fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000540000"
	        filename = ""

Region:
	              id = 553
	        start_va = 0x550000
	          end_va = 0x550fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000550000"
	        filename = ""

Region:
	              id = 554
	        start_va = 0x560000
	          end_va = 0x560fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000560000"
	        filename = ""

Region:
	              id = 555
	        start_va = 0x570000
	          end_va = 0x576fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000570000"
	        filename = ""

Region:
	              id = 556
	        start_va = 0x580000
	          end_va = 0x580fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000580000"
	        filename = ""

Region:
	              id = 557
	        start_va = 0x590000
	          end_va = 0x590fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000590000"
	        filename = ""

Region:
	              id = 558
	        start_va = 0x5a0000
	          end_va = 0x5a1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000005a0000"
	        filename = ""

Region:
	              id = 559
	        start_va = 0x5b0000
	          end_va = 0x5b3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "cversions.2.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")

Region:
	              id = 560
	        start_va = 0x5c0000
	          end_va = 0x5c3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "cversions.2.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")

Region:
	              id = 561
	        start_va = 0x5d0000
	          end_va = 0x5d0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "usocore.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\usocore.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\usocore.dll.mui")

Region:
	              id = 562
	        start_va = 0x5e0000
	          end_va = 0x5e6fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005e0000"
	        filename = ""

Region:
	              id = 563
	        start_va = 0x5f0000
	          end_va = 0x5f1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000005f0000"
	        filename = ""

Region:
	              id = 564
	        start_va = 0x600000
	          end_va = 0x6fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000600000"
	        filename = ""

Region:
	              id = 565
	        start_va = 0x700000
	          end_va = 0x887fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000700000"
	        filename = ""

Region:
	              id = 566
	        start_va = 0x890000
	          end_va = 0x891fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000890000"
	        filename = ""

Region:
	              id = 567
	        start_va = 0x8a0000
	          end_va = 0x8a6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "newdev.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\newdev.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\newdev.dll.mui")

Region:
	              id = 568
	        start_va = 0x8b0000
	          end_va = 0x8b6fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000008b0000"
	        filename = ""

Region:
	              id = 569
	        start_va = 0x8c0000
	          end_va = 0x8c1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "dosvc.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui")

Region:
	              id = 570
	        start_va = 0x8d0000
	          end_va = 0x8d1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000008d0000"
	        filename = ""

Region:
	              id = 571
	        start_va = 0x8e0000
	          end_va = 0x8f7fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000008e0000"
	        filename = ""

Region:
	              id = 572
	        start_va = 0x900000
	          end_va = 0x9fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000900000"
	        filename = ""

Region:
	              id = 573
	        start_va = 0xa00000
	          end_va = 0xb80fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000a00000"
	        filename = ""

Region:
	              id = 574
	        start_va = 0xb90000
	          end_va = 0xf8afff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000b90000"
	        filename = ""

Region:
	              id = 575
	        start_va = 0xf90000
	          end_va = 0xfd4fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000005.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db")

Region:
	              id = 576
	        start_va = 0x1000000
	          end_va = 0x10fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001000000"
	        filename = ""

Region:
	              id = 577
	        start_va = 0x1100000
	          end_va = 0x117ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001100000"
	        filename = ""

Region:
	              id = 578
	        start_va = 0x1180000
	          end_va = 0x11fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001180000"
	        filename = ""

Region:
	              id = 579
	        start_va = 0x1200000
	          end_va = 0x12fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001200000"
	        filename = ""

Region:
	              id = 580
	        start_va = 0x1300000
	          end_va = 0x13fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001300000"
	        filename = ""

Region:
	              id = 581
	        start_va = 0x1400000
	          end_va = 0x14fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001400000"
	        filename = ""

Region:
	              id = 582
	        start_va = 0x1500000
	          end_va = 0x15fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001500000"
	        filename = ""

Region:
	              id = 583
	        start_va = 0x1600000
	          end_va = 0x1936fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 584
	        start_va = 0x1940000
	          end_va = 0x1a3ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001940000"
	        filename = ""

Region:
	              id = 585
	        start_va = 0x1a40000
	          end_va = 0x1b3ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001a40000"
	        filename = ""

Region:
	              id = 586
	        start_va = 0x1b40000
	          end_va = 0x1c3ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001b40000"
	        filename = ""

Region:
	              id = 587
	        start_va = 0x1c40000
	          end_va = 0x1d3ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001c40000"
	        filename = ""

Region:
	              id = 588
	        start_va = 0x1d40000
	          end_va = 0x1e3ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001d40000"
	        filename = ""

Region:
	              id = 589
	        start_va = 0x1e40000
	          end_va = 0x1e82fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001e40000"
	        filename = ""

Region:
	              id = 590
	        start_va = 0x1e90000
	          end_va = 0x1e96fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001e90000"
	        filename = ""

Region:
	              id = 591
	        start_va = 0x1f00000
	          end_va = 0x1ffffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001f00000"
	        filename = ""

Region:
	              id = 592
	        start_va = 0x2000000
	          end_va = 0x20fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002000000"
	        filename = ""

Region:
	              id = 593
	        start_va = 0x2100000
	          end_va = 0x21fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002100000"
	        filename = ""

Region:
	              id = 594
	        start_va = 0x2200000
	          end_va = 0x22fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002200000"
	        filename = ""

Region:
	              id = 595
	        start_va = 0x2300000
	          end_va = 0x237ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002300000"
	        filename = ""

Region:
	              id = 596
	        start_va = 0x2380000
	          end_va = 0x2380fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002380000"
	        filename = ""

Region:
	              id = 597
	        start_va = 0x2390000
	          end_va = 0x240ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002390000"
	        filename = ""

Region:
	              id = 598
	        start_va = 0x2440000
	          end_va = 0x2446fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002440000"
	        filename = ""

Region:
	              id = 599
	        start_va = 0x2450000
	          end_va = 0x24cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002450000"
	        filename = ""

Region:
	              id = 600
	        start_va = 0x2500000
	          end_va = 0x25fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002500000"
	        filename = ""

Region:
	              id = 601
	        start_va = 0x2600000
	          end_va = 0x26fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002600000"
	        filename = ""

Region:
	              id = 602
	        start_va = 0x2700000
	          end_va = 0x27fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002700000"
	        filename = ""

Region:
	              id = 603
	        start_va = 0x2800000
	          end_va = 0x28fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002800000"
	        filename = ""

Region:
	              id = 604
	        start_va = 0x2900000
	          end_va = 0x29dffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui")

Region:
	              id = 605
	        start_va = 0x29e0000
	          end_va = 0x2adffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000029e0000"
	        filename = ""

Region:
	              id = 606
	        start_va = 0x2ae0000
	          end_va = 0x2b6dfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db"
	        filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db")

Region:
	              id = 607
	        start_va = 0x2b70000
	          end_va = 0x2beffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002b70000"
	        filename = ""

Region:
	              id = 608
	        start_va = 0x2c60000
	          end_va = 0x2cdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002c60000"
	        filename = ""

Region:
	              id = 609
	        start_va = 0x2d00000
	          end_va = 0x2dfffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d00000"
	        filename = ""

Region:
	              id = 610
	        start_va = 0x2e00000
	          end_va = 0x2efffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002e00000"
	        filename = ""

Region:
	              id = 611
	        start_va = 0x2f00000
	          end_va = 0x2ffffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002f00000"
	        filename = ""

Region:
	              id = 612
	        start_va = 0x3000000
	          end_va = 0x30fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003000000"
	        filename = ""

Region:
	              id = 613
	        start_va = 0x3100000
	          end_va = 0x31fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003100000"
	        filename = ""

Region:
	              id = 614
	        start_va = 0x3200000
	          end_va = 0x32fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003200000"
	        filename = ""

Region:
	              id = 615
	        start_va = 0x3300000
	          end_va = 0x33fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003300000"
	        filename = ""

Region:
	              id = 616
	        start_va = 0x3400000
	          end_va = 0x347ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003400000"
	        filename = ""

Region:
	              id = 617
	        start_va = 0x34b0000
	          end_va = 0x34b6fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000034b0000"
	        filename = ""

Region:
	              id = 618
	        start_va = 0x3500000
	          end_va = 0x35fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003500000"
	        filename = ""

Region:
	              id = 619
	        start_va = 0x3600000
	          end_va = 0x36fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003600000"
	        filename = ""

Region:
	              id = 620
	        start_va = 0x3700000
	          end_va = 0x37fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003700000"
	        filename = ""

Region:
	              id = 621
	        start_va = 0x3800000
	          end_va = 0x38fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003800000"
	        filename = ""

Region:
	              id = 622
	        start_va = 0x3900000
	          end_va = 0x39fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003900000"
	        filename = ""

Region:
	              id = 623
	        start_va = 0x3a00000
	          end_va = 0x3afffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003a00000"
	        filename = ""

Region:
	              id = 624
	        start_va = 0x3b00000
	          end_va = 0x3bfffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003b00000"
	        filename = ""

Region:
	              id = 625
	        start_va = 0x3c00000
	          end_va = 0x3cfffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003c00000"
	        filename = ""

Region:
	              id = 626
	        start_va = 0x3d00000
	          end_va = 0x3d7ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003d00000"
	        filename = ""

Region:
	              id = 627
	        start_va = 0x3d80000
	          end_va = 0x3e7ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003d80000"
	        filename = ""

Region:
	              id = 628
	        start_va = 0x3e80000
	          end_va = 0x3f7ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003e80000"
	        filename = ""

Region:
	              id = 629
	        start_va = 0x3f80000
	          end_va = 0x3ffffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003f80000"
	        filename = ""

Region:
	              id = 630
	        start_va = 0x4010000
	          end_va = 0x4016fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004010000"
	        filename = ""

Region:
	              id = 631
	        start_va = 0x4020000
	          end_va = 0x409ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004020000"
	        filename = ""

Region:
	              id = 632
	        start_va = 0x4100000
	          end_va = 0x41fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004100000"
	        filename = ""

Region:
	              id = 633
	        start_va = 0x4200000
	          end_va = 0x42fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004200000"
	        filename = ""

Region:
	              id = 634
	        start_va = 0x4300000
	          end_va = 0x43fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004300000"
	        filename = ""

Region:
	              id = 635
	        start_va = 0x4400000
	          end_va = 0x44fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004400000"
	        filename = ""

Region:
	              id = 636
	        start_va = 0x4700000
	          end_va = 0x47fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004700000"
	        filename = ""

Region:
	              id = 637
	        start_va = 0x4a80000
	          end_va = 0x4a80fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "msxml6r.dll"
	        filename = "\\Windows\\System32\\msxml6r.dll" (normalized: "c:\\windows\\system32\\msxml6r.dll")

Region:
	              id = 638
	        start_va = 0x4a90000
	          end_va = 0x4b8ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004a90000"
	        filename = ""

Region:
	              id = 639
	        start_va = 0x4c10000
	          end_va = 0x4c11fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000004c10000"
	        filename = ""

Region:
	              id = 640
	        start_va = 0x4c20000
	          end_va = 0x4c26fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004c20000"
	        filename = ""

Region:
	              id = 641
	        start_va = 0x4cb0000
	          end_va = 0x4cb1fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "activeds.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\activeds.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\activeds.dll.mui")

Region:
	              id = 642
	        start_va = 0x4ce0000
	          end_va = 0x4ce4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "winnlsres.dll"
	        filename = "\\Windows\\System32\\winnlsres.dll" (normalized: "c:\\windows\\system32\\winnlsres.dll")

Region:
	              id = 643
	        start_va = 0x4cf0000
	          end_va = 0x4cfffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "winnlsres.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\winnlsres.dll.mui")

Region:
	              id = 644
	        start_va = 0x4d00000
	          end_va = 0x4dfffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004d00000"
	        filename = ""

Region:
	              id = 645
	        start_va = 0x4f00000
	          end_va = 0x4ffffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004f00000"
	        filename = ""

Region:
	              id = 646
	        start_va = 0x5000000
	          end_va = 0x50fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005000000"
	        filename = ""

Region:
	              id = 647
	        start_va = 0x5100000
	          end_va = 0x51fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005100000"
	        filename = ""

Region:
	              id = 648
	        start_va = 0x5200000
	          end_va = 0x52fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005200000"
	        filename = ""

Region:
	              id = 649
	        start_va = 0x5300000
	          end_va = 0x53fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005300000"
	        filename = ""

Region:
	              id = 650
	        start_va = 0x5480000
	          end_va = 0x54fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005480000"
	        filename = ""

Region:
	              id = 651
	        start_va = 0x5580000
	          end_va = 0x55fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005580000"
	        filename = ""

Region:
	              id = 652
	        start_va = 0x5620000
	          end_va = 0x5626fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005620000"
	        filename = ""

Region:
	              id = 653
	        start_va = 0x5630000
	          end_va = 0x572ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005630000"
	        filename = ""

Region:
	              id = 654
	        start_va = 0x57b0000
	          end_va = 0x57c0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "c_1256.nls"
	        filename = "\\Windows\\System32\\C_1256.NLS" (normalized: "c:\\windows\\system32\\c_1256.nls")

Region:
	              id = 655
	        start_va = 0x57d0000
	          end_va = 0x57e0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "c_1251.nls"
	        filename = "\\Windows\\System32\\C_1251.NLS" (normalized: "c:\\windows\\system32\\c_1251.nls")

Region:
	              id = 656
	        start_va = 0x5800000
	          end_va = 0x5806fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005800000"
	        filename = ""

Region:
	              id = 657
	        start_va = 0x5810000
	          end_va = 0x590ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005810000"
	        filename = ""

Region:
	              id = 658
	        start_va = 0x59a0000
	          end_va = 0x59a6fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000059a0000"
	        filename = ""

Region:
	              id = 659
	        start_va = 0x59b0000
	          end_va = 0x5aaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000059b0000"
	        filename = ""

Region:
	              id = 660
	        start_va = 0x5ab0000
	          end_va = 0x5baffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005ab0000"
	        filename = ""

Region:
	              id = 661
	        start_va = 0x5bb0000
	          end_va = 0x5c2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005bb0000"
	        filename = ""

Region:
	              id = 662
	        start_va = 0x5c30000
	          end_va = 0x5d2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005c30000"
	        filename = ""

Region:
	              id = 663
	        start_va = 0x5d30000
	          end_va = 0x5e2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005d30000"
	        filename = ""

Region:
	              id = 664
	        start_va = 0x5e30000
	          end_va = 0x5e40fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "c_1254.nls"
	        filename = "\\Windows\\System32\\C_1254.NLS" (normalized: "c:\\windows\\system32\\c_1254.nls")

Region:
	              id = 665
	        start_va = 0x5e50000
	          end_va = 0x5e60fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "c_1250.nls"
	        filename = "\\Windows\\System32\\C_1250.NLS" (normalized: "c:\\windows\\system32\\c_1250.nls")

Region:
	              id = 666
	        start_va = 0x5e70000
	          end_va = 0x5e76fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005e70000"
	        filename = ""

Region:
	              id = 667
	        start_va = 0x5e80000
	          end_va = 0x5e90fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "c_1253.nls"
	        filename = "\\Windows\\System32\\C_1253.NLS" (normalized: "c:\\windows\\system32\\c_1253.nls")

Region:
	              id = 668
	        start_va = 0x5ea0000
	          end_va = 0x5eb0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "c_1257.nls"
	        filename = "\\Windows\\System32\\C_1257.NLS" (normalized: "c:\\windows\\system32\\c_1257.nls")

Region:
	              id = 669
	        start_va = 0x5ec0000
	          end_va = 0x5ed0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "c_1255.nls"
	        filename = "\\Windows\\System32\\C_1255.NLS" (normalized: "c:\\windows\\system32\\c_1255.nls")

Region:
	              id = 670
	        start_va = 0x5ee0000
	          end_va = 0x5ef0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "c_874.nls"
	        filename = "\\Windows\\System32\\C_874.NLS" (normalized: "c:\\windows\\system32\\c_874.nls")

Region:
	              id = 671
	        start_va = 0x5f00000
	          end_va = 0x5ffffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000005f00000"
	        filename = ""

Region:
	              id = 672
	        start_va = 0x6000000
	          end_va = 0x60fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006000000"
	        filename = ""

Region:
	              id = 673
	        start_va = 0x6100000
	          end_va = 0x61fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006100000"
	        filename = ""

Region:
	              id = 674
	        start_va = 0x6200000
	          end_va = 0x62fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006200000"
	        filename = ""

Region:
	              id = 675
	        start_va = 0x6300000
	          end_va = 0x63fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006300000"
	        filename = ""

Region:
	              id = 676
	        start_va = 0x6400000
	          end_va = 0x64fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006400000"
	        filename = ""

Region:
	              id = 677
	        start_va = 0x6500000
	          end_va = 0x65fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006500000"
	        filename = ""

Region:
	              id = 678
	        start_va = 0x6600000
	          end_va = 0x66fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006600000"
	        filename = ""

Region:
	              id = 679
	        start_va = 0x6700000
	          end_va = 0x67fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006700000"
	        filename = ""

Region:
	              id = 680
	        start_va = 0x6800000
	          end_va = 0x68fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006800000"
	        filename = ""

Region:
	              id = 681
	        start_va = 0x6900000
	          end_va = 0x69fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006900000"
	        filename = ""

Region:
	              id = 682
	        start_va = 0x6a00000
	          end_va = 0x6afffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006a00000"
	        filename = ""

Region:
	              id = 683
	        start_va = 0x6b00000
	          end_va = 0x6bfffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006b00000"
	        filename = ""

Region:
	              id = 684
	        start_va = 0x6c00000
	          end_va = 0x6cfffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006c00000"
	        filename = ""

Region:
	              id = 685
	        start_va = 0x6d00000
	          end_va = 0x6dfffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006d00000"
	        filename = ""

Region:
	              id = 686
	        start_va = 0x6e00000
	          end_va = 0x6efffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006e00000"
	        filename = ""

Region:
	              id = 687
	        start_va = 0x6f00000
	          end_va = 0x6ffffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000006f00000"
	        filename = ""

Region:
	              id = 688
	        start_va = 0x7000000
	          end_va = 0x70fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007000000"
	        filename = ""

Region:
	              id = 689
	        start_va = 0x7100000
	          end_va = 0x7127fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "c_932.nls"
	        filename = "\\Windows\\System32\\C_932.NLS" (normalized: "c:\\windows\\system32\\c_932.nls")

Region:
	              id = 690
	        start_va = 0x7130000
	          end_va = 0x7160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "c_949.nls"
	        filename = "\\Windows\\System32\\C_949.NLS" (normalized: "c:\\windows\\system32\\c_949.nls")

Region:
	              id = 691
	        start_va = 0x7170000
	          end_va = 0x7180fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "c_1258.nls"
	        filename = "\\Windows\\System32\\C_1258.NLS" (normalized: "c:\\windows\\system32\\c_1258.nls")

Region:
	              id = 692
	        start_va = 0x7190000
	          end_va = 0x71c0fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "c_936.nls"
	        filename = "\\Windows\\System32\\C_936.NLS" (normalized: "c:\\windows\\system32\\c_936.nls")

Region:
	              id = 693
	        start_va = 0x71d0000
	          end_va = 0x7200fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "c_950.nls"
	        filename = "\\Windows\\System32\\C_950.NLS" (normalized: "c:\\windows\\system32\\c_950.nls")

Region:
	              id = 694
	        start_va = 0x7300000
	          end_va = 0x73fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007300000"
	        filename = ""

Region:
	              id = 695
	        start_va = 0x7400000
	          end_va = 0x74fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007400000"
	        filename = ""

Region:
	              id = 696
	        start_va = 0x7500000
	          end_va = 0x75fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007500000"
	        filename = ""

Region:
	              id = 697
	        start_va = 0x7800000
	          end_va = 0x78fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007800000"
	        filename = ""

Region:
	              id = 698
	        start_va = 0x7900000
	          end_va = 0x79fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007900000"
	        filename = ""

Region:
	              id = 699
	        start_va = 0x7a20000
	          end_va = 0x7b1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007a20000"
	        filename = ""

Region:
	              id = 700
	        start_va = 0x7b50000
	          end_va = 0x7c4ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007b50000"
	        filename = ""

Region:
	              id = 701
	        start_va = 0x7d00000
	          end_va = 0x7dfffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007d00000"
	        filename = ""

Region:
	              id = 702
	        start_va = 0x7e00000
	          end_va = 0x7efffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007e00000"
	        filename = ""

Region:
	              id = 703
	        start_va = 0x7f00000
	          end_va = 0x7ffffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000007f00000"
	        filename = ""

Region:
	              id = 704
	        start_va = 0x8100000
	          end_va = 0x81fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000008100000"
	        filename = ""

Region:
	              id = 705
	        start_va = 0x8300000
	          end_va = 0x83fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000008300000"
	        filename = ""

Region:
	              id = 706
	        start_va = 0x8400000
	          end_va = 0x84fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000008400000"
	        filename = ""

Region:
	              id = 707
	        start_va = 0x8500000
	          end_va = 0x85fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000008500000"
	        filename = ""

Region:
	              id = 708
	        start_va = 0x8700000
	          end_va = 0x87fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000008700000"
	        filename = ""

Region:
	              id = 709
	        start_va = 0x8800000
	          end_va = 0x88fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000008800000"
	        filename = ""

Region:
	              id = 710
	        start_va = 0x8900000
	          end_va = 0x89fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000008900000"
	        filename = ""

Region:
	              id = 711
	        start_va = 0x8a00000
	          end_va = 0x8afffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000008a00000"
	        filename = ""

Region:
	              id = 712
	        start_va = 0x8b00000
	          end_va = 0x8bfffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000008b00000"
	        filename = ""

Region:
	              id = 713
	        start_va = 0x8c00000
	          end_va = 0x8cfffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000008c00000"
	        filename = ""

Region:
	              id = 714
	        start_va = 0x9700000
	          end_va = 0x97fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000009700000"
	        filename = ""

Region:
	              id = 715
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 716
	        start_va = 0x7df5ffec0000
	          end_va = 0x7df5fffbffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df5ffec0000"
	        filename = ""

Region:
	              id = 717
	        start_va = 0x7df5fffc0000
	          end_va = 0x7df5fffe2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df5fffc0000"
	        filename = ""

Region:
	              id = 718
	        start_va = 0x7df5ffff0000
	          end_va = 0x7ff5fffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df5ffff0000"
	        filename = ""

Region:
	              id = 719
	        start_va = 0x7ff6a3140000
	          end_va = 0x7ff6a314cfff
	       monitored = 0
	     entry_point = 0x7ff6a3143980
	     region_type = mapped_file
	            name = "svchost.exe"
	        filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe")

Region:
	              id = 720
	        start_va = 0x7ff860690000
	          end_va = 0x7ff8606a7fff
	       monitored = 0
	     entry_point = 0x7ff860691b10
	     region_type = mapped_file
	            name = "locationframeworkinternalps.dll"
	        filename = "\\Windows\\System32\\LocationFrameworkInternalPS.dll" (normalized: "c:\\windows\\system32\\locationframeworkinternalps.dll")

Region:
	              id = 721
	        start_va = 0x7ff861600000
	          end_va = 0x7ff861617fff
	       monitored = 0
	     entry_point = 0x7ff861604290
	     region_type = mapped_file
	            name = "elscore.dll"
	        filename = "\\Windows\\System32\\ELSCore.dll" (normalized: "c:\\windows\\system32\\elscore.dll")

Region:
	              id = 722
	        start_va = 0x7ff861f00000
	          end_va = 0x7ff861f51fff
	       monitored = 0
	     entry_point = 0x7ff861f03d30
	     region_type = mapped_file
	            name = "cryptngc.dll"
	        filename = "\\Windows\\System32\\cryptngc.dll" (normalized: "c:\\windows\\system32\\cryptngc.dll")

Region:
	              id = 723
	        start_va = 0x7ff861fb0000
	          end_va = 0x7ff8621affff
	       monitored = 0
	     entry_point = 0x7ff862025240
	     region_type = mapped_file
	            name = "wlidsvc.dll"
	        filename = "\\Windows\\System32\\wlidsvc.dll" (normalized: "c:\\windows\\system32\\wlidsvc.dll")

Region:
	              id = 724
	        start_va = 0x7ff862270000
	          end_va = 0x7ff8622b3fff
	       monitored = 0
	     entry_point = 0x7ff8622983e0
	     region_type = mapped_file
	            name = "updatehandlers.dll"
	        filename = "\\Windows\\System32\\updatehandlers.dll" (normalized: "c:\\windows\\system32\\updatehandlers.dll")

Region:
	              id = 725
	        start_va = 0x7ff8622c0000
	          end_va = 0x7ff8622d7fff
	       monitored = 0
	     entry_point = 0x7ff8622cb850
	     region_type = mapped_file
	            name = "dmcmnutils.dll"
	        filename = "\\Windows\\System32\\dmcmnutils.dll" (normalized: "c:\\windows\\system32\\dmcmnutils.dll")

Region:
	              id = 726
	        start_va = 0x7ff863a70000
	          end_va = 0x7ff863d1ffff
	       monitored = 0
	     entry_point = 0x7ff863a71cf0
	     region_type = mapped_file
	            name = "netshell.dll"
	        filename = "\\Windows\\System32\\netshell.dll" (normalized: "c:\\windows\\system32\\netshell.dll")

Region:
	              id = 727
	        start_va = 0x7ff863de0000
	          end_va = 0x7ff863e3cfff
	       monitored = 0
	     entry_point = 0x7ff863e0e510
	     region_type = mapped_file
	            name = "usocore.dll"
	        filename = "\\Windows\\System32\\usocore.dll" (normalized: "c:\\windows\\system32\\usocore.dll")

Region:
	              id = 728
	        start_va = 0x7ff864170000
	          end_va = 0x7ff86427efff
	       monitored = 0
	     entry_point = 0x7ff8641ac010
	     region_type = mapped_file
	            name = "dosvc.dll"
	        filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll")

Region:
	              id = 729
	        start_va = 0x7ff865880000
	          end_va = 0x7ff86599cfff
	       monitored = 0
	     entry_point = 0x7ff8658afe60
	     region_type = mapped_file
	            name = "qmgr.dll"
	        filename = "\\Windows\\System32\\qmgr.dll" (normalized: "c:\\windows\\system32\\qmgr.dll")

Region:
	              id = 730
	        start_va = 0x7ff865cd0000
	          end_va = 0x7ff865ce6fff
	       monitored = 0
	     entry_point = 0x7ff865cd7520
	     region_type = mapped_file
	            name = "usoapi.dll"
	        filename = "\\Windows\\System32\\usoapi.dll" (normalized: "c:\\windows\\system32\\usoapi.dll")

Region:
	              id = 731
	        start_va = 0x7ff867d30000
	          end_va = 0x7ff867d61fff
	       monitored = 0
	     entry_point = 0x7ff867d3b0c0
	     region_type = mapped_file
	            name = "shacct.dll"
	        filename = "\\Windows\\System32\\shacct.dll" (normalized: "c:\\windows\\system32\\shacct.dll")

Region:
	              id = 732
	        start_va = 0x7ff86ae00000
	          end_va = 0x7ff86ae11fff
	       monitored = 0
	     entry_point = 0x7ff86ae01a80
	     region_type = mapped_file
	            name = "bitsproxy.dll"
	        filename = "\\Windows\\System32\\BitsProxy.dll" (normalized: "c:\\windows\\system32\\bitsproxy.dll")

Region:
	              id = 733
	        start_va = 0x7ff86ae20000
	          end_va = 0x7ff86ae30fff
	       monitored = 0
	     entry_point = 0x7ff86ae228d0
	     region_type = mapped_file
	            name = "credentialmigrationhandler.dll"
	        filename = "\\Windows\\System32\\CredentialMigrationHandler.dll" (normalized: "c:\\windows\\system32\\credentialmigrationhandler.dll")

Region:
	              id = 734
	        start_va = 0x7ff86afa0000
	          end_va = 0x7ff86b006fff
	       monitored = 0
	     entry_point = 0x7ff86afab160
	     region_type = mapped_file
	            name = "upnp.dll"
	        filename = "\\Windows\\System32\\upnp.dll" (normalized: "c:\\windows\\system32\\upnp.dll")

Region:
	              id = 735
	        start_va = 0x7ff86b010000
	          end_va = 0x7ff86b055fff
	       monitored = 0
	     entry_point = 0x7ff86b0179a0
	     region_type = mapped_file
	            name = "adsldp.dll"
	        filename = "\\Windows\\System32\\adsldp.dll" (normalized: "c:\\windows\\system32\\adsldp.dll")

Region:
	              id = 736
	        start_va = 0x7ff86c230000
	          end_va = 0x7ff86c24cfff
	       monitored = 0
	     entry_point = 0x7ff86c234f60
	     region_type = mapped_file
	            name = "appinfo.dll"
	        filename = "\\Windows\\System32\\appinfo.dll" (normalized: "c:\\windows\\system32\\appinfo.dll")

Region:
	              id = 737
	        start_va = 0x7ff86c730000
	          end_va = 0x7ff86c75efff
	       monitored = 0
	     entry_point = 0x7ff86c73ec60
	     region_type = mapped_file
	            name = "cryptnet.dll"
	        filename = "\\Windows\\System32\\cryptnet.dll" (normalized: "c:\\windows\\system32\\cryptnet.dll")

Region:
	              id = 738
	        start_va = 0x7ff86c8b0000
	          end_va = 0x7ff86c8c3fff
	       monitored = 0
	     entry_point = 0x7ff86c8b3710
	     region_type = mapped_file
	            name = "mskeyprotect.dll"
	        filename = "\\Windows\\System32\\mskeyprotect.dll" (normalized: "c:\\windows\\system32\\mskeyprotect.dll")

Region:
	              id = 739
	        start_va = 0x7ff86c8d0000
	          end_va = 0x7ff86c8f7fff
	       monitored = 0
	     entry_point = 0x7ff86c8defc0
	     region_type = mapped_file
	            name = "dssenh.dll"
	        filename = "\\Windows\\System32\\dssenh.dll" (normalized: "c:\\windows\\system32\\dssenh.dll")

Region:
	              id = 740
	        start_va = 0x7ff86c960000
	          end_va = 0x7ff86c97dfff
	       monitored = 0
	     entry_point = 0x7ff86c96ef80
	     region_type = mapped_file
	            name = "ncryptsslp.dll"
	        filename = "\\Windows\\System32\\ncryptsslp.dll" (normalized: "c:\\windows\\system32\\ncryptsslp.dll")

Region:
	              id = 741
	        start_va = 0x7ff86d180000
	          end_va = 0x7ff86d1fffff
	       monitored = 0
	     entry_point = 0x7ff86d1ad280
	     region_type = mapped_file
	            name = "webio.dll"
	        filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll")

Region:
	              id = 742
	        start_va = 0x7ff86d220000
	          end_va = 0x7ff86d233fff
	       monitored = 0
	     entry_point = 0x7ff86d225080
	     region_type = mapped_file
	            name = "windows.staterepositorybroker.dll"
	        filename = "\\Windows\\System32\\Windows.StateRepositoryBroker.dll" (normalized: "c:\\windows\\system32\\windows.staterepositorybroker.dll")

Region:
	              id = 743
	        start_va = 0x7ff86d2d0000
	          end_va = 0x7ff86d305fff
	       monitored = 0
	     entry_point = 0x7ff86d2d27f0
	     region_type = mapped_file
	            name = "windows.networking.hostname.dll"
	        filename = "\\Windows\\System32\\Windows.Networking.HostName.dll" (normalized: "c:\\windows\\system32\\windows.networking.hostname.dll")

Region:
	              id = 744
	        start_va = 0x7ff86d310000
	          end_va = 0x7ff86d325fff
	       monitored = 0
	     entry_point = 0x7ff86d311d50
	     region_type = mapped_file
	            name = "wwapi.dll"
	        filename = "\\Windows\\System32\\wwapi.dll" (normalized: "c:\\windows\\system32\\wwapi.dll")

Region:
	              id = 745
	        start_va = 0x7ff86e3e0000
	          end_va = 0x7ff86e3f0fff
	       monitored = 0
	     entry_point = 0x7ff86e3e7480
	     region_type = mapped_file
	            name = "tetheringclient.dll"
	        filename = "\\Windows\\System32\\tetheringclient.dll" (normalized: "c:\\windows\\system32\\tetheringclient.dll")

Region:
	              id = 746
	        start_va = 0x7ff86e400000
	          end_va = 0x7ff86e483fff
	       monitored = 0
	     entry_point = 0x7ff86e418d50
	     region_type = mapped_file
	            name = "wbemess.dll"
	        filename = "\\Windows\\System32\\wbem\\wbemess.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemess.dll")

Region:
	              id = 747
	        start_va = 0x7ff86e590000
	          end_va = 0x7ff86e5a5fff
	       monitored = 0
	     entry_point = 0x7ff86e5955e0
	     region_type = mapped_file
	            name = "ncobjapi.dll"
	        filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll")

Region:
	              id = 748
	        start_va = 0x7ff86e5b0000
	          end_va = 0x7ff86e685fff
	       monitored = 0
	     entry_point = 0x7ff86e5da800
	     region_type = mapped_file
	            name = "wmiprvsd.dll"
	        filename = "\\Windows\\System32\\wbem\\WmiPrvSD.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprvsd.dll")

Region:
	              id = 749
	        start_va = 0x7ff86e690000
	          end_va = 0x7ff86e6a5fff
	       monitored = 0
	     entry_point = 0x7ff86e691af0
	     region_type = mapped_file
	            name = "napinsp.dll"
	        filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll")

Region:
	              id = 750
	        start_va = 0x7ff86e6b0000
	          end_va = 0x7ff86e6c9fff
	       monitored = 0
	     entry_point = 0x7ff86e6b2330
	     region_type = mapped_file
	            name = "pnrpnsp.dll"
	        filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll")

Region:
	              id = 751
	        start_va = 0x7ff86e6d0000
	          end_va = 0x7ff86e6dcfff
	       monitored = 0
	     entry_point = 0x7ff86e6d1420
	     region_type = mapped_file
	            name = "winrnr.dll"
	        filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll")

Region:
	              id = 752
	        start_va = 0x7ff86e8d0000
	          end_va = 0x7ff86e933fff
	       monitored = 0
	     entry_point = 0x7ff86e8ebed0
	     region_type = mapped_file
	            name = "repdrvfs.dll"
	        filename = "\\Windows\\System32\\wbem\\repdrvfs.dll" (normalized: "c:\\windows\\system32\\wbem\\repdrvfs.dll")

Region:
	              id = 753
	        start_va = 0x7ff86e940000
	          end_va = 0x7ff86e964fff
	       monitored = 0
	     entry_point = 0x7ff86e949900
	     region_type = mapped_file
	            name = "wmiutils.dll"
	        filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll")

Region:
	              id = 754
	        start_va = 0x7ff86e970000
	          end_va = 0x7ff86e983fff
	       monitored = 0
	     entry_point = 0x7ff86e971800
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll")

Region:
	              id = 755
	        start_va = 0x7ff86e990000
	          end_va = 0x7ff86ea85fff
	       monitored = 0
	     entry_point = 0x7ff86e9c9590
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll")

Region:
	              id = 756
	        start_va = 0x7ff86ea90000
	          end_va = 0x7ff86eb03fff
	       monitored = 0
	     entry_point = 0x7ff86eaa5eb0
	     region_type = mapped_file
	            name = "esscli.dll"
	        filename = "\\Windows\\System32\\wbem\\esscli.dll" (normalized: "c:\\windows\\system32\\wbem\\esscli.dll")

Region:
	              id = 757
	        start_va = 0x7ff86eb10000
	          end_va = 0x7ff86ec46fff
	       monitored = 0
	     entry_point = 0x7ff86eb50480
	     region_type = mapped_file
	            name = "wbemcore.dll"
	        filename = "\\Windows\\System32\\wbem\\wbemcore.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemcore.dll")

Region:
	              id = 758
	        start_va = 0x7ff86ef10000
	          end_va = 0x7ff86ef1efff
	       monitored = 0
	     entry_point = 0x7ff86ef14960
	     region_type = mapped_file
	            name = "nci.dll"
	        filename = "\\Windows\\System32\\nci.dll" (normalized: "c:\\windows\\system32\\nci.dll")

Region:
	              id = 759
	        start_va = 0x7ff86efa0000
	          end_va = 0x7ff86efb0fff
	       monitored = 0
	     entry_point = 0x7ff86efa2fc0
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll")

Region:
	              id = 760
	        start_va = 0x7ff86efc0000
	          end_va = 0x7ff86efddfff
	       monitored = 0
	     entry_point = 0x7ff86efc3a40
	     region_type = mapped_file
	            name = "atl.dll"
	        filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll")

Region:
	              id = 761
	        start_va = 0x7ff86efe0000
	          end_va = 0x7ff86f061fff
	       monitored = 0
	     entry_point = 0x7ff86efe2a10
	     region_type = mapped_file
	            name = "hnetcfg.dll"
	        filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll")

Region:
	              id = 762
	        start_va = 0x7ff86f070000
	          end_va = 0x7ff86f077fff
	       monitored = 0
	     entry_point = 0x7ff86f0713b0
	     region_type = mapped_file
	            name = "dmiso8601utils.dll"
	        filename = "\\Windows\\System32\\dmiso8601utils.dll" (normalized: "c:\\windows\\system32\\dmiso8601utils.dll")

Region:
	              id = 763
	        start_va = 0x7ff86f0c0000
	          end_va = 0x7ff86f0fffff
	       monitored = 0
	     entry_point = 0x7ff86f0ccbe0
	     region_type = mapped_file
	            name = "adsldpc.dll"
	        filename = "\\Windows\\System32\\adsldpc.dll" (normalized: "c:\\windows\\system32\\adsldpc.dll")

Region:
	              id = 764
	        start_va = 0x7ff86f100000
	          end_va = 0x7ff86f146fff
	       monitored = 0
	     entry_point = 0x7ff86f101d10
	     region_type = mapped_file
	            name = "activeds.dll"
	        filename = "\\Windows\\System32\\activeds.dll" (normalized: "c:\\windows\\system32\\activeds.dll")

Region:
	              id = 765
	        start_va = 0x7ff86f220000
	          end_va = 0x7ff86f236fff
	       monitored = 0
	     entry_point = 0x7ff86f226620
	     region_type = mapped_file
	            name = "msauserext.dll"
	        filename = "\\Windows\\System32\\msauserext.dll" (normalized: "c:\\windows\\system32\\msauserext.dll")

Region:
	              id = 766
	        start_va = 0x7ff86f240000
	          end_va = 0x7ff86f281fff
	       monitored = 0
	     entry_point = 0x7ff86f243670
	     region_type = mapped_file
	            name = "wdscore.dll"
	        filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll")

Region:
	              id = 767
	        start_va = 0x7ff86f390000
	          end_va = 0x7ff86f3aefff
	       monitored = 0
	     entry_point = 0x7ff86f3937e0
	     region_type = mapped_file
	            name = "netsetupapi.dll"
	        filename = "\\Windows\\System32\\NetSetupApi.dll" (normalized: "c:\\windows\\system32\\netsetupapi.dll")

Region:
	              id = 768
	        start_va = 0x7ff86f3b0000
	          end_va = 0x7ff86f428fff
	       monitored = 0
	     entry_point = 0x7ff86f3b76a0
	     region_type = mapped_file
	            name = "netsetupshim.dll"
	        filename = "\\Windows\\System32\\NetSetupShim.dll" (normalized: "c:\\windows\\system32\\netsetupshim.dll")

Region:
	              id = 769
	        start_va = 0x7ff86f4a0000
	          end_va = 0x7ff86f542fff
	       monitored = 0
	     entry_point = 0x7ff86f4a2c10
	     region_type = mapped_file
	            name = "clusapi.dll"
	        filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll")

Region:
	              id = 770
	        start_va = 0x7ff86f550000
	          end_va = 0x7ff86f5a1fff
	       monitored = 0
	     entry_point = 0x7ff86f555770
	     region_type = mapped_file
	            name = "resutils.dll"
	        filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll")

Region:
	              id = 771
	        start_va = 0x7ff86f5b0000
	          end_va = 0x7ff86f5ddfff
	       monitored = 1
	     entry_point = 0x7ff86f5b2300
	     region_type = mapped_file
	            name = "wmidcom.dll"
	        filename = "\\Windows\\System32\\wmidcom.dll" (normalized: "c:\\windows\\system32\\wmidcom.dll")

Region:
	              id = 772
	        start_va = 0x7ff86f5e0000
	          end_va = 0x7ff86f63dfff
	       monitored = 0
	     entry_point = 0x7ff86f5e5080
	     region_type = mapped_file
	            name = "miutils.dll"
	        filename = "\\Windows\\System32\\miutils.dll" (normalized: "c:\\windows\\system32\\miutils.dll")

Region:
	              id = 773
	        start_va = 0x7ff86f640000
	          end_va = 0x7ff86f65ffff
	       monitored = 0
	     entry_point = 0x7ff86f641f50
	     region_type = mapped_file
	            name = "mi.dll"
	        filename = "\\Windows\\System32\\mi.dll" (normalized: "c:\\windows\\system32\\mi.dll")

Region:
	              id = 774
	        start_va = 0x7ff86f660000
	          end_va = 0x7ff86f668fff
	       monitored = 0
	     entry_point = 0x7ff86f6618f0
	     region_type = mapped_file
	            name = "sscoreext.dll"
	        filename = "\\Windows\\System32\\sscoreext.dll" (normalized: "c:\\windows\\system32\\sscoreext.dll")

Region:
	              id = 775
	        start_va = 0x7ff86f670000
	          end_va = 0x7ff86f680fff
	       monitored = 0
	     entry_point = 0x7ff86f671d30
	     region_type = mapped_file
	            name = "sscore.dll"
	        filename = "\\Windows\\System32\\sscore.dll" (normalized: "c:\\windows\\system32\\sscore.dll")

Region:
	              id = 776
	        start_va = 0x7ff86f6a0000
	          end_va = 0x7ff86f6b7fff
	       monitored = 0
	     entry_point = 0x7ff86f6a4e10
	     region_type = mapped_file
	            name = "adhsvc.dll"
	        filename = "\\Windows\\System32\\adhsvc.dll" (normalized: "c:\\windows\\system32\\adhsvc.dll")

Region:
	              id = 777
	        start_va = 0x7ff86f6c0000
	          end_va = 0x7ff86f6e4fff
	       monitored = 0
	     entry_point = 0x7ff86f6c5ca0
	     region_type = mapped_file
	            name = "httpprxm.dll"
	        filename = "\\Windows\\System32\\httpprxm.dll" (normalized: "c:\\windows\\system32\\httpprxm.dll")

Region:
	              id = 778
	        start_va = 0x7ff870370000
	          end_va = 0x7ff8703b0fff
	       monitored = 0
	     entry_point = 0x7ff870373750
	     region_type = mapped_file
	            name = "sqmapi.dll"
	        filename = "\\Windows\\System32\\sqmapi.dll" (normalized: "c:\\windows\\system32\\sqmapi.dll")

Region:
	              id = 779
	        start_va = 0x7ff8703c0000
	          end_va = 0x7ff8704b2fff
	       monitored = 0
	     entry_point = 0x7ff8703e5d80
	     region_type = mapped_file
	            name = "iphlpsvc.dll"
	        filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll")

Region:
	              id = 780
	        start_va = 0x7ff8704c0000
	          end_va = 0x7ff87050bfff
	       monitored = 0
	     entry_point = 0x7ff8704d5310
	     region_type = mapped_file
	            name = "srvsvc.dll"
	        filename = "\\Windows\\System32\\srvsvc.dll" (normalized: "c:\\windows\\system32\\srvsvc.dll")

Region:
	              id = 781
	        start_va = 0x7ff870690000
	          end_va = 0x7ff8706a7fff
	       monitored = 0
	     entry_point = 0x7ff870692000
	     region_type = mapped_file
	            name = "vsstrace.dll"
	        filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll")

Region:
	              id = 782
	        start_va = 0x7ff8706b0000
	          end_va = 0x7ff870831fff
	       monitored = 0
	     entry_point = 0x7ff8706c82a0
	     region_type = mapped_file
	            name = "vssapi.dll"
	        filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll")

Region:
	              id = 783
	        start_va = 0x7ff870c70000
	          end_va = 0x7ff870ceefff
	       monitored = 0
	     entry_point = 0x7ff870c87110
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll")

Region:
	              id = 784
	        start_va = 0x7ff870cf0000
	          end_va = 0x7ff870d2bfff
	       monitored = 0
	     entry_point = 0x7ff870cf6aa0
	     region_type = mapped_file
	            name = "wmisvc.dll"
	        filename = "\\Windows\\System32\\wbem\\WMIsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wmisvc.dll")

Region:
	              id = 785
	        start_va = 0x7ff870d80000
	          end_va = 0x7ff870d89fff
	       monitored = 0
	     entry_point = 0x7ff870d81350
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll")

Region:
	              id = 786
	        start_va = 0x7ff870dc0000
	          end_va = 0x7ff870dcbfff
	       monitored = 0
	     entry_point = 0x7ff870dc35c0
	     region_type = mapped_file
	            name = "secur32.dll"
	        filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll")

Region:
	              id = 787
	        start_va = 0x7ff872410000
	          end_va = 0x7ff872418fff
	       monitored = 0
	     entry_point = 0x7ff8724121d0
	     region_type = mapped_file
	            name = "httpprxc.dll"
	        filename = "\\Windows\\System32\\httpprxc.dll" (normalized: "c:\\windows\\system32\\httpprxc.dll")

Region:
	              id = 788
	        start_va = 0x7ff872420000
	          end_va = 0x7ff872454fff
	       monitored = 0
	     entry_point = 0x7ff87242a270
	     region_type = mapped_file
	            name = "fwpolicyiomgr.dll"
	        filename = "\\Windows\\System32\\fwpolicyiomgr.dll" (normalized: "c:\\windows\\system32\\fwpolicyiomgr.dll")

Region:
	              id = 789
	        start_va = 0x7ff872540000
	          end_va = 0x7ff8727b9fff
	       monitored = 0
	     entry_point = 0x7ff87255a7a0
	     region_type = mapped_file
	            name = "msxml6.dll"
	        filename = "\\Windows\\System32\\msxml6.dll" (normalized: "c:\\windows\\system32\\msxml6.dll")

Region:
	              id = 790
	        start_va = 0x7ff8727c0000
	          end_va = 0x7ff8727fffff
	       monitored = 0
	     entry_point = 0x7ff8727d6c60
	     region_type = mapped_file
	            name = "netprofm.dll"
	        filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll")

Region:
	              id = 791
	        start_va = 0x7ff872a10000
	          end_va = 0x7ff872a1ffff
	       monitored = 0
	     entry_point = 0x7ff872a11690
	     region_type = mapped_file
	            name = "wups.dll"
	        filename = "\\Windows\\System32\\wups.dll" (normalized: "c:\\windows\\system32\\wups.dll")

Region:
	              id = 792
	        start_va = 0x7ff872a20000
	          end_va = 0x7ff872a32fff
	       monitored = 0
	     entry_point = 0x7ff872a21b10
	     region_type = mapped_file
	            name = "devrtl.dll"
	        filename = "\\Windows\\System32\\devrtl.dll" (normalized: "c:\\windows\\system32\\devrtl.dll")

Region:
	              id = 793
	        start_va = 0x7ff872a40000
	          end_va = 0x7ff872ac1fff
	       monitored = 0
	     entry_point = 0x7ff872a41790
	     region_type = mapped_file
	            name = "newdev.dll"
	        filename = "\\Windows\\System32\\newdev.dll" (normalized: "c:\\windows\\system32\\newdev.dll")

Region:
	              id = 794
	        start_va = 0x7ff872ad0000
	          end_va = 0x7ff872e09fff
	       monitored = 0
	     entry_point = 0x7ff872ad8520
	     region_type = mapped_file
	            name = "msi.dll"
	        filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll")

Region:
	              id = 795
	        start_va = 0x7ff872e10000
	          end_va = 0x7ff872e93fff
	       monitored = 0
	     entry_point = 0x7ff872e22830
	     region_type = mapped_file
	            name = "winspool.drv"
	        filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv")

Region:
	              id = 796
	        start_va = 0x7ff872ea0000
	          end_va = 0x7ff872f04fff
	       monitored = 0
	     entry_point = 0x7ff872eb3170
	     region_type = mapped_file
	            name = "wuuhext.dll"
	        filename = "\\Windows\\System32\\wuuhext.dll" (normalized: "c:\\windows\\system32\\wuuhext.dll")

Region:
	              id = 797
	        start_va = 0x7ff872f10000
	          end_va = 0x7ff873208fff
	       monitored = 0
	     entry_point = 0x7ff872fd7280
	     region_type = mapped_file
	            name = "esent.dll"
	        filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll")

Region:
	              id = 798
	        start_va = 0x7ff873210000
	          end_va = 0x7ff873445fff
	       monitored = 0
	     entry_point = 0x7ff87329a450
	     region_type = mapped_file
	            name = "wuaueng.dll"
	        filename = "\\Windows\\System32\\wuaueng.dll" (normalized: "c:\\windows\\system32\\wuaueng.dll")

Region:
	              id = 799
	        start_va = 0x7ff873450000
	          end_va = 0x7ff873471fff
	       monitored = 0
	     entry_point = 0x7ff873462540
	     region_type = mapped_file
	            name = "updatepolicy.dll"
	        filename = "\\Windows\\System32\\updatepolicy.dll" (normalized: "c:\\windows\\system32\\updatepolicy.dll")

Region:
	              id = 800
	        start_va = 0x7ff873480000
	          end_va = 0x7ff873554fff
	       monitored = 0
	     entry_point = 0x7ff87349cf80
	     region_type = mapped_file
	            name = "wuapi.dll"
	        filename = "\\Windows\\System32\\wuapi.dll" (normalized: "c:\\windows\\system32\\wuapi.dll")

Region:
	              id = 801
	        start_va = 0x7ff873620000
	          end_va = 0x7ff8736b3fff
	       monitored = 0
	     entry_point = 0x7ff873659210
	     region_type = mapped_file
	            name = "staterepository.core.dll"
	        filename = "\\Windows\\System32\\StateRepository.Core.dll" (normalized: "c:\\windows\\system32\\staterepository.core.dll")

Region:
	              id = 802
	        start_va = 0x7ff8736c0000
	          end_va = 0x7ff873962fff
	       monitored = 0
	     entry_point = 0x7ff8736e6190
	     region_type = mapped_file
	            name = "windows.staterepository.dll"
	        filename = "\\Windows\\System32\\Windows.StateRepository.dll" (normalized: "c:\\windows\\system32\\windows.staterepository.dll")

Region:
	              id = 803
	        start_va = 0x7ff873970000
	          end_va = 0x7ff873985fff
	       monitored = 0
	     entry_point = 0x7ff87397b550
	     region_type = mapped_file
	            name = "clipc.dll"
	        filename = "\\Windows\\System32\\Clipc.dll" (normalized: "c:\\windows\\system32\\clipc.dll")

Region:
	              id = 804
	        start_va = 0x7ff8744b0000
	          end_va = 0x7ff8744c1fff
	       monitored = 0
	     entry_point = 0x7ff8744b3580
	     region_type = mapped_file
	            name = "cscapi.dll"
	        filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll")

Region:
	              id = 805
	        start_va = 0x7ff874540000
	          end_va = 0x7ff87455afff
	       monitored = 0
	     entry_point = 0x7ff874541040
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll")

Region:
	              id = 806
	        start_va = 0x7ff874830000
	          end_va = 0x7ff874839fff
	       monitored = 0
	     entry_point = 0x7ff8748314c0
	     region_type = mapped_file
	            name = "rasadhlp.dll"
	        filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll")

Region:
	              id = 807
	        start_va = 0x7ff874a90000
	          end_va = 0x7ff874a9dfff
	       monitored = 0
	     entry_point = 0x7ff874a91460
	     region_type = mapped_file
	            name = "npmproxy.dll"
	        filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll")

Region:
	              id = 808
	        start_va = 0x7ff874aa0000
	          end_va = 0x7ff874aaffff
	       monitored = 0
	     entry_point = 0x7ff874aa1700
	     region_type = mapped_file
	            name = "proximityservicepal.dll"
	        filename = "\\Windows\\System32\\ProximityServicePal.dll" (normalized: "c:\\windows\\system32\\proximityservicepal.dll")

Region:
	              id = 809
	        start_va = 0x7ff874ab0000
	          end_va = 0x7ff874ac4fff
	       monitored = 0
	     entry_point = 0x7ff874ab2dc0
	     region_type = mapped_file
	            name = "ondemandconnroutehelper.dll"
	        filename = "\\Windows\\System32\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\system32\\ondemandconnroutehelper.dll")

Region:
	              id = 810
	        start_va = 0x7ff874ad0000
	          end_va = 0x7ff874ad8fff
	       monitored = 0
	     entry_point = 0x7ff874ad1ed0
	     region_type = mapped_file
	            name = "proximitycommonpal.dll"
	        filename = "\\Windows\\System32\\ProximityCommonPal.dll" (normalized: "c:\\windows\\system32\\proximitycommonpal.dll")

Region:
	              id = 811
	        start_va = 0x7ff874ae0000
	          end_va = 0x7ff874b0cfff
	       monitored = 0
	     entry_point = 0x7ff874ae2290
	     region_type = mapped_file
	            name = "proximitycommon.dll"
	        filename = "\\Windows\\System32\\ProximityCommon.dll" (normalized: "c:\\windows\\system32\\proximitycommon.dll")

Region:
	              id = 812
	        start_va = 0x7ff874b10000
	          end_va = 0x7ff874b61fff
	       monitored = 0
	     entry_point = 0x7ff874b138e0
	     region_type = mapped_file
	            name = "proximityservice.dll"
	        filename = "\\Windows\\System32\\ProximityService.dll" (normalized: "c:\\windows\\system32\\proximityservice.dll")

Region:
	              id = 813
	        start_va = 0x7ff874d60000
	          end_va = 0x7ff874d74fff
	       monitored = 0
	     entry_point = 0x7ff874d63460
	     region_type = mapped_file
	            name = "ssdpapi.dll"
	        filename = "\\Windows\\System32\\ssdpapi.dll" (normalized: "c:\\windows\\system32\\ssdpapi.dll")

Region:
	              id = 814
	        start_va = 0x7ff874e50000
	          end_va = 0x7ff874f0ffff
	       monitored = 0
	     entry_point = 0x7ff874e7fd20
	     region_type = mapped_file
	            name = "fveapi.dll"
	        filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll")

Region:
	              id = 815
	        start_va = 0x7ff874f10000
	          end_va = 0x7ff874fa9fff
	       monitored = 0
	     entry_point = 0x7ff874f2ada0
	     region_type = mapped_file
	            name = "shsvcs.dll"
	        filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll")

Region:
	              id = 816
	        start_va = 0x7ff874fc0000
	          end_va = 0x7ff875026fff
	       monitored = 0
	     entry_point = 0x7ff874fc63e0
	     region_type = mapped_file
	            name = "fwpuclnt.dll"
	        filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll")

Region:
	              id = 817
	        start_va = 0x7ff875080000
	          end_va = 0x7ff8750c0fff
	       monitored = 0
	     entry_point = 0x7ff875084840
	     region_type = mapped_file
	            name = "usermgrproxy.dll"
	        filename = "\\Windows\\System32\\UserMgrProxy.dll" (normalized: "c:\\windows\\system32\\usermgrproxy.dll")

Region:
	              id = 818
	        start_va = 0x7ff8750d0000
	          end_va = 0x7ff8750dafff
	       monitored = 0
	     entry_point = 0x7ff8750d1d30
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll")

Region:
	              id = 819
	        start_va = 0x7ff875200000
	          end_va = 0x7ff87522dfff
	       monitored = 0
	     entry_point = 0x7ff875207550
	     region_type = mapped_file
	            name = "netjoin.dll"
	        filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll")

Region:
	              id = 820
	        start_va = 0x7ff875230000
	          end_va = 0x7ff875245fff
	       monitored = 0
	     entry_point = 0x7ff875231b60
	     region_type = mapped_file
	            name = "wkscli.dll"
	        filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll")

Region:
	              id = 821
	        start_va = 0x7ff875250000
	          end_va = 0x7ff875269fff
	       monitored = 0
	     entry_point = 0x7ff875252430
	     region_type = mapped_file
	            name = "dhcpcsvc.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll")

Region:
	              id = 822
	        start_va = 0x7ff875270000
	          end_va = 0x7ff875285fff
	       monitored = 0
	     entry_point = 0x7ff8752719f0
	     region_type = mapped_file
	            name = "dhcpcsvc6.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll")

Region:
	              id = 823
	        start_va = 0x7ff875290000
	          end_va = 0x7ff87529cfff
	       monitored = 0
	     entry_point = 0x7ff875292ca0
	     region_type = mapped_file
	            name = "csystemeventsbrokerclient.dll"
	        filename = "\\Windows\\System32\\CSystemEventsBrokerClient.dll" (normalized: "c:\\windows\\system32\\csystemeventsbrokerclient.dll")

Region:
	              id = 824
	        start_va = 0x7ff8752a0000
	          end_va = 0x7ff8752cefff
	       monitored = 0
	     entry_point = 0x7ff8752a8910
	     region_type = mapped_file
	            name = "wptaskscheduler.dll"
	        filename = "\\Windows\\System32\\WPTaskScheduler.dll" (normalized: "c:\\windows\\system32\\wptaskscheduler.dll")

Region:
	              id = 825
	        start_va = 0x7ff875320000
	          end_va = 0x7ff875405fff
	       monitored = 0
	     entry_point = 0x7ff87533cf10
	     region_type = mapped_file
	            name = "usermgr.dll"
	        filename = "\\Windows\\System32\\usermgr.dll" (normalized: "c:\\windows\\system32\\usermgr.dll")

Region:
	              id = 826
	        start_va = 0x7ff875480000
	          end_va = 0x7ff8754b7fff
	       monitored = 0
	     entry_point = 0x7ff875498cc0
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll")

Region:
	              id = 827
	        start_va = 0x7ff875560000
	          end_va = 0x7ff875573fff
	       monitored = 0
	     entry_point = 0x7ff875562d50
	     region_type = mapped_file
	            name = "rtutils.dll"
	        filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll")

Region:
	              id = 828
	        start_va = 0x7ff875860000
	          end_va = 0x7ff8758f2fff
	       monitored = 0
	     entry_point = 0x7ff875869680
	     region_type = mapped_file
	            name = "msvcp_win.dll"
	        filename = "\\Windows\\System32\\msvcp_win.dll" (normalized: "c:\\windows\\system32\\msvcp_win.dll")

Region:
	              id = 829
	        start_va = 0x7ff875a10000
	          end_va = 0x7ff875a28fff
	       monitored = 0
	     entry_point = 0x7ff875a14520
	     region_type = mapped_file
	            name = "samcli.dll"
	        filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll")

Region:
	              id = 830
	        start_va = 0x7ff875b40000
	          end_va = 0x7ff875b4ffff
	       monitored = 0
	     entry_point = 0x7ff875b42c60
	     region_type = mapped_file
	            name = "usermgrcli.dll"
	        filename = "\\Windows\\System32\\usermgrcli.dll" (normalized: "c:\\windows\\system32\\usermgrcli.dll")

Region:
	              id = 831
	        start_va = 0x7ff875c60000
	          end_va = 0x7ff875ccdfff
	       monitored = 0
	     entry_point = 0x7ff875c67f60
	     region_type = mapped_file
	            name = "taskcomp.dll"
	        filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll")

Region:
	              id = 832
	        start_va = 0x7ff875ce0000
	          end_va = 0x7ff875cfefff
	       monitored = 0
	     entry_point = 0x7ff875ce4960
	     region_type = mapped_file
	            name = "ncprov.dll"
	        filename = "\\Windows\\System32\\wbem\\NCProv.dll" (normalized: "c:\\windows\\system32\\wbem\\ncprov.dll")

Region:
	              id = 833
	        start_va = 0x7ff875d00000
	          end_va = 0x7ff875d13fff
	       monitored = 0
	     entry_point = 0x7ff875d02a00
	     region_type = mapped_file
	            name = "bitsigd.dll"
	        filename = "\\Windows\\System32\\bitsigd.dll" (normalized: "c:\\windows\\system32\\bitsigd.dll")

Region:
	              id = 834
	        start_va = 0x7ff875d20000
	          end_va = 0x7ff875d30fff
	       monitored = 0
	     entry_point = 0x7ff875d23320
	     region_type = mapped_file
	            name = "wmiclnt.dll"
	        filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll")

Region:
	              id = 835
	        start_va = 0x7ff875d40000
	          end_va = 0x7ff875d80fff
	       monitored = 0
	     entry_point = 0x7ff875d57eb0
	     region_type = mapped_file
	            name = "ubpm.dll"
	        filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll")

Region:
	              id = 836
	        start_va = 0x7ff875d90000
	          end_va = 0x7ff875e8bfff
	       monitored = 0
	     entry_point = 0x7ff875dc6df0
	     region_type = mapped_file
	            name = "schedsvc.dll"
	        filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll")

Region:
	              id = 837
	        start_va = 0x7ff8764e0000
	          end_va = 0x7ff876861fff
	       monitored = 0
	     entry_point = 0x7ff876531220
	     region_type = mapped_file
	            name = "iertutil.dll"
	        filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll")

Region:
	              id = 838
	        start_va = 0x7ff876870000
	          end_va = 0x7ff8769a5fff
	       monitored = 0
	     entry_point = 0x7ff87689f350
	     region_type = mapped_file
	            name = "wintypes.dll"
	        filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll")

Region:
	              id = 839
	        start_va = 0x7ff8779f0000
	          end_va = 0x7ff877a98fff
	       monitored = 0
	     entry_point = 0x7ff877a19010
	     region_type = mapped_file
	            name = "windows.ui.dll"
	        filename = "\\Windows\\System32\\Windows.UI.dll" (normalized: "c:\\windows\\system32\\windows.ui.dll")

Region:
	              id = 840
	        start_va = 0x7ff877aa0000
	          end_va = 0x7ff877badfff
	       monitored = 0
	     entry_point = 0x7ff877aeeaa0
	     region_type = mapped_file
	            name = "mrmcorer.dll"
	        filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll")

Region:
	              id = 841
	        start_va = 0x7ff878150000
	          end_va = 0x7ff87815bfff
	       monitored = 0
	     entry_point = 0x7ff878152830
	     region_type = mapped_file
	            name = "bi.dll"
	        filename = "\\Windows\\System32\\bi.dll" (normalized: "c:\\windows\\system32\\bi.dll")

Region:
	              id = 842
	        start_va = 0x7ff878230000
	          end_va = 0x7ff8782eefff
	       monitored = 0
	     entry_point = 0x7ff878251c50
	     region_type = mapped_file
	            name = "taskschd.dll"
	        filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll")

Region:
	              id = 843
	        start_va = 0x7ff878310000
	          end_va = 0x7ff878326fff
	       monitored = 0
	     entry_point = 0x7ff878315630
	     region_type = mapped_file
	            name = "sens.dll"
	        filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll")

Region:
	              id = 844
	        start_va = 0x7ff878330000
	          end_va = 0x7ff8783ddfff
	       monitored = 0
	     entry_point = 0x7ff8783480c0
	     region_type = mapped_file
	            name = "windows.networking.connectivity.dll"
	        filename = "\\Windows\\System32\\Windows.Networking.Connectivity.dll" (normalized: "c:\\windows\\system32\\windows.networking.connectivity.dll")

Region:
	              id = 845
	        start_va = 0x7ff8783e0000
	          end_va = 0x7ff8783f1fff
	       monitored = 0
	     entry_point = 0x7ff8783e9260
	     region_type = mapped_file
	            name = "rilproxy.dll"
	        filename = "\\Windows\\System32\\rilproxy.dll" (normalized: "c:\\windows\\system32\\rilproxy.dll")

Region:
	              id = 846
	        start_va = 0x7ff878400000
	          end_va = 0x7ff8784b0fff
	       monitored = 0
	     entry_point = 0x7ff8784788b0
	     region_type = mapped_file
	            name = "cellularapi.dll"
	        filename = "\\Windows\\System32\\CellularAPI.dll" (normalized: "c:\\windows\\system32\\cellularapi.dll")

Region:
	              id = 847
	        start_va = 0x7ff8784c0000
	          end_va = 0x7ff8784e4fff
	       monitored = 0
	     entry_point = 0x7ff8784d2f20
	     region_type = mapped_file
	            name = "wificonnapi.dll"
	        filename = "\\Windows\\System32\\wificonnapi.dll" (normalized: "c:\\windows\\system32\\wificonnapi.dll")

Region:
	              id = 848
	        start_va = 0x7ff8784f0000
	          end_va = 0x7ff878500fff
	       monitored = 0
	     entry_point = 0x7ff8784f7ea0
	     region_type = mapped_file
	            name = "dcpapi.dll"
	        filename = "\\Windows\\System32\\dcpapi.dll" (normalized: "c:\\windows\\system32\\dcpapi.dll")

Region:
	              id = 849
	        start_va = 0x7ff878510000
	          end_va = 0x7ff87854dfff
	       monitored = 0
	     entry_point = 0x7ff87851a050
	     region_type = mapped_file
	            name = "logoncli.dll"
	        filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll")

Region:
	              id = 850
	        start_va = 0x7ff878550000
	          end_va = 0x7ff878576fff
	       monitored = 0
	     entry_point = 0x7ff878553bf0
	     region_type = mapped_file
	            name = "profsvcext.dll"
	        filename = "\\Windows\\System32\\profsvcext.dll" (normalized: "c:\\windows\\system32\\profsvcext.dll")

Region:
	              id = 851
	        start_va = 0x7ff878580000
	          end_va = 0x7ff8785f9fff
	       monitored = 0
	     entry_point = 0x7ff8785a7630
	     region_type = mapped_file
	            name = "es.dll"
	        filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll")

Region:
	              id = 852
	        start_va = 0x7ff878600000
	          end_va = 0x7ff878612fff
	       monitored = 0
	     entry_point = 0x7ff8786057f0
	     region_type = mapped_file
	            name = "themeservice.dll"
	        filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll")

Region:
	              id = 853
	        start_va = 0x7ff878620000
	          end_va = 0x7ff878639fff
	       monitored = 0
	     entry_point = 0x7ff878622cf0
	     region_type = mapped_file
	            name = "locationpelegacywinlocation.dll"
	        filename = "\\Windows\\System32\\LocationPeLegacyWinLocation.dll" (normalized: "c:\\windows\\system32\\locationpelegacywinlocation.dll")

Region:
	              id = 854
	        start_va = 0x7ff878640000
	          end_va = 0x7ff878694fff
	       monitored = 0
	     entry_point = 0x7ff87864fc00
	     region_type = mapped_file
	            name = "profsvc.dll"
	        filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll")

Region:
	              id = 855
	        start_va = 0x7ff8786a0000
	          end_va = 0x7ff8786a9fff
	       monitored = 0
	     entry_point = 0x7ff8786a1660
	     region_type = mapped_file
	            name = "dsrole.dll"
	        filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll")

Region:
	              id = 856
	        start_va = 0x7ff8786b0000
	          end_va = 0x7ff8786c7fff
	       monitored = 0
	     entry_point = 0x7ff8786b5910
	     region_type = mapped_file
	            name = "nlaapi.dll"
	        filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll")

Region:
	              id = 857
	        start_va = 0x7ff8786d0000
	          end_va = 0x7ff87881cfff
	       monitored = 0
	     entry_point = 0x7ff878713da0
	     region_type = mapped_file
	            name = "gpsvc.dll"
	        filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll")

Region:
	              id = 858
	        start_va = 0x7ff878820000
	          end_va = 0x7ff87882bfff
	       monitored = 0
	     entry_point = 0x7ff8788214d0
	     region_type = mapped_file
	            name = "locationframeworkps.dll"
	        filename = "\\Windows\\System32\\LocationFrameworkPS.dll" (normalized: "c:\\windows\\system32\\locationframeworkps.dll")

Region:
	              id = 859
	        start_va = 0x7ff878830000
	          end_va = 0x7ff878884fff
	       monitored = 0
	     entry_point = 0x7ff878833fb0
	     region_type = mapped_file
	            name = "policymanager.dll"
	        filename = "\\Windows\\System32\\policymanager.dll" (normalized: "c:\\windows\\system32\\policymanager.dll")

Region:
	              id = 860
	        start_va = 0x7ff878890000
	          end_va = 0x7ff8788c6fff
	       monitored = 0
	     entry_point = 0x7ff878896020
	     region_type = mapped_file
	            name = "gnssadapter.dll"
	        filename = "\\Windows\\System32\\GnssAdapter.dll" (normalized: "c:\\windows\\system32\\gnssadapter.dll")

Region:
	              id = 861
	        start_va = 0x7ff8788d0000
	          end_va = 0x7ff8788effff
	       monitored = 0
	     entry_point = 0x7ff8788d39a0
	     region_type = mapped_file
	            name = "locationwinpalmisc.dll"
	        filename = "\\Windows\\System32\\LocationWinPalMisc.dll" (normalized: "c:\\windows\\system32\\locationwinpalmisc.dll")

Region:
	              id = 862
	        start_va = 0x7ff8788f0000
	          end_va = 0x7ff878953fff
	       monitored = 0
	     entry_point = 0x7ff878905ae0
	     region_type = mapped_file
	            name = "wevtapi.dll"
	        filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll")

Region:
	              id = 863
	        start_va = 0x7ff878b20000
	          end_va = 0x7ff878be7fff
	       monitored = 0
	     entry_point = 0x7ff878b613f0
	     region_type = mapped_file
	            name = "winhttp.dll"
	        filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll")

Region:
	              id = 864
	        start_va = 0x7ff878bf0000
	          end_va = 0x7ff878c50fff
	       monitored = 0
	     entry_point = 0x7ff878bf4b50
	     region_type = mapped_file
	            name = "wlanapi.dll"
	        filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll")

Region:
	              id = 865
	        start_va = 0x7ff878c60000
	          end_va = 0x7ff878ddbfff
	       monitored = 0
	     entry_point = 0x7ff878cb1650
	     region_type = mapped_file
	            name = "locationframework.dll"
	        filename = "\\Windows\\System32\\LocationFramework.dll" (normalized: "c:\\windows\\system32\\locationframework.dll")

Region:
	              id = 866
	        start_va = 0x7ff878de0000
	          end_va = 0x7ff878deafff
	       monitored = 0
	     entry_point = 0x7ff878de1770
	     region_type = mapped_file
	            name = "lfsvc.dll"
	        filename = "\\Windows\\System32\\lfsvc.dll" (normalized: "c:\\windows\\system32\\lfsvc.dll")

Region:
	              id = 867
	        start_va = 0x7ff878e80000
	          end_va = 0x7ff878f11fff
	       monitored = 0
	     entry_point = 0x7ff878eca780
	     region_type = mapped_file
	            name = "msvcp110_win.dll"
	        filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll")

Region:
	              id = 868
	        start_va = 0x7ff878fc0000
	          end_va = 0x7ff878fe8fff
	       monitored = 0
	     entry_point = 0x7ff878fcca00
	     region_type = mapped_file
	            name = "cabinet.dll"
	        filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll")

Region:
	              id = 869
	        start_va = 0x7ff878ff0000
	          end_va = 0x7ff879025fff
	       monitored = 0
	     entry_point = 0x7ff879000070
	     region_type = mapped_file
	            name = "xmllite.dll"
	        filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll")

Region:
	              id = 870
	        start_va = 0x7ff879c20000
	          end_va = 0x7ff879c2afff
	       monitored = 0
	     entry_point = 0x7ff879c21de0
	     region_type = mapped_file
	            name = "bitsperf.dll"
	        filename = "\\Windows\\System32\\bitsperf.dll" (normalized: "c:\\windows\\system32\\bitsperf.dll")

Region:
	              id = 871
	        start_va = 0x7ff879c90000
	          end_va = 0x7ff87a122fff
	       monitored = 0
	     entry_point = 0x7ff879c9f760
	     region_type = mapped_file
	            name = "actxprxy.dll"
	        filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll")

Region:
	              id = 872
	        start_va = 0x7ff87a130000
	          end_va = 0x7ff87a196fff
	       monitored = 0
	     entry_point = 0x7ff87a14e710
	     region_type = mapped_file
	            name = "bcp47langs.dll"
	        filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll")

Region:
	              id = 873
	        start_va = 0x7ff87a1f0000
	          end_va = 0x7ff87a1f7fff
	       monitored = 0
	     entry_point = 0x7ff87a1f13e0
	     region_type = mapped_file
	            name = "dabapi.dll"
	        filename = "\\Windows\\System32\\dabapi.dll" (normalized: "c:\\windows\\system32\\dabapi.dll")

Region:
	              id = 874
	        start_va = 0x7ff87aa90000
	          end_va = 0x7ff87ab08fff
	       monitored = 0
	     entry_point = 0x7ff87aaafb90
	     region_type = mapped_file
	            name = "apphelp.dll"
	        filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll")

Region:
	              id = 875
	        start_va = 0x7ff87ab10000
	          end_va = 0x7ff87ac95fff
	       monitored = 0
	     entry_point = 0x7ff87ab5d700
	     region_type = mapped_file
	            name = "propsys.dll"
	        filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll")

Region:
	              id = 876
	        start_va = 0x7ff87aca0000
	          end_va = 0x7ff87acbbfff
	       monitored = 0
	     entry_point = 0x7ff87aca37a0
	     region_type = mapped_file
	            name = "samlib.dll"
	        filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll")

Region:
	              id = 877
	        start_va = 0x7ff87ad00000
	          end_va = 0x7ff87ad12fff
	       monitored = 0
	     entry_point = 0x7ff87ad02760
	     region_type = mapped_file
	            name = "wtsapi32.dll"
	        filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll")

Region:
	              id = 878
	        start_va = 0x7ff87ae70000
	          end_va = 0x7ff87aeaffff
	       monitored = 0
	     entry_point = 0x7ff87ae81960
	     region_type = mapped_file
	            name = "brokerlib.dll"
	        filename = "\\Windows\\System32\\BrokerLib.dll" (normalized: "c:\\windows\\system32\\brokerlib.dll")

Region:
	              id = 879
	        start_va = 0x7ff87af40000
	          end_va = 0x7ff87afd5fff
	       monitored = 0
	     entry_point = 0x7ff87af65570
	     region_type = mapped_file
	            name = "uxtheme.dll"
	        filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")

Region:
	              id = 880
	        start_va = 0x7ff87afe0000
	          end_va = 0x7ff87b006fff
	       monitored = 0
	     entry_point = 0x7ff87afe7940
	     region_type = mapped_file
	            name = "devobj.dll"
	        filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll")

Region:
	              id = 881
	        start_va = 0x7ff87b030000
	          end_va = 0x7ff87b0d9fff
	       monitored = 0
	     entry_point = 0x7ff87b057910
	     region_type = mapped_file
	            name = "dnsapi.dll"
	        filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll")

Region:
	              id = 882
	        start_va = 0x7ff87b0e0000
	          end_va = 0x7ff87b1dffff
	       monitored = 0
	     entry_point = 0x7ff87b120f80
	     region_type = mapped_file
	            name = "twinapi.appcore.dll"
	        filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll")

Region:
	              id = 883
	        start_va = 0x7ff87b270000
	          end_va = 0x7ff87b27bfff
	       monitored = 0
	     entry_point = 0x7ff87b272480
	     region_type = mapped_file
	            name = "sysntfy.dll"
	        filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll")

Region:
	              id = 884
	        start_va = 0x7ff87b340000
	          end_va = 0x7ff87b371fff
	       monitored = 0
	     entry_point = 0x7ff87b352340
	     region_type = mapped_file
	            name = "fwbase.dll"
	        filename = "\\Windows\\System32\\fwbase.dll" (normalized: "c:\\windows\\system32\\fwbase.dll")

Region:
	              id = 885
	        start_va = 0x7ff87b5b0000
	          end_va = 0x7ff87b5bbfff
	       monitored = 0
	     entry_point = 0x7ff87b5b2790
	     region_type = mapped_file
	            name = "hid.dll"
	        filename = "\\Windows\\System32\\hid.dll" (normalized: "c:\\windows\\system32\\hid.dll")

Region:
	              id = 886
	        start_va = 0x7ff87b5c0000
	          end_va = 0x7ff87b5e3fff
	       monitored = 0
	     entry_point = 0x7ff87b5c3260
	     region_type = mapped_file
	            name = "gpapi.dll"
	        filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll")

Region:
	              id = 887
	        start_va = 0x7ff87b760000
	          end_va = 0x7ff87b853fff
	       monitored = 0
	     entry_point = 0x7ff87b76a960
	     region_type = mapped_file
	            name = "ucrtbase.dll"
	        filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll")

Region:
	              id = 888
	        start_va = 0x7ff87b8b0000
	          end_va = 0x7ff87b8f8fff
	       monitored = 0
	     entry_point = 0x7ff87b8ba090
	     region_type = mapped_file
	            name = "authz.dll"
	        filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll")

Region:
	              id = 889
	        start_va = 0x7ff87b9d0000
	          end_va = 0x7ff87b9dbfff
	       monitored = 0
	     entry_point = 0x7ff87b9d27e0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll")

Region:
	              id = 890
	        start_va = 0x7ff87ba10000
	          end_va = 0x7ff87ba1cfff
	       monitored = 0
	     entry_point = 0x7ff87ba11fe0
	     region_type = mapped_file
	            name = "tbs.dll"
	        filename = "\\Windows\\System32\\tbs.dll" (normalized: "c:\\windows\\system32\\tbs.dll")

Region:
	              id = 891
	        start_va = 0x7ff87bab0000
	          end_va = 0x7ff87bae0fff
	       monitored = 0
	     entry_point = 0x7ff87bab7d10
	     region_type = mapped_file
	            name = "ntmarta.dll"
	        filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll")

Region:
	              id = 892
	        start_va = 0x7ff87bb10000
	          end_va = 0x7ff87bb89fff
	       monitored = 0
	     entry_point = 0x7ff87bb31a50
	     region_type = mapped_file
	            name = "schannel.dll"
	        filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll")

Region:
	              id = 893
	        start_va = 0x7ff87bbd0000
	          end_va = 0x7ff87bc03fff
	       monitored = 0
	     entry_point = 0x7ff87bbeae70
	     region_type = mapped_file
	            name = "rsaenh.dll"
	        filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")

Region:
	              id = 894
	        start_va = 0x7ff87bc10000
	          end_va = 0x7ff87bc19fff
	       monitored = 0
	     entry_point = 0x7ff87bc11830
	     region_type = mapped_file
	            name = "dpapi.dll"
	        filename = "\\Windows\\System32\\dpapi.dll" (normalized: "c:\\windows\\system32\\dpapi.dll")

Region:
	              id = 895
	        start_va = 0x7ff87bd20000
	          end_va = 0x7ff87bd3efff
	       monitored = 0
	     entry_point = 0x7ff87bd25d30
	     region_type = mapped_file
	            name = "userenv.dll"
	        filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll")

Region:
	              id = 896
	        start_va = 0x7ff87be90000
	          end_va = 0x7ff87beebfff
	       monitored = 0
	     entry_point = 0x7ff87bea6f70
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll")

Region:
	              id = 897
	        start_va = 0x7ff87bf40000
	          end_va = 0x7ff87bf56fff
	       monitored = 0
	     entry_point = 0x7ff87bf479d0
	     region_type = mapped_file
	            name = "cryptsp.dll"
	        filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")

Region:
	              id = 898
	        start_va = 0x7ff87c060000
	          end_va = 0x7ff87c06afff
	       monitored = 0
	     entry_point = 0x7ff87c0619a0
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")

Region:
	              id = 899
	        start_va = 0x7ff87c0a0000
	          end_va = 0x7ff87c0c0fff
	       monitored = 0
	     entry_point = 0x7ff87c0b0250
	     region_type = mapped_file
	            name = "joinutil.dll"
	        filename = "\\Windows\\System32\\joinutil.dll" (normalized: "c:\\windows\\system32\\joinutil.dll")

Region:
	              id = 900
	        start_va = 0x7ff87c0f0000
	          end_va = 0x7ff87c129fff
	       monitored = 0
	     entry_point = 0x7ff87c0f8d20
	     region_type = mapped_file
	            name = "ntasn1.dll"
	        filename = "\\Windows\\System32\\ntasn1.dll" (normalized: "c:\\windows\\system32\\ntasn1.dll")

Region:
	              id = 901
	        start_va = 0x7ff87c130000
	          end_va = 0x7ff87c156fff
	       monitored = 0
	     entry_point = 0x7ff87c140aa0
	     region_type = mapped_file
	            name = "ncrypt.dll"
	        filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll")

Region:
	              id = 902
	        start_va = 0x7ff87c240000
	          end_va = 0x7ff87c26cfff
	       monitored = 0
	     entry_point = 0x7ff87c259d40
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")

Region:
	              id = 903
	        start_va = 0x7ff87c3d0000
	          end_va = 0x7ff87c425fff
	       monitored = 0
	     entry_point = 0x7ff87c3e0bf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll")

Region:
	              id = 904
	        start_va = 0x7ff87c430000
	          end_va = 0x7ff87c448fff
	       monitored = 0
	     entry_point = 0x7ff87c435e10
	     region_type = mapped_file
	            name = "eventaggregation.dll"
	        filename = "\\Windows\\System32\\EventAggregation.dll" (normalized: "c:\\windows\\system32\\eventaggregation.dll")

Region:
	              id = 905
	        start_va = 0x7ff87c450000
	          end_va = 0x7ff87c478fff
	       monitored = 0
	     entry_point = 0x7ff87c464530
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")

Region:
	              id = 906
	        start_va = 0x7ff87c480000
	          end_va = 0x7ff87c518fff
	       monitored = 0
	     entry_point = 0x7ff87c4af4e0
	     region_type = mapped_file
	            name = "sxs.dll"
	        filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll")

Region:
	              id = 907
	        start_va = 0x7ff87c5c0000
	          end_va = 0x7ff87c5cffff
	       monitored = 0
	     entry_point = 0x7ff87c5c56e0
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")

Region:
	              id = 908
	        start_va = 0x7ff87c5d0000
	          end_va = 0x7ff87c5e3fff
	       monitored = 0
	     entry_point = 0x7ff87c5d52e0
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")

Region:
	              id = 909
	        start_va = 0x7ff87c5f0000
	          end_va = 0x7ff87c63afff
	       monitored = 0
	     entry_point = 0x7ff87c5f35f0
	     region_type = mapped_file
	            name = "powrprof.dll"
	        filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")

Region:
	              id = 910
	        start_va = 0x7ff87c640000
	          end_va = 0x7ff87c64efff
	       monitored = 0
	     entry_point = 0x7ff87c643210
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")

Region:
	              id = 911
	        start_va = 0x7ff87c650000
	          end_va = 0x7ff87c704fff
	       monitored = 0
	     entry_point = 0x7ff87c6922e0
	     region_type = mapped_file
	            name = "shcore.dll"
	        filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll")

Region:
	              id = 912
	        start_va = 0x7ff87c710000
	          end_va = 0x7ff87c752fff
	       monitored = 0
	     entry_point = 0x7ff87c724b50
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")

Region:
	              id = 913
	        start_va = 0x7ff87c760000
	          end_va = 0x7ff87cda3fff
	       monitored = 0
	     entry_point = 0x7ff87c9264b0
	     region_type = mapped_file
	            name = "windows.storage.dll"
	        filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll")

Region:
	              id = 914
	        start_va = 0x7ff87cdb0000
	          end_va = 0x7ff87ce35fff
	       monitored = 0
	     entry_point = 0x7ff87cdbd8f0
	     region_type = mapped_file
	            name = "firewallapi.dll"
	        filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll")

Region:
	              id = 915
	        start_va = 0x7ff87ce40000
	          end_va = 0x7ff87d027fff
	       monitored = 0
	     entry_point = 0x7ff87ce6ba70
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 916
	        start_va = 0x7ff87d030000
	          end_va = 0x7ff87d099fff
	       monitored = 0
	     entry_point = 0x7ff87d066d50
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")

Region:
	              id = 917
	        start_va = 0x7ff87d0a0000
	          end_va = 0x7ff87d0b6fff
	       monitored = 0
	     entry_point = 0x7ff87d0a1390
	     region_type = mapped_file
	            name = "netapi32.dll"
	        filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll")

Region:
	              id = 918
	        start_va = 0x7ff87d170000
	          end_va = 0x7ff87d336fff
	       monitored = 0
	     entry_point = 0x7ff87d1cdb80
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")

Region:
	              id = 919
	        start_va = 0x7ff87d340000
	          end_va = 0x7ff87d394fff
	       monitored = 0
	     entry_point = 0x7ff87d357970
	     region_type = mapped_file
	            name = "wintrust.dll"
	        filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll")

Region:
	              id = 920
	        start_va = 0x7ff87d3a0000
	          end_va = 0x7ff87d4e2fff
	       monitored = 0
	     entry_point = 0x7ff87d3c8210
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")

Region:
	              id = 921
	        start_va = 0x7ff87d650000
	          end_va = 0x7ff87ebaefff
	       monitored = 0
	     entry_point = 0x7ff87d7b11f0
	     region_type = mapped_file
	            name = "shell32.dll"
	        filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")

Region:
	              id = 922
	        start_va = 0x7ff87ed60000
	          end_va = 0x7ff87eeb5fff
	       monitored = 0
	     entry_point = 0x7ff87ed6a8d0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 923
	        start_va = 0x7ff87eed0000
	          end_va = 0x7ff87ef3afff
	       monitored = 0
	     entry_point = 0x7ff87eee90c0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")

Region:
	              id = 924
	        start_va = 0x7ff87efa0000
	          end_va = 0x7ff87efa7fff
	       monitored = 0
	     entry_point = 0x7ff87efa1ea0
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")

Region:
	              id = 925
	        start_va = 0x7ff87efb0000
	          end_va = 0x7ff87f3d8fff
	       monitored = 0
	     entry_point = 0x7ff87efd8740
	     region_type = mapped_file
	            name = "setupapi.dll"
	        filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll")

Region:
	              id = 926
	        start_va = 0x7ff87f3e0000
	          end_va = 0x7ff87f565fff
	       monitored = 0
	     entry_point = 0x7ff87f42ffc0
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 927
	        start_va = 0x7ff87f570000
	          end_va = 0x7ff87f5cbfff
	       monitored = 0
	     entry_point = 0x7ff87f58b720
	     region_type = mapped_file
	            name = "wldap32.dll"
	        filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll")

Region:
	              id = 928
	        start_va = 0x7ff87f640000
	          end_va = 0x7ff87f6ecfff
	       monitored = 0
	     entry_point = 0x7ff87f6581a0
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 929
	        start_va = 0x7ff87f6f0000
	          end_va = 0x7ff87f96cfff
	       monitored = 0
	     entry_point = 0x7ff87f7c4970
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")

Region:
	              id = 930
	        start_va = 0x7ff87f970000
	          end_va = 0x7ff87f9cafff
	       monitored = 0
	     entry_point = 0x7ff87f9838b0
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 931
	        start_va = 0x7ff87f9d0000
	          end_va = 0x7ff87fa76fff
	       monitored = 0
	     entry_point = 0x7ff87f9db4d0
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")

Region:
	              id = 932
	        start_va = 0x7ff87fa80000
	          end_va = 0x7ff87fb40fff
	       monitored = 0
	     entry_point = 0x7ff87faa0da0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 933
	        start_va = 0x7ff87fb50000
	          end_va = 0x7ff87fba1fff
	       monitored = 0
	     entry_point = 0x7ff87fb5f530
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")

Region:
	              id = 934
	        start_va = 0x7ff87fd30000
	          end_va = 0x7ff87fdd6fff
	       monitored = 0
	     entry_point = 0x7ff87fd458d0
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 935
	        start_va = 0x7ff87fde0000
	          end_va = 0x7ff87fe7cfff
	       monitored = 0
	     entry_point = 0x7ff87fde78a0
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 936
	        start_va = 0x7ff87fe80000
	          end_va = 0x7ff87ff9bfff
	       monitored = 0
	     entry_point = 0x7ff87fec02b0
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 937
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 939
	        start_va = 0xa500000
	          end_va = 0xa5fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000a500000"
	        filename = ""

Region:
	              id = 940
	        start_va = 0xa600000
	          end_va = 0xa6fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000a600000"
	        filename = ""

Region:
	              id = 941
	        start_va = 0xa700000
	          end_va = 0xa7fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000a700000"
	        filename = ""

Region:
	              id = 942
	        start_va = 0xa800000
	          end_va = 0xa8fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000a800000"
	        filename = ""

Region:
	              id = 943
	        start_va = 0xa900000
	          end_va = 0xa9fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000a900000"
	        filename = ""

Region:
	              id = 944
	        start_va = 0xfe0000
	          end_va = 0xfe5fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000fe0000"
	        filename = ""

Region:
	              id = 946
	        start_va = 0xaa00000
	          end_va = 0xaafffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000aa00000"
	        filename = ""

Region:
	              id = 947
	        start_va = 0xab00000
	          end_va = 0xabfffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000ab00000"
	        filename = ""

Region:
	              id = 948
	        start_va = 0xfe0000
	          end_va = 0xfe0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000fe0000"
	        filename = ""

Region:
	              id = 1002
	        start_va = 0xfe0000
	          end_va = 0xfe7fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000fe0000"
	        filename = ""

Region:
	              id = 1003
	        start_va = 0xfe0000
	          end_va = 0xfe5fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000fe0000"
	        filename = ""

Region:
	              id = 1066
	        start_va = 0xfe0000
	          end_va = 0xfe1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000fe0000"
	        filename = ""

Region:
	              id = 1067
	        start_va = 0xff0000
	          end_va = 0xff1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000ff0000"
	        filename = ""

Region:
	              id = 1128
	        start_va = 0x1ea0000
	          end_va = 0x1ea1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001ea0000"
	        filename = ""

Region:
	              id = 1129
	        start_va = 0xff0000
	          end_va = 0xff5fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000ff0000"
	        filename = ""

Region:
	              id = 1131
	        start_va = 0xff0000
	          end_va = 0xff7fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000ff0000"
	        filename = ""

Region:
	              id = 1132
	        start_va = 0xff0000
	          end_va = 0xff5fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000ff0000"
	        filename = ""

Region:
	              id = 1256
	        start_va = 0xff0000
	          end_va = 0xff5fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000ff0000"
	        filename = ""

Region:
	              id = 1258
	        start_va = 0xff0000
	          end_va = 0xff7fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000ff0000"
	        filename = ""

Region:
	              id = 1259
	        start_va = 0xff0000
	          end_va = 0xff5fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000ff0000"
	        filename = ""

Region:
	              id = 1381
	        start_va = 0xff0000
	          end_va = 0xff5fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000ff0000"
	        filename = ""

Region:
	              id = 1383
	        start_va = 0x400000
	          end_va = 0x407fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 1384
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 1507
	        start_va = 0x400000
	          end_va = 0x407fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 1508
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 1631
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 1633
	        start_va = 0x400000
	          end_va = 0x407fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 1634
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 1755
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 1757
	        start_va = 0x400000
	          end_va = 0x407fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 1758
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 1880
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 1882
	        start_va = 0x400000
	          end_va = 0x407fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 1883
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 2007
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 2009
	        start_va = 0x400000
	          end_va = 0x407fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 2010
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 2075
	        start_va = 0x400000
	          end_va = 0x442fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 2076
	        start_va = 0x4500000
	          end_va = 0x45fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004500000"
	        filename = ""

Region:
	              id = 2077
	        start_va = 0x4600000
	          end_va = 0x46fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004600000"
	        filename = ""

Region:
	              id = 2078
	        start_va = 0x450000
	          end_va = 0x450fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000450000"
	        filename = ""

Region:
	              id = 2079
	        start_va = 0x2bf0000
	          end_va = 0x2c4ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002bf0000"
	        filename = ""

Region:
	              id = 2080
	        start_va = 0x4800000
	          end_va = 0x487ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004800000"
	        filename = ""

Region:
	              id = 2081
	        start_va = 0x2bf0000
	          end_va = 0x2bfffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002bf0000"
	        filename = ""

Region:
	              id = 2082
	        start_va = 0x2c00000
	          end_va = 0x2c0ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002c00000"
	        filename = ""

Region:
	              id = 2083
	        start_va = 0x2c10000
	          end_va = 0x2c1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002c10000"
	        filename = ""

Region:
	              id = 2084
	        start_va = 0x2c20000
	          end_va = 0x2c2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002c20000"
	        filename = ""

Region:
	              id = 2085
	        start_va = 0x2c30000
	          end_va = 0x2c3ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002c30000"
	        filename = ""

Region:
	              id = 2086
	        start_va = 0x2c40000
	          end_va = 0x2c4ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000002c40000"
	        filename = ""

Region:
	              id = 2087
	        start_va = 0x460000
	          end_va = 0x460fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000460000"
	        filename = ""

Region:
	              id = 2088
	        start_va = 0x4880000
	          end_va = 0x48fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004880000"
	        filename = ""

Region:
	              id = 2089
	        start_va = 0x1e40000
	          end_va = 0x1e8dfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001e40000"
	        filename = ""

Region:
	              id = 2090
	        start_va = 0x1eb0000
	          end_va = 0x1efdfff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001eb0000"
	        filename = ""

Region:
	              id = 2091
	        start_va = 0x40a0000
	          end_va = 0x40fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000040a0000"
	        filename = ""

Region:
	              id = 2092
	        start_va = 0x40a0000
	          end_va = 0x40affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000040a0000"
	        filename = ""

Region:
	              id = 2093
	        start_va = 0x40b0000
	          end_va = 0x40bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000040b0000"
	        filename = ""

Region:
	              id = 2094
	        start_va = 0x40c0000
	          end_va = 0x40cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000040c0000"
	        filename = ""

Region:
	              id = 2095
	        start_va = 0x40d0000
	          end_va = 0x40dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000040d0000"
	        filename = ""

Region:
	              id = 2096
	        start_va = 0x40e0000
	          end_va = 0x40effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000040e0000"
	        filename = ""

Region:
	              id = 2097
	        start_va = 0x40f0000
	          end_va = 0x40fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000040f0000"
	        filename = ""

Region:
	              id = 2098
	        start_va = 0x470000
	          end_va = 0x473fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000470000"
	        filename = ""

Region:
	              id = 2099
	        start_va = 0xac00000
	          end_va = 0xbbfffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000000ac00000"
	        filename = ""

Region:
	              id = 2100
	        start_va = 0xff0000
	          end_va = 0xffffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ff0000"
	        filename = ""

Region:
	              id = 2101
	        start_va = 0x2410000
	          end_va = 0x241ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002410000"
	        filename = ""

Region:
	              id = 2102
	        start_va = 0x2420000
	          end_va = 0x2420fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002420000"
	        filename = ""

Region:
	              id = 2103
	        start_va = 0x2430000
	          end_va = 0x2430fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002430000"
	        filename = ""

Region:
	              id = 2104
	        start_va = 0x24d0000
	          end_va = 0x24d3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000024d0000"
	        filename = ""

Region:
	              id = 2105
	        start_va = 0x24e0000
	          end_va = 0x24e1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000024e0000"
	        filename = ""

Region:
	              id = 2106
	        start_va = 0x24f0000
	          end_va = 0x24f0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000024f0000"
	        filename = ""

Region:
	              id = 2107
	        start_va = 0x4900000
	          end_va = 0x4a4ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004900000"
	        filename = ""

Region:
	              id = 2121
	        start_va = 0x2c50000
	          end_va = 0x2c50fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002c50000"
	        filename = ""

Region:
	              id = 2122
	        start_va = 0x2ce0000
	          end_va = 0x2ce1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002ce0000"
	        filename = ""

Region:
	              id = 2135
	        start_va = 0x2ce0000
	          end_va = 0x2cfffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002ce0000"
	        filename = ""

Region:
	              id = 2136
	        start_va = 0x2c50000
	          end_va = 0x2c5ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002c50000"
	        filename = ""

Region:
	              id = 2137
	        start_va = 0x3480000
	          end_va = 0x3481fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003480000"
	        filename = ""

Region:
	              id = 2138
	        start_va = 0x3480000
	          end_va = 0x3483fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003480000"
	        filename = ""

Region:
	              id = 2139
	        start_va = 0x3490000
	          end_va = 0x349ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003490000"
	        filename = ""

Region:
	              id = 2140
	        start_va = 0x3490000
	          end_va = 0x3491fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003490000"
	        filename = ""

Region:
	              id = 2141
	        start_va = 0x34a0000
	          end_va = 0x34a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000034a0000"
	        filename = ""

Region:
	              id = 2142
	        start_va = 0x34a0000
	          end_va = 0x34affff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 2157
	        start_va = 0x34c0000
	          end_va = 0x34cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000034c0000"
	        filename = ""

Region:
	              id = 2158
	        start_va = 0x34d0000
	          end_va = 0x34dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000034d0000"
	        filename = ""

Region:
	              id = 2159
	        start_va = 0x34e0000
	          end_va = 0x34effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000034e0000"
	        filename = ""

Region:
	              id = 2160
	        start_va = 0x34f0000
	          end_va = 0x34fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000034f0000"
	        filename = ""

Region:
	              id = 2161
	        start_va = 0x4000000
	          end_va = 0x400ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004000000"
	        filename = ""

Region:
	              id = 2162
	        start_va = 0x4900000
	          end_va = 0x490ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 2163
	        start_va = 0x4910000
	          end_va = 0x491ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 2164
	        start_va = 0x4920000
	          end_va = 0x4923fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004920000"
	        filename = ""

Region:
	              id = 2165
	        start_va = 0x4930000
	          end_va = 0x493ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 2166
	        start_va = 0x4940000
	          end_va = 0x494ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "datastore.edb"
	        filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")

Region:
	              id = 2169
	        start_va = 0x4950000
	          end_va = 0x495ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004950000"
	        filename = ""

Region:
	              id = 2185
	        start_va = 0xfe0000
	          end_va = 0xfe5fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000fe0000"
	        filename = ""

Region:
	              id = 2187
	        start_va = 0xfe0000
	          end_va = 0xfe1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000fe0000"
	        filename = ""

Region:
	              id = 2188
	        start_va = 0x1ea0000
	          end_va = 0x1ea1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001ea0000"
	        filename = ""

Region:
	              id = 2189
	        start_va = 0x4960000
	          end_va = 0x4961fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000004960000"
	        filename = ""

Region:
	              id = 2190
	        start_va = 0x1ea0000
	          end_va = 0x1ea7fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001ea0000"
	        filename = ""

Region:
	              id = 2191
	        start_va = 0x1ea0000
	          end_va = 0x1ea5fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001ea0000"
	        filename = ""

Region:
	              id = 2192
	        start_va = 0x4970000
	          end_va = 0x497ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004970000"
	        filename = ""

Region:
	              id = 2193
	        start_va = 0x4980000
	          end_va = 0x49fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004980000"
	        filename = ""

Region:
	              id = 2194
	        start_va = 0x1ea0000
	          end_va = 0x1ea3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001ea0000"
	        filename = ""

Region:
	              id = 2195
	        start_va = 0x1ea0000
	          end_va = 0x1ea0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001ea0000"
	        filename = ""

Region:
	              id = 2196
	        start_va = 0x1ea0000
	          end_va = 0x1ea0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001ea0000"
	        filename = ""

Region:
	              id = 2318
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 2320
	        start_va = 0x400000
	          end_va = 0x407fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 2321
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 2443
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 2445
	        start_va = 0x400000
	          end_va = 0x407fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 2446
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 2568
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 2570
	        start_va = 0x400000
	          end_va = 0x407fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 2571
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 2692
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 2694
	        start_va = 0x400000
	          end_va = 0x407fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 2695
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 2817
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 2819
	        start_va = 0x400000
	          end_va = 0x407fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 2820
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 2941
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 2943
	        start_va = 0x400000
	          end_va = 0x407fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 2944
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 3066
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 3068
	        start_va = 0x400000
	          end_va = 0x407fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 3069
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 3191
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 3193
	        start_va = 0x400000
	          end_va = 0x407fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 3194
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 3316
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 3318
	        start_va = 0x400000
	          end_va = 0x407fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 3319
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 3406
	        start_va = 0x400000
	          end_va = 0x420fff
	       monitored = 0
	     entry_point = 0x402300
	     region_type = mapped_file
	            name = "sppc.dll"
	        filename = "\\Windows\\System32\\sppc.dll" (normalized: "c:\\windows\\system32\\sppc.dll")

Region:
	              id = 3426
	        start_va = 0x430000
	          end_va = 0x47efff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000430000"
	        filename = ""

Region:
	              id = 3427
	        start_va = 0x400000
	          end_va = 0x420fff
	       monitored = 0
	     entry_point = 0x402300
	     region_type = mapped_file
	            name = "sppc.dll"
	        filename = "\\Windows\\System32\\sppc.dll" (normalized: "c:\\windows\\system32\\sppc.dll")

Region:
	              id = 3428
	        start_va = 0x400000
	          end_va = 0x420fff
	       monitored = 0
	     entry_point = 0x402300
	     region_type = mapped_file
	            name = "sppc.dll"
	        filename = "\\Windows\\System32\\sppc.dll" (normalized: "c:\\windows\\system32\\sppc.dll")

Region:
	              id = 3446
	        start_va = 0x400000
	          end_va = 0x401fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 3447
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 3449
	        start_va = 0x400000
	          end_va = 0x407fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 3450
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 3572
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 3574
	        start_va = 0x400000
	          end_va = 0x407fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 3575
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 3697
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 3699
	        start_va = 0x400000
	          end_va = 0x407fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 3700
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 3821
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 3823
	        start_va = 0x400000
	          end_va = 0x407fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 3824
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 3946
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 3948
	        start_va = 0x400000
	          end_va = 0x407fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 3949
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 4071
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 4073
	        start_va = 0x400000
	          end_va = 0x407fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 4074
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 4195
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 4197
	        start_va = 0x400000
	          end_va = 0x407fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 4198
	        start_va = 0x4a90000
	          end_va = 0x4b8ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004a90000"
	        filename = ""

Region:
	              id = 4199
	        start_va = 0x4e00000
	          end_va = 0x4efffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000004e00000"
	        filename = ""

Region:
	              id = 4200
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 4322
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 4324
	        start_va = 0x400000
	          end_va = 0x407fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 4325
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 4446
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 4448
	        start_va = 0x400000
	          end_va = 0x407fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 4449
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 4571
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 4573
	        start_va = 0x400000
	          end_va = 0x407fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 4574
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 4696
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 4698
	        start_va = 0x400000
	          end_va = 0x407fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 4699
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 4823
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 4825
	        start_va = 0x400000
	          end_va = 0x407fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 4826
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 4948
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 4950
	        start_va = 0x400000
	          end_va = 0x407fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 4951
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 5073
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 5075
	        start_va = 0x400000
	          end_va = 0x407fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 5076
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 5197
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 5199
	        start_va = 0x400000
	          end_va = 0x407fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 5200
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 5322
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 5324
	        start_va = 0x400000
	          end_va = 0x407fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 5325
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 5447
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 5449
	        start_va = 0x400000
	          end_va = 0x407fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 5450
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 5571
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 5573
	        start_va = 0x400000
	          end_va = 0x407fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 5574
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 5696
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 5698
	        start_va = 0x400000
	          end_va = 0x407fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 5699
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 5821
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 5823
	        start_va = 0x400000
	          end_va = 0x407fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 5824
	        start_va = 0x400000
	          end_va = 0x405fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 5979
	        start_va = 0x400000
	          end_va = 0x401fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 5980
	        start_va = 0x410000
	          end_va = 0x411fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000410000"
	        filename = ""

Region:
	              id = 5981
	        start_va = 0x400000
	          end_va = 0x400fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 5982
	        start_va = 0x400000
	          end_va = 0x400fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 5983
	        start_va = 0x400000
	          end_va = 0x400fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""


Thread:
	id = 19
	os_tid = 0xc08


Thread:
	id = 20
	os_tid = 0x137c


Thread:
	id = 21
	os_tid = 0x1340


Thread:
	id = 22
	os_tid = 0x133c


Thread:
	id = 23
	os_tid = 0xd1c


Thread:
	id = 24
	os_tid = 0x70c


Thread:
	id = 25
	os_tid = 0xd10


Thread:
	id = 26
	os_tid = 0x43c


Thread:
	id = 27
	os_tid = 0x46c


Thread:
	id = 28
	os_tid = 0xd34


Thread:
	id = 29
	os_tid = 0x3a8


Thread:
	id = 30
	os_tid = 0x304


Thread:
	id = 31
	os_tid = 0x9c8


Thread:
	id = 32
	os_tid = 0x914


Thread:
	id = 33
	os_tid = 0xb60


Thread:
	id = 34
	os_tid = 0x1d0


Thread:
	id = 35
	os_tid = 0x890


Thread:
	id = 36
	os_tid = 0xbc0


Thread:
	id = 37
	os_tid = 0xc28


Thread:
	id = 38
	os_tid = 0xfcc


Thread:
	id = 39
	os_tid = 0xfc8


Thread:
	id = 40
	os_tid = 0xfbc


Thread:
	id = 41
	os_tid = 0xfb4


Thread:
	id = 42
	os_tid = 0xfac


Thread:
	id = 43
	os_tid = 0xfa8


Thread:
	id = 44
	os_tid = 0xf3c


Thread:
	id = 45
	os_tid = 0xf38


Thread:
	id = 46
	os_tid = 0xf34


Thread:
	id = 47
	os_tid = 0xf2c


Thread:
	id = 48
	os_tid = 0xf14


Thread:
	id = 49
	os_tid = 0xee8


Thread:
	id = 50
	os_tid = 0xed4


Thread:
	id = 51
	os_tid = 0xec4


Thread:
	id = 52
	os_tid = 0xe9c


Thread:
	id = 53
	os_tid = 0xe90


Thread:
	id = 54
	os_tid = 0xe88


Thread:
	id = 55
	os_tid = 0xe78


Thread:
	id = 56
	os_tid = 0xe64


Thread:
	id = 57
	os_tid = 0xde0


Thread:
	id = 58
	os_tid = 0xdd0


Thread:
	id = 59
	os_tid = 0xd98


Thread:
	id = 60
	os_tid = 0xd7c


Thread:
	id = 61
	os_tid = 0xd44


Thread:
	id = 62
	os_tid = 0x534


Thread:
	id = 63
	os_tid = 0x8c4


Thread:
	id = 64
	os_tid = 0x6c4


Thread:
	id = 65
	os_tid = 0x8bc


Thread:
	id = 66
	os_tid = 0x8b8


Thread:
	id = 67
	os_tid = 0x874


Thread:
	id = 68
	os_tid = 0x870


Thread:
	id = 69
	os_tid = 0x854


Thread:
	id = 70
	os_tid = 0x850


Thread:
	id = 71
	os_tid = 0x83c


Thread:
	id = 72
	os_tid = 0x834


Thread:
	id = 73
	os_tid = 0x824


Thread:
	id = 74
	os_tid = 0x558


Thread:
	id = 75
	os_tid = 0x628


Thread:
	id = 76
	os_tid = 0x568


Thread:
	id = 77
	os_tid = 0x4cc


Thread:
	id = 78
	os_tid = 0x474


Thread:
	id = 79
	os_tid = 0x404


Thread:
	id = 80
	os_tid = 0x164


Thread:
	id = 81
	os_tid = 0x7f8


Thread:
	id = 82
	os_tid = 0x7bc


Thread:
	id = 83
	os_tid = 0x424


Thread:
	id = 84
	os_tid = 0x730


Thread:
	id = 85
	os_tid = 0x6e8


Thread:
	id = 86
	os_tid = 0x694


Thread:
	id = 87
	os_tid = 0x690


Thread:
	id = 88
	os_tid = 0x668


Thread:
	id = 89
	os_tid = 0x648


Thread:
	id = 90
	os_tid = 0x604


Thread:
	id = 91
	os_tid = 0x5f0


Thread:
	id = 92
	os_tid = 0x5e4


Thread:
	id = 93
	os_tid = 0x4e0


Thread:
	id = 94
	os_tid = 0x468


Thread:
	id = 95
	os_tid = 0x450


Thread:
	id = 96
	os_tid = 0x438


Thread:
	id = 97
	os_tid = 0x434


Thread:
	id = 98
	os_tid = 0x430


Thread:
	id = 99
	os_tid = 0x3d8


Thread:
	id = 100
	os_tid = 0x280


Thread:
	id = 101
	os_tid = 0x170


Thread:
	id = 102
	os_tid = 0x210


Thread:
	id = 103
	os_tid = 0x16c


Thread:
	id = 104
	os_tid = 0x178


Thread:
	id = 105
	os_tid = 0x190


Thread:
	id = 106
	os_tid = 0x140


Thread:
	id = 107
	os_tid = 0x120


Thread:
	id = 108
	os_tid = 0x60


Thread:
	id = 109
	os_tid = 0x3ec


Thread:
	id = 110
	os_tid = 0x6f0


Thread:
	id = 111
	os_tid = 0xd38


Thread:
	id = 112
	os_tid = 0x688


Thread:
	id = 113
	os_tid = 0xf94


Thread:
	id = 114
	os_tid = 0xec8


Thread:
	id = 115
	os_tid = 0x1314


Thread:
	id = 116
	os_tid = 0x1388


Thread:
	id = 126
	os_tid = 0x234


Thread:
	id = 185
	os_tid = 0x1110


Thread:
	id = 186
	os_tid = 0x1114


Thread:
	id = 191
	os_tid = 0x1138


Thread:
	id = 305
	os_tid = 0xc40


Thread:
	id = 306
	os_tid = 0x990


Process:
	id = "6"
	image_name = "dllhost.exe"
	filename = "c:\\windows\\system32\\dllhost.exe"
	page_root = "0x489da000"
	os_pid = "0x1250"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "rpc_server"
	parent_id = "5"
	os_parent_pid = "0x274"
	cmd_line = "C:\\Windows\\system32\\DllHost.exe /Processid:{7006698D-2974-4091-A424-85DD0B909E23}"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 949
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 950
	        start_va = 0x20000
	          end_va = 0x26fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 951
	        start_va = 0x30000
	          end_va = 0x44fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 952
	        start_va = 0x50000
	          end_va = 0x14ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000050000"
	        filename = ""

Region:
	              id = 953
	        start_va = 0x150000
	          end_va = 0x153fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000150000"
	        filename = ""

Region:
	              id = 954
	        start_va = 0x160000
	          end_va = 0x161fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000160000"
	        filename = ""

Region:
	              id = 955
	        start_va = 0x170000
	          end_va = 0x170fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000170000"
	        filename = ""

Region:
	              id = 956
	        start_va = 0x180000
	          end_va = 0x186fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000180000"
	        filename = ""

Region:
	              id = 957
	        start_va = 0x190000
	          end_va = 0x190fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000190000"
	        filename = ""

Region:
	              id = 958
	        start_va = 0x1a0000
	          end_va = 0x1a0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001a0000"
	        filename = ""

Region:
	              id = 959
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001b0000"
	        filename = ""

Region:
	              id = 960
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 961
	        start_va = 0x400000
	          end_va = 0x4bdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 962
	        start_va = 0x4c0000
	          end_va = 0x5bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004c0000"
	        filename = ""

Region:
	              id = 963
	        start_va = 0x5d0000
	          end_va = 0x6cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005d0000"
	        filename = ""

Region:
	              id = 964
	        start_va = 0x6d0000
	          end_va = 0x857fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000006d0000"
	        filename = ""

Region:
	              id = 965
	        start_va = 0x870000
	          end_va = 0x87ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000870000"
	        filename = ""

Region:
	              id = 966
	        start_va = 0x880000
	          end_va = 0xa00fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000880000"
	        filename = ""

Region:
	              id = 967
	        start_va = 0xa10000
	          end_va = 0x1e0ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000a10000"
	        filename = ""

Region:
	              id = 968
	        start_va = 0x1e10000
	          end_va = 0x1f0ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001e10000"
	        filename = ""

Region:
	              id = 969
	        start_va = 0x1f10000
	          end_va = 0x200ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001f10000"
	        filename = ""

Region:
	              id = 970
	        start_va = 0x2010000
	          end_va = 0x210ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002010000"
	        filename = ""

Region:
	              id = 971
	        start_va = 0x2110000
	          end_va = 0x220ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002110000"
	        filename = ""

Region:
	              id = 972
	        start_va = 0x23e0000
	          end_va = 0x23effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000023e0000"
	        filename = ""

Region:
	              id = 973
	        start_va = 0x23f0000
	          end_va = 0x24effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000023f0000"
	        filename = ""

Region:
	              id = 974
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 975
	        start_va = 0x7df5ffec0000
	          end_va = 0x7df5fffbffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df5ffec0000"
	        filename = ""

Region:
	              id = 976
	        start_va = 0x7df5fffc0000
	          end_va = 0x7df5fffe2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df5fffc0000"
	        filename = ""

Region:
	              id = 977
	        start_va = 0x7df5ffff0000
	          end_va = 0x7ff5fffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df5ffff0000"
	        filename = ""

Region:
	              id = 978
	        start_va = 0x7ff7cab00000
	          end_va = 0x7ff7cab06fff
	       monitored = 0
	     entry_point = 0x7ff7cab01570
	     region_type = mapped_file
	            name = "dllhost.exe"
	        filename = "\\Windows\\System32\\dllhost.exe" (normalized: "c:\\windows\\system32\\dllhost.exe")

Region:
	              id = 979
	        start_va = 0x7ff863e40000
	          end_va = 0x7ff863e7efff
	       monitored = 0
	     entry_point = 0x7ff863e63320
	     region_type = mapped_file
	            name = "flightsettings.dll"
	        filename = "\\Windows\\System32\\FlightSettings.dll" (normalized: "c:\\windows\\system32\\flightsettings.dll")

Region:
	              id = 980
	        start_va = 0x7ff879c90000
	          end_va = 0x7ff87a122fff
	       monitored = 0
	     entry_point = 0x7ff879c9f760
	     region_type = mapped_file
	            name = "actxprxy.dll"
	        filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll")

Region:
	              id = 981
	        start_va = 0x7ff87af40000
	          end_va = 0x7ff87afd5fff
	       monitored = 0
	     entry_point = 0x7ff87af65570
	     region_type = mapped_file
	            name = "uxtheme.dll"
	        filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")

Region:
	              id = 982
	        start_va = 0x7ff87c5c0000
	          end_va = 0x7ff87c5cffff
	       monitored = 0
	     entry_point = 0x7ff87c5c56e0
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")

Region:
	              id = 983
	        start_va = 0x7ff87c640000
	          end_va = 0x7ff87c64efff
	       monitored = 0
	     entry_point = 0x7ff87c643210
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")

Region:
	              id = 984
	        start_va = 0x7ff87ce40000
	          end_va = 0x7ff87d027fff
	       monitored = 0
	     entry_point = 0x7ff87ce6ba70
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 985
	        start_va = 0x7ff87d030000
	          end_va = 0x7ff87d099fff
	       monitored = 0
	     entry_point = 0x7ff87d066d50
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")

Region:
	              id = 986
	        start_va = 0x7ff87d170000
	          end_va = 0x7ff87d336fff
	       monitored = 0
	     entry_point = 0x7ff87d1cdb80
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")

Region:
	              id = 987
	        start_va = 0x7ff87d4f0000
	          end_va = 0x7ff87d52afff
	       monitored = 0
	     entry_point = 0x7ff87d4f12f0
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")

Region:
	              id = 988
	        start_va = 0x7ff87ed60000
	          end_va = 0x7ff87eeb5fff
	       monitored = 0
	     entry_point = 0x7ff87ed6a8d0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 989
	        start_va = 0x7ff87f3e0000
	          end_va = 0x7ff87f565fff
	       monitored = 0
	     entry_point = 0x7ff87f42ffc0
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 990
	        start_va = 0x7ff87f640000
	          end_va = 0x7ff87f6ecfff
	       monitored = 0
	     entry_point = 0x7ff87f6581a0
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 991
	        start_va = 0x7ff87f6f0000
	          end_va = 0x7ff87f96cfff
	       monitored = 0
	     entry_point = 0x7ff87f7c4970
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")

Region:
	              id = 992
	        start_va = 0x7ff87f970000
	          end_va = 0x7ff87f9cafff
	       monitored = 0
	     entry_point = 0x7ff87f9838b0
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 993
	        start_va = 0x7ff87f9d0000
	          end_va = 0x7ff87fa76fff
	       monitored = 0
	     entry_point = 0x7ff87f9db4d0
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")

Region:
	              id = 994
	        start_va = 0x7ff87fa80000
	          end_va = 0x7ff87fb40fff
	       monitored = 0
	     entry_point = 0x7ff87faa0da0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 995
	        start_va = 0x7ff87fb50000
	          end_va = 0x7ff87fba1fff
	       monitored = 0
	     entry_point = 0x7ff87fb5f530
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")

Region:
	              id = 996
	        start_va = 0x7ff87fde0000
	          end_va = 0x7ff87fe7cfff
	       monitored = 0
	     entry_point = 0x7ff87fde78a0
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 997
	        start_va = 0x7ff87fe80000
	          end_va = 0x7ff87ff9bfff
	       monitored = 0
	     entry_point = 0x7ff87fec02b0
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 998
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 999
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001c0000"
	        filename = ""

Region:
	              id = 1000
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001d0000"
	        filename = ""

Region:
	              id = 1001
	        start_va = 0x2210000
	          end_va = 0x22effff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui")


Thread:
	id = 117
	os_tid = 0x13d4


Thread:
	id = 118
	os_tid = 0xf74


Thread:
	id = 119
	os_tid = 0x520


Thread:
	id = 120
	os_tid = 0x138c


Thread:
	id = 121
	os_tid = 0x13d0


Thread:
	id = 122
	os_tid = 0x1254


Thread:
	id = 123
	os_tid = 0x844


Thread:
	id = 124
	os_tid = 0x126c


Process:
	id = "7"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x534a1000"
	os_pid = "0x13cc"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x614"
	cmd_line = "cmd.exe /c \"taskkill /f /im sqlagent.exe \""
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 1004
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 1005
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 1006
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 1007
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 1008
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 1009
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 1010
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 1011
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 1012
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 1013
	        start_va = 0x13a0000
	          end_va = 0x13f1fff
	       monitored = 1
	     entry_point = 0x13b4fd0
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")

Region:
	              id = 1014
	        start_va = 0x1400000
	          end_va = 0x53fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001400000"
	        filename = ""

Region:
	              id = 1015
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 1016
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 1017
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1018
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 1019
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 1020
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 1021
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 1022
	        start_va = 0x400000
	          end_va = 0x4dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 1023
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 1024
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 1025
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 1026
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 1027
	        start_va = 0x4e0000
	          end_va = 0x68ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004e0000"
	        filename = ""

Region:
	              id = 1028
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 1029
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 1030
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 1031
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 1032
	        start_va = 0x400000
	          end_va = 0x4bdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1033
	        start_va = 0x4d0000
	          end_va = 0x4dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004d0000"
	        filename = ""

Region:
	              id = 1034
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 1035
	        start_va = 0x4e0000
	          end_va = 0x51ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004e0000"
	        filename = ""

Region:
	              id = 1036
	        start_va = 0x590000
	          end_va = 0x68ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000590000"
	        filename = ""

Region:
	              id = 1037
	        start_va = 0x690000
	          end_va = 0x78ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000690000"
	        filename = ""

Region:
	              id = 1038
	        start_va = 0x790000
	          end_va = 0x8dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000790000"
	        filename = ""

Region:
	              id = 1039
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 1040
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 1041
	        start_va = 0x8e0000
	          end_va = 0xc16fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 125
	os_tid = 0xc14

	[0120.408] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000
	[0120.408] __set_app_type (_Type=0x1) 
	[0120.408] __p__fmode () returned 0x74974d6c
	[0120.408] __p__commode () returned 0x74975b1c
	[0120.409] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13b5200) returned 0x0
	[0120.409] __getmainargs (in: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0, _DoWildCard=0, _StartInfo=0x13c60fc | out: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0) returned 0
	[0120.409] GetCurrentThreadId () returned 0xc14
	[0120.409] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xc14) returned 0x78
	[0120.410] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0120.410] GetProcAddress (hModule=0x75600000, lpProcName="SetThreadUILanguage") returned 0x75642510
	[0120.410] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0120.425] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0120.425] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2
	[0120.425] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0120.426] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0120.426] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0120.426] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0120.426] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0120.426] GetConsoleOutputCP () returned 0x1b5
	[0120.428] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0120.429] SetConsoleCtrlHandler (HandlerRoutine=0x13c0e40, Add=1) returned 1
	[0120.429] _get_osfhandle (_FileHandle=1) returned 0x13c
	[0120.429] SetConsoleMode (hConsoleHandle=0x13c, dwMode=0x0) returned 0
	[0120.429] _get_osfhandle (_FileHandle=1) returned 0x13c
	[0120.429] GetConsoleMode (in: hConsoleHandle=0x13c, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0120.429] _get_osfhandle (_FileHandle=0) returned 0x130
	[0120.429] GetConsoleMode (in: hConsoleHandle=0x130, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0120.429] GetEnvironmentStringsW () returned 0x597cc0*
	[0120.429] GetProcessHeap () returned 0x590000
	[0120.429] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0xa1a) returned 0x5986e8
	[0120.430] FreeEnvironmentStringsA (penv="A") returned 1
	[0120.430] GetProcessHeap () returned 0x590000
	[0120.430] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x4) returned 0x590550
	[0120.430] GetEnvironmentStringsW () returned 0x597cc0*
	[0120.430] GetProcessHeap () returned 0x590000
	[0120.430] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0xa1a) returned 0x599110
	[0120.430] FreeEnvironmentStringsA (penv="A") returned 1
	[0120.430] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0120.430] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0120.430] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0120.430] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0120.430] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0120.430] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0120.431] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0120.431] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0120.431] RegCloseKey (hKey=0x88) returned 0x0
	[0120.431] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0120.431] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0120.431] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0120.431] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0120.431] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0120.431] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0120.431] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0120.431] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0120.431] RegCloseKey (hKey=0x88) returned 0x0
	[0120.432] time (in: timer=0x0 | out: timer=0x0) returned 0x62344202
	[0120.432] srand (_Seed=0x62344202) 
	[0120.432] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im sqlagent.exe \""
	[0120.432] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im sqlagent.exe \""
	[0120.432] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0120.432] GetProcessHeap () returned 0x590000
	[0120.432] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x210) returned 0x599b38
	[0120.432] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x599b40, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0120.432] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0120.432] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0120.432] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0120.433] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0120.433] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0120.433] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0120.433] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0120.433] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0120.433] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0120.433] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0120.433] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0120.433] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0120.436] GetProcessHeap () returned 0x590000
	[0120.436] RtlFreeHeap (HeapHandle=0x590000, Flags=0x0, BaseAddress=0x5986e8) returned 1
	[0120.437] GetEnvironmentStringsW () returned 0x597cc0*
	[0120.437] GetProcessHeap () returned 0x590000
	[0120.437] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0xa32) returned 0x59a790
	[0120.437] FreeEnvironmentStringsA (penv="A") returned 1
	[0120.437] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b
	[0120.437] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0120.437] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0120.437] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0120.437] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0120.437] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0120.438] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0120.438] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0120.438] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0120.438] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0120.438] GetProcessHeap () returned 0x590000
	[0120.438] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x44) returned 0x5905c8
	[0120.438] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0120.438] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19fc4c*="Desktop") returned 0x1d
	[0120.438] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0120.438] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x590618
	[0120.439] FindClose (in: hFindFile=0x590618 | out: hFindFile=0x590618) returned 1
	[0120.439] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x590618
	[0120.439] FindClose (in: hFindFile=0x590618 | out: hFindFile=0x590618) returned 1
	[0120.439] _wcsnicmp (_String1="RDHJ0C~1", _String2="RDhJ0CNFevzX", _MaxCount=0xc) returned 16
	[0120.439] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x590618
	[0120.439] FindClose (in: hFindFile=0x590618 | out: hFindFile=0x590618) returned 1
	[0120.439] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0120.440] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1
	[0120.440] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 1
	[0120.440] GetProcessHeap () returned 0x590000
	[0120.440] RtlFreeHeap (HeapHandle=0x590000, Flags=0x0, BaseAddress=0x59a790) returned 1
	[0120.441] GetEnvironmentStringsW () returned 0x597cc0*
	[0120.441] GetProcessHeap () returned 0x590000
	[0120.441] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0xa76) returned 0x599d50
	[0120.441] FreeEnvironmentStringsA (penv="=") returned 1
	[0120.441] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0120.441] GetProcessHeap () returned 0x590000
	[0120.441] RtlFreeHeap (HeapHandle=0x590000, Flags=0x0, BaseAddress=0x5905c8) returned 1
	[0120.441] GetProcessHeap () returned 0x590000
	[0120.441] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x400e) returned 0x59bc50
	[0120.442] GetProcessHeap () returned 0x590000
	[0120.442] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x4c) returned 0x59a7d0
	[0120.442] GetProcessHeap () returned 0x590000
	[0120.442] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x4008) returned 0x59fc68
	[0120.442] GetProcessHeap () returned 0x590000
	[0120.443] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x4008) returned 0x5a3c78
	[0120.455] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0120.456] GetProcessHeap () returned 0x590000
	[0120.456] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x418) returned 0x59a828
	[0120.456] SetErrorMode (uMode=0x0) returned 0x8003
	[0120.456] SetErrorMode (uMode=0x1) returned 0x0
	[0120.456] GetFullPathNameW (in: lpFileName="taskkill \\f \\.", nBufferLength=0x208, lpBuffer=0x59a830, lpFilePart=0x19fbac | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f", lpFilePart=0x19fbac*="f") returned 0x29
	[0120.456] SetErrorMode (uMode=0x8003) returned 0x1
	[0120.457] GetProcessHeap () returned 0x590000
	[0120.457] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x59a828, Size=0x7e) returned 0x59a828
	[0120.457] GetProcessHeap () returned 0x590000
	[0120.457] RtlSizeHeap (HeapHandle=0x590000, Flags=0x0, MemoryPointer=0x59a828) returned 0x7e
	[0120.457] NeedCurrentDirectoryForExePathW (ExeName="taskkill \\f \\.") returned 1
	[0120.457] GetProcessHeap () returned 0x590000
	[0120.457] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x62) returned 0x59a8b0
	[0120.457] GetProcessHeap () returned 0x590000
	[0120.457] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0xb8) returned 0x59a920
	[0120.457] GetProcessHeap () returned 0x590000
	[0120.457] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x59a920, Size=0x62) returned 0x59a920
	[0120.457] GetProcessHeap () returned 0x590000
	[0120.457] RtlSizeHeap (HeapHandle=0x590000, Flags=0x0, MemoryPointer=0x59a920) returned 0x62
	[0120.458] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0120.458] GetProcessHeap () returned 0x590000
	[0120.458] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0xe0) returned 0x59a990
	[0120.463] GetProcessHeap () returned 0x590000
	[0120.463] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x59a990, Size=0x76) returned 0x59a990
	[0120.463] GetProcessHeap () returned 0x590000
	[0120.463] RtlSizeHeap (HeapHandle=0x590000, Flags=0x0, MemoryPointer=0x59a990) returned 0x76
	[0120.463] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0120.463] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f\\im sqlagent.exe ", fInfoLevelId=0x1, lpFindFileData=0x19f958, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f958) returned 0xffffffff
	[0120.464] GetLastError () returned 0x3
	[0120.464] GetProcessHeap () returned 0x590000
	[0120.464] RtlFreeHeap (HeapHandle=0x590000, Flags=0x0, BaseAddress=0x59fc68) returned 1
	[0120.464] GetProcessHeap () returned 0x590000
	[0120.465] RtlFreeHeap (HeapHandle=0x590000, Flags=0x0, BaseAddress=0x5a3c78) returned 1
	[0120.465] GetProcessHeap () returned 0x590000
	[0120.465] RtlFreeHeap (HeapHandle=0x590000, Flags=0x0, BaseAddress=0x59bc50) returned 1
	[0120.466] GetConsoleOutputCP () returned 0x1b5
	[0120.475] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0120.475] GetUserDefaultLCID () returned 0x409
	[0120.475] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x13d34a0, cchData=8 | out: lpLCData=":") returned 2
	[0120.475] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0120.475] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0120.476] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2
	[0120.476] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x13d34b0, cchData=8 | out: lpLCData="/") returned 2
	[0120.476] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x13d3500, cchData=32 | out: lpLCData="Mon") returned 4
	[0120.476] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x13d3540, cchData=32 | out: lpLCData="Tue") returned 4
	[0120.476] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x13d3580, cchData=32 | out: lpLCData="Wed") returned 4
	[0120.476] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x13d35c0, cchData=32 | out: lpLCData="Thu") returned 4
	[0120.476] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x13d3600, cchData=32 | out: lpLCData="Fri") returned 4
	[0120.476] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x13d3640, cchData=32 | out: lpLCData="Sat") returned 4
	[0120.476] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x13d3680, cchData=32 | out: lpLCData="Sun") returned 4
	[0120.476] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x13d34c0, cchData=8 | out: lpLCData=".") returned 2
	[0120.476] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x13d34e0, cchData=8 | out: lpLCData=",") returned 2
	[0120.476] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0120.479] GetProcessHeap () returned 0x590000
	[0120.479] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x20c) returned 0x59aa58
	[0120.479] GetConsoleTitleW (in: lpConsoleTitle=0x59aa58, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0120.501] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0120.501] GetProcAddress (hModule=0x75600000, lpProcName="CopyFileExW") returned 0x7561ffc0
	[0120.501] GetProcAddress (hModule=0x75600000, lpProcName="IsDebuggerPresent") returned 0x7561b0b0
	[0120.501] GetProcAddress (hModule=0x75600000, lpProcName="SetConsoleInputExeNameW") returned 0x7559b440
	[0120.502] GetProcessHeap () returned 0x590000
	[0120.502] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x400a) returned 0x59bc50
	[0120.502] GetProcessHeap () returned 0x590000
	[0120.503] RtlFreeHeap (HeapHandle=0x590000, Flags=0x0, BaseAddress=0x59bc50) returned 1
	[0120.504] _wcsicmp (_String1="taskkill", _String2=")") returned 75
	[0120.504] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14
	[0120.504] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14
	[0120.504] _wcsicmp (_String1="IF", _String2="taskkill") returned -11
	[0120.504] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11
	[0120.504] _wcsicmp (_String1="REM", _String2="taskkill") returned -2
	[0120.504] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2
	[0120.504] GetProcessHeap () returned 0x590000
	[0120.504] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x58) returned 0x59ac70
	[0120.504] GetProcessHeap () returned 0x590000
	[0120.504] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x1a) returned 0x590578
	[0120.505] GetProcessHeap () returned 0x590000
	[0120.505] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x34) returned 0x59acd0
	[0120.506] GetConsoleTitleW (in: lpConsoleTitle=0x19fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0120.522] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0120.522] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0120.522] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0120.522] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0120.522] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0120.522] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0120.522] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0120.522] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0120.523] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0120.523] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0120.523] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0120.523] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0120.523] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0120.523] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0120.523] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0120.523] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0120.523] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0120.523] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0120.523] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0120.523] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0120.523] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0120.523] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0120.523] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0120.523] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0120.523] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0120.523] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0120.523] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0120.523] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0120.523] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0120.523] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0120.523] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0120.524] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0120.524] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0120.524] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0120.524] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0120.524] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0120.524] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0120.524] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0120.524] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0120.524] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0120.524] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0120.524] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0120.524] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0120.524] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0120.524] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0120.524] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0120.524] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0120.524] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0120.524] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0120.524] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0120.524] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0120.524] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0120.525] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0120.525] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0120.525] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0120.525] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0120.525] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0120.525] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0120.525] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0120.525] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0120.525] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0120.525] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0120.525] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0120.525] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0120.525] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0120.525] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0120.525] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0120.525] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0120.525] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0120.525] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0120.525] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0120.525] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0120.525] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0120.525] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0120.526] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0120.526] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0120.526] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0120.526] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0120.526] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0120.526] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0120.526] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0120.526] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0120.526] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0120.526] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0120.526] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14
	[0120.526] _wcsicmp (_String1="taskkill", _String2="IF") returned 11
	[0120.526] _wcsicmp (_String1="taskkill", _String2="REM") returned 2
	[0120.527] GetProcessHeap () returned 0x590000
	[0120.527] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x210) returned 0x59ad10
	[0120.527] GetProcessHeap () returned 0x590000
	[0120.527] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x46) returned 0x59af28
	[0120.527] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0120.527] GetProcessHeap () returned 0x590000
	[0120.527] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x418) returned 0x5905c8
	[0120.527] SetErrorMode (uMode=0x0) returned 0x8003
	[0120.527] SetErrorMode (uMode=0x1) returned 0x0
	[0120.528] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x5905d0, lpFilePart=0x19f57c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19f57c*="Desktop") returned 0x1d
	[0120.528] SetErrorMode (uMode=0x8003) returned 0x1
	[0120.528] GetProcessHeap () returned 0x590000
	[0120.528] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5905c8, Size=0x56) returned 0x5905c8
	[0120.528] GetProcessHeap () returned 0x590000
	[0120.528] RtlSizeHeap (HeapHandle=0x590000, Flags=0x0, MemoryPointer=0x5905c8) returned 0x56
	[0120.528] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0120.528] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0120.528] GetProcessHeap () returned 0x590000
	[0120.528] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x110) returned 0x59af78
	[0120.528] GetProcessHeap () returned 0x590000
	[0120.528] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x218) returned 0x590628
	[0120.535] GetProcessHeap () returned 0x590000
	[0120.535] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x590628, Size=0x112) returned 0x590628
	[0120.535] GetProcessHeap () returned 0x590000
	[0120.535] RtlSizeHeap (HeapHandle=0x590000, Flags=0x0, MemoryPointer=0x590628) returned 0x112
	[0120.535] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0120.535] GetProcessHeap () returned 0x590000
	[0120.535] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0xe0) returned 0x59b090
	[0120.537] GetProcessHeap () returned 0x590000
	[0120.537] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x59b090, Size=0x76) returned 0x59b090
	[0120.537] GetProcessHeap () returned 0x590000
	[0120.538] RtlSizeHeap (HeapHandle=0x590000, Flags=0x0, MemoryPointer=0x59b090) returned 0x76
	[0120.538] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0120.538] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0120.538] GetLastError () returned 0x2
	[0120.538] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0120.538] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x59b110
	[0120.539] GetProcessHeap () returned 0x590000
	[0120.539] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x14) returned 0x597428
	[0120.539] FindClose (in: hFindFile=0x59b110 | out: hFindFile=0x59b110) returned 1
	[0120.539] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0120.539] GetLastError () returned 0x2
	[0120.539] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x59b110
	[0120.540] GetProcessHeap () returned 0x590000
	[0120.540] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x597428, Size=0x4) returned 0x59b150
	[0120.540] FindClose (in: hFindFile=0x59b110 | out: hFindFile=0x59b110) returned 1
	[0120.540] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0120.540] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0120.540] GetConsoleTitleW (in: lpConsoleTitle=0x19f7fc, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0120.563] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f728, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f70c | out: lpAttributeList=0x19f728, lpSize=0x19f70c) returned 1
	[0120.563] UpdateProcThreadAttribute (in: lpAttributeList=0x19f728, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f714, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f728, lpPreviousValue=0x0) returned 1
	[0120.563] GetStartupInfoW (in: lpStartupInfo=0x19f760 | out: lpStartupInfo=0x19f760*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x130, hStdOutput=0x13c, hStdError=0x140)) 
	[0120.563] GetProcessHeap () returned 0x590000
	[0120.563] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x18) returned 0x597508
	[0120.563] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0120.563] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0120.563] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0120.563] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0120.563] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0120.563] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0120.563] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0120.564] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0120.564] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0120.564] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0120.564] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0120.564] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0120.564] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0120.564] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0120.564] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0120.564] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0120.564] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0120.564] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0120.564] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0120.564] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0120.564] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0120.564] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0120.564] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0120.564] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0120.564] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0120.564] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0120.564] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0120.564] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0120.564] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0120.565] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0120.565] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0120.565] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0120.565] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0120.565] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0120.565] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0120.565] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0120.565] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0120.565] GetProcessHeap () returned 0x590000
	[0120.565] RtlFreeHeap (HeapHandle=0x590000, Flags=0x0, BaseAddress=0x597508) returned 1
	[0120.565] GetProcessHeap () returned 0x590000
	[0120.565] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0xa) returned 0x59b110
	[0120.565] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1
	[0120.568] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill  /f /im sqlagent.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x19f6b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill  /f /im sqlagent.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f6fc | out: lpCommandLine="taskkill  /f /im sqlagent.exe ", lpProcessInformation=0x19f6fc*(hProcess=0x9c, hThread=0x98, dwProcessId=0xcdc, dwThreadId=0x788)) returned 1
	[0120.592] CloseHandle (hObject=0x98) returned 1
	[0120.592] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0120.592] GetProcessHeap () returned 0x590000
	[0120.593] RtlFreeHeap (HeapHandle=0x590000, Flags=0x0, BaseAddress=0x599d50) returned 1
	[0120.593] GetEnvironmentStringsW () returned 0x599d50*
	[0120.593] GetProcessHeap () returned 0x590000
	[0120.593] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0xa76) returned 0x597cc0
	[0120.593] FreeEnvironmentStringsA (penv="=") returned 1
	[0120.593] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0
	[0121.858] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x19f694 | out: lpExitCode=0x19f694*=0x80) returned 1
	[0121.859] CloseHandle (hObject=0x9c) returned 1
	[0121.859] _vsnwprintf (in: _Buffer=0x19f77c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f69c | out: _Buffer="00000080") returned 8
	[0121.859] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1
	[0121.859] GetProcessHeap () returned 0x590000
	[0121.860] RtlFreeHeap (HeapHandle=0x590000, Flags=0x0, BaseAddress=0x597cc0) returned 1
	[0121.860] GetEnvironmentStringsW () returned 0x59b160*
	[0121.860] GetProcessHeap () returned 0x590000
	[0121.860] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0xa9c) returned 0x597cc0
	[0121.860] FreeEnvironmentStringsA (penv="=") returned 1
	[0121.860] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0121.860] GetProcessHeap () returned 0x590000
	[0121.861] RtlFreeHeap (HeapHandle=0x590000, Flags=0x0, BaseAddress=0x597cc0) returned 1
	[0121.861] GetEnvironmentStringsW () returned 0x59b160*
	[0121.861] GetProcessHeap () returned 0x590000
	[0121.861] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0xa9c) returned 0x597cc0
	[0121.861] FreeEnvironmentStringsA (penv="=") returned 1
	[0121.861] GetProcessHeap () returned 0x590000
	[0121.861] RtlFreeHeap (HeapHandle=0x590000, Flags=0x0, BaseAddress=0x59b110) returned 1
	[0121.861] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f728 | out: lpAttributeList=0x19f728) 
	[0121.861] _get_osfhandle (_FileHandle=1) returned 0x13c
	[0121.861] SetConsoleMode (hConsoleHandle=0x13c, dwMode=0x0) returned 0
	[0121.861] _get_osfhandle (_FileHandle=1) returned 0x13c
	[0121.861] GetConsoleMode (in: hConsoleHandle=0x13c, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0121.861] _get_osfhandle (_FileHandle=0) returned 0x130
	[0121.861] GetConsoleMode (in: hConsoleHandle=0x130, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0121.861] GetConsoleOutputCP () returned 0x1b5
	[0121.863] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0121.863] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0121.865] exit (_Code=128) 

Thread:
	id = 127
	os_tid = 0x1244


Process:
	id = "8"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\syswow64\\taskkill.exe"
	page_root = "0x484da000"
	os_pid = "0xcdc"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "7"
	os_parent_pid = "0x13cc"
	cmd_line = "taskkill  /f /im sqlagent.exe "
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 1042
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 1043
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 1044
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 1045
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 1046
	        start_va = 0xa0000
	          end_va = 0xdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 1047
	        start_va = 0xe0000
	          end_va = 0xe3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 1048
	        start_va = 0xf0000
	          end_va = 0xf0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 1049
	        start_va = 0x100000
	          end_va = 0x101fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 1050
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 1051
	        start_va = 0x13b0000
	          end_va = 0x13c5fff
	       monitored = 0
	     entry_point = 0x13bde80
	     region_type = mapped_file
	            name = "taskkill.exe"
	        filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe")

Region:
	              id = 1052
	        start_va = 0x13d0000
	          end_va = 0x53cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000013d0000"
	        filename = ""

Region:
	              id = 1053
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 1054
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 1055
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1056
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 1057
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 1058
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 1059
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 1060
	        start_va = 0x110000
	          end_va = 0x11ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000110000"
	        filename = ""

Region:
	              id = 1061
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 1062
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 1063
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 1064
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 1065
	        start_va = 0x400000
	          end_va = 0x67ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 1068
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 1069
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 1070
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 1071
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 1072
	        start_va = 0x120000
	          end_va = 0x1ddfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1073
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 1074
	        start_va = 0x74650000
	          end_va = 0x746cafff
	       monitored = 0
	     entry_point = 0x7466e970
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 1075
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 1076
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 1077
	        start_va = 0x440000
	          end_va = 0x47ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000440000"
	        filename = ""

Region:
	              id = 1078
	        start_va = 0x580000
	          end_va = 0x67ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000580000"
	        filename = ""

Region:
	              id = 1079
	        start_va = 0x76ae0000
	          end_va = 0x76b23fff
	       monitored = 0
	     entry_point = 0x76af9d80
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 1080
	        start_va = 0x75260000
	          end_va = 0x7530cfff
	       monitored = 0
	     entry_point = 0x75274f00
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 1081
	        start_va = 0x74450000
	          end_va = 0x7446dfff
	       monitored = 0
	     entry_point = 0x7445b640
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 1082
	        start_va = 0x74440000
	          end_va = 0x74449fff
	       monitored = 0
	     entry_point = 0x74442a00
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 1083
	        start_va = 0x74590000
	          end_va = 0x745e7fff
	       monitored = 0
	     entry_point = 0x745d25c0
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 1084
	        start_va = 0x77450000
	          end_va = 0x77596fff
	       monitored = 0
	     entry_point = 0x77461cf0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 1085
	        start_va = 0x76b30000
	          end_va = 0x76c7efff
	       monitored = 0
	     entry_point = 0x76be6820
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 1086
	        start_va = 0x753c0000
	          end_va = 0x75451fff
	       monitored = 0
	     entry_point = 0x753f8cf0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 1087
	        start_va = 0x77290000
	          end_va = 0x7744cfff
	       monitored = 0
	     entry_point = 0x77372a10
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")

Region:
	              id = 1088
	        start_va = 0x75310000
	          end_va = 0x7536efff
	       monitored = 0
	     entry_point = 0x75314af0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 1089
	        start_va = 0x77240000
	          end_va = 0x77284fff
	       monitored = 0
	     entry_point = 0x7725de90
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 1090
	        start_va = 0x6cc90000
	          end_va = 0x6cc97fff
	       monitored = 0
	     entry_point = 0x6cc917b0
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 1091
	        start_va = 0x6cc70000
	          end_va = 0x6cc85fff
	       monitored = 0
	     entry_point = 0x6cc721d0
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")

Region:
	              id = 1092
	        start_va = 0x6cc30000
	          end_va = 0x6cc6efff
	       monitored = 0
	     entry_point = 0x6cc446c0
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll")

Region:
	              id = 1093
	        start_va = 0x6cac0000
	          end_va = 0x6cac9fff
	       monitored = 0
	     entry_point = 0x6cac28d0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")

Region:
	              id = 1094
	        start_va = 0x6cad0000
	          end_va = 0x6caebfff
	       monitored = 0
	     entry_point = 0x6cad4720
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")

Region:
	              id = 1095
	        start_va = 0x6caf0000
	          end_va = 0x6cc2efff
	       monitored = 0
	     entry_point = 0x6cb1d880
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll")

Region:
	              id = 1096
	        start_va = 0x680000
	          end_va = 0x7bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000680000"
	        filename = ""

Region:
	              id = 1097
	        start_va = 0x480000
	          end_va = 0x4a9fff
	       monitored = 0
	     entry_point = 0x485680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 1098
	        start_va = 0x7c0000
	          end_va = 0x947fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000007c0000"
	        filename = ""

Region:
	              id = 1099
	        start_va = 0x74ea0000
	          end_va = 0x74ecafff
	       monitored = 0
	     entry_point = 0x74ea5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 1100
	        start_va = 0x950000
	          end_va = 0xad0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000950000"
	        filename = ""

Region:
	              id = 1101
	        start_va = 0x53d0000
	          end_va = 0x67cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000053d0000"
	        filename = ""

Region:
	              id = 1102
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 1103
	        start_va = 0x1e0000
	          end_va = 0x1e0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001e0000"
	        filename = ""

Region:
	              id = 1104
	        start_va = 0x1f0000
	          end_va = 0x1f4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taskkill.exe.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui")

Region:
	              id = 1105
	        start_va = 0x480000
	          end_va = 0x480fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 1106
	        start_va = 0x490000
	          end_va = 0x490fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000490000"
	        filename = ""

Region:
	              id = 1107
	        start_va = 0xae0000
	          end_va = 0xe16fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 1108
	        start_va = 0x680000
	          end_va = 0x769fff
	       monitored = 0
	     entry_point = 0x6bd650
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 1109
	        start_va = 0x7b0000
	          end_va = 0x7bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000007b0000"
	        filename = ""

Region:
	              id = 1110
	        start_va = 0x4a0000
	          end_va = 0x4a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004a0000"
	        filename = ""

Region:
	              id = 1111
	        start_va = 0x680000
	          end_va = 0x75ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 1112
	        start_va = 0x76e20000
	          end_va = 0x76e2bfff
	       monitored = 0
	     entry_point = 0x76e23930
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")

Region:
	              id = 1113
	        start_va = 0x4b0000
	          end_va = 0x4b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004b0000"
	        filename = ""

Region:
	              id = 1114
	        start_va = 0x76c80000
	          end_va = 0x76d03fff
	       monitored = 0
	     entry_point = 0x76ca6220
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 1115
	        start_va = 0x4c0000
	          end_va = 0x4c0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004c0000"
	        filename = ""

Region:
	              id = 1116
	        start_va = 0x6cab0000
	          end_va = 0x6cabcfff
	       monitored = 0
	     entry_point = 0x6cab3520
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 1117
	        start_va = 0x6ca40000
	          end_va = 0x6caa6fff
	       monitored = 0
	     entry_point = 0x6ca5b610
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 1118
	        start_va = 0x740f0000
	          end_va = 0x7410afff
	       monitored = 0
	     entry_point = 0x740f9050
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 1119
	        start_va = 0x6c9f0000
	          end_va = 0x6ca33fff
	       monitored = 0
	     entry_point = 0x6ca0aaf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")

Region:
	              id = 1120
	        start_va = 0x4d0000
	          end_va = 0x50ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004d0000"
	        filename = ""

Region:
	              id = 1121
	        start_va = 0x510000
	          end_va = 0x54ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000510000"
	        filename = ""

Region:
	              id = 1122
	        start_va = 0x760000
	          end_va = 0x79ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000760000"
	        filename = ""

Region:
	              id = 1123
	        start_va = 0xe20000
	          end_va = 0xe5ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e20000"
	        filename = ""

Region:
	              id = 1124
	        start_va = 0xe60000
	          end_va = 0xe9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e60000"
	        filename = ""

Region:
	              id = 1125
	        start_va = 0xea0000
	          end_va = 0xedffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ea0000"
	        filename = ""

Region:
	              id = 1126
	        start_va = 0x6c9d0000
	          end_va = 0x6c9e0fff
	       monitored = 0
	     entry_point = 0x6c9d8fa0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 1127
	        start_va = 0x6c910000
	          end_va = 0x6c9cefff
	       monitored = 0
	     entry_point = 0x6c941e80
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 1130
	        start_va = 0x550000
	          end_va = 0x555fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000550000"
	        filename = ""


Thread:
	id = 128
	os_tid = 0x788


Thread:
	id = 129
	os_tid = 0x4a4


Thread:
	id = 130
	os_tid = 0x11c


Thread:
	id = 131
	os_tid = 0x1304


Thread:
	id = 132
	os_tid = 0x460


Process:
	id = "9"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x485c2000"
	os_pid = "0x654"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x614"
	cmd_line = "cmd.exe /c \"taskkill /f /im sqlbrowser.exe \""
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 1133
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 1134
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 1135
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 1136
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 1137
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 1138
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 1139
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 1140
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 1141
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 1142
	        start_va = 0x13a0000
	          end_va = 0x13f1fff
	       monitored = 1
	     entry_point = 0x13b4fd0
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")

Region:
	              id = 1143
	        start_va = 0x1400000
	          end_va = 0x53fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001400000"
	        filename = ""

Region:
	              id = 1144
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 1145
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 1146
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1147
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 1148
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 1149
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 1150
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 1151
	        start_va = 0x400000
	          end_va = 0x5cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 1152
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 1153
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 1154
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 1155
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 1156
	        start_va = 0x5d0000
	          end_va = 0x83ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005d0000"
	        filename = ""

Region:
	              id = 1157
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 1158
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 1159
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 1160
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 1161
	        start_va = 0x400000
	          end_va = 0x4bdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1162
	        start_va = 0x5c0000
	          end_va = 0x5cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005c0000"
	        filename = ""

Region:
	              id = 1163
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 1164
	        start_va = 0x4c0000
	          end_va = 0x4fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004c0000"
	        filename = ""

Region:
	              id = 1165
	        start_va = 0x5d0000
	          end_va = 0x6cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005d0000"
	        filename = ""

Region:
	              id = 1166
	        start_va = 0x740000
	          end_va = 0x83ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000740000"
	        filename = ""

Region:
	              id = 1167
	        start_va = 0x840000
	          end_va = 0x99ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000840000"
	        filename = ""

Region:
	              id = 1168
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 1169
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 1170
	        start_va = 0x9a0000
	          end_va = 0xcd6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 133
	os_tid = 0x238

	[0122.139] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000
	[0122.139] __set_app_type (_Type=0x1) 
	[0122.139] __p__fmode () returned 0x74974d6c
	[0122.139] __p__commode () returned 0x74975b1c
	[0122.139] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13b5200) returned 0x0
	[0122.139] __getmainargs (in: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0, _DoWildCard=0, _StartInfo=0x13c60fc | out: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0) returned 0
	[0122.139] GetCurrentThreadId () returned 0x238
	[0122.139] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x238) returned 0x78
	[0122.140] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0122.140] GetProcAddress (hModule=0x75600000, lpProcName="SetThreadUILanguage") returned 0x75642510
	[0122.140] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0122.144] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0122.144] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2
	[0122.144] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0122.144] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0122.144] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0122.144] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0122.144] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0122.144] GetConsoleOutputCP () returned 0x1b5
	[0122.148] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0122.148] SetConsoleCtrlHandler (HandlerRoutine=0x13c0e40, Add=1) returned 1
	[0122.149] _get_osfhandle (_FileHandle=1) returned 0x130
	[0122.149] SetConsoleMode (hConsoleHandle=0x130, dwMode=0x0) returned 0
	[0122.149] _get_osfhandle (_FileHandle=1) returned 0x130
	[0122.149] GetConsoleMode (in: hConsoleHandle=0x130, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0122.149] _get_osfhandle (_FileHandle=0) returned 0x154
	[0122.149] GetConsoleMode (in: hConsoleHandle=0x154, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0122.149] GetEnvironmentStringsW () returned 0x747d68*
	[0122.149] GetProcessHeap () returned 0x740000
	[0122.149] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0xa1a) returned 0x748790
	[0122.149] FreeEnvironmentStringsA (penv="A") returned 1
	[0122.149] GetProcessHeap () returned 0x740000
	[0122.149] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x4) returned 0x744448
	[0122.149] GetEnvironmentStringsW () returned 0x747d68*
	[0122.149] GetProcessHeap () returned 0x740000
	[0122.149] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0xa1a) returned 0x7491b8
	[0122.149] FreeEnvironmentStringsA (penv="A") returned 1
	[0122.149] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0122.149] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0122.150] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0122.150] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0122.150] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0122.150] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0122.150] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0122.150] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0122.150] RegCloseKey (hKey=0x88) returned 0x0
	[0122.150] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0122.150] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0122.150] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0122.150] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0122.150] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0122.150] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0122.150] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0122.150] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0122.150] RegCloseKey (hKey=0x88) returned 0x0
	[0122.150] time (in: timer=0x0 | out: timer=0x0) returned 0x62344204
	[0122.151] srand (_Seed=0x62344204) 
	[0122.151] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im sqlbrowser.exe \""
	[0122.151] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im sqlbrowser.exe \""
	[0122.151] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0122.151] GetProcessHeap () returned 0x740000
	[0122.151] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x210) returned 0x749be0
	[0122.151] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x749be8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0122.151] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0122.151] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0122.151] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0122.151] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0122.151] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0122.151] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0122.151] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0122.151] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0122.151] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0122.151] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0122.151] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0122.151] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0122.152] GetProcessHeap () returned 0x740000
	[0122.152] RtlFreeHeap (HeapHandle=0x740000, Flags=0x0, BaseAddress=0x748790) returned 1
	[0122.152] GetEnvironmentStringsW () returned 0x747d68*
	[0122.152] GetProcessHeap () returned 0x740000
	[0122.152] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0xa32) returned 0x74a838
	[0122.152] FreeEnvironmentStringsA (penv="A") returned 1
	[0122.152] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b
	[0122.153] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0122.153] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0122.153] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0122.153] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0122.153] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0122.153] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0122.153] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0122.153] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0122.153] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0122.153] GetProcessHeap () returned 0x740000
	[0122.153] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x44) returned 0x7442e8
	[0122.153] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0122.153] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19fc4c*="Desktop") returned 0x1d
	[0122.153] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0122.153] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x744338
	[0122.153] FindClose (in: hFindFile=0x744338 | out: hFindFile=0x744338) returned 1
	[0122.153] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x744338
	[0122.154] FindClose (in: hFindFile=0x744338 | out: hFindFile=0x744338) returned 1
	[0122.154] _wcsnicmp (_String1="RDHJ0C~1", _String2="RDhJ0CNFevzX", _MaxCount=0xc) returned 16
	[0122.154] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x744338
	[0122.154] FindClose (in: hFindFile=0x744338 | out: hFindFile=0x744338) returned 1
	[0122.154] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0122.154] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1
	[0122.154] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 1
	[0122.154] GetProcessHeap () returned 0x740000
	[0122.155] RtlFreeHeap (HeapHandle=0x740000, Flags=0x0, BaseAddress=0x74a838) returned 1
	[0122.155] GetEnvironmentStringsW () returned 0x747d68*
	[0122.155] GetProcessHeap () returned 0x740000
	[0122.155] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0xa76) returned 0x749df8
	[0122.155] FreeEnvironmentStringsA (penv="=") returned 1
	[0122.155] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0122.155] GetProcessHeap () returned 0x740000
	[0122.155] RtlFreeHeap (HeapHandle=0x740000, Flags=0x0, BaseAddress=0x7442e8) returned 1
	[0122.155] GetProcessHeap () returned 0x740000
	[0122.155] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x400e) returned 0x74bcf8
	[0122.156] GetProcessHeap () returned 0x740000
	[0122.156] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x50) returned 0x7442e8
	[0122.156] GetProcessHeap () returned 0x740000
	[0122.156] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x4008) returned 0x74fd10
	[0122.156] GetProcessHeap () returned 0x740000
	[0122.156] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x4008) returned 0x753d20
	[0122.158] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0122.158] GetProcessHeap () returned 0x740000
	[0122.158] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x418) returned 0x74a878
	[0122.158] SetErrorMode (uMode=0x0) returned 0x8003
	[0122.158] SetErrorMode (uMode=0x1) returned 0x0
	[0122.158] GetFullPathNameW (in: lpFileName="taskkill \\f \\.", nBufferLength=0x208, lpBuffer=0x74a880, lpFilePart=0x19fbac | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f", lpFilePart=0x19fbac*="f") returned 0x29
	[0122.158] SetErrorMode (uMode=0x8003) returned 0x1
	[0122.158] GetProcessHeap () returned 0x740000
	[0122.158] RtlReAllocateHeap (Heap=0x740000, Flags=0x0, Ptr=0x74a878, Size=0x82) returned 0x74a878
	[0122.158] GetProcessHeap () returned 0x740000
	[0122.158] RtlSizeHeap (HeapHandle=0x740000, Flags=0x0, MemoryPointer=0x74a878) returned 0x82
	[0122.159] NeedCurrentDirectoryForExePathW (ExeName="taskkill \\f \\.") returned 1
	[0122.159] GetProcessHeap () returned 0x740000
	[0122.159] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x62) returned 0x74a908
	[0122.159] GetProcessHeap () returned 0x740000
	[0122.159] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0xb8) returned 0x74a978
	[0122.159] GetProcessHeap () returned 0x740000
	[0122.159] RtlReAllocateHeap (Heap=0x740000, Flags=0x0, Ptr=0x74a978, Size=0x62) returned 0x74a978
	[0122.159] GetProcessHeap () returned 0x740000
	[0122.159] RtlSizeHeap (HeapHandle=0x740000, Flags=0x0, MemoryPointer=0x74a978) returned 0x62
	[0122.159] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0122.159] GetProcessHeap () returned 0x740000
	[0122.159] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0xe0) returned 0x74a9e8
	[0122.163] GetProcessHeap () returned 0x740000
	[0122.163] RtlReAllocateHeap (Heap=0x740000, Flags=0x0, Ptr=0x74a9e8, Size=0x76) returned 0x74a9e8
	[0122.163] GetProcessHeap () returned 0x740000
	[0122.163] RtlSizeHeap (HeapHandle=0x740000, Flags=0x0, MemoryPointer=0x74a9e8) returned 0x76
	[0122.163] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0122.163] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f\\im sqlbrowser.exe ", fInfoLevelId=0x1, lpFindFileData=0x19f958, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f958) returned 0xffffffff
	[0122.163] GetLastError () returned 0x3
	[0122.163] GetProcessHeap () returned 0x740000
	[0122.164] RtlFreeHeap (HeapHandle=0x740000, Flags=0x0, BaseAddress=0x74fd10) returned 1
	[0122.164] GetProcessHeap () returned 0x740000
	[0122.164] RtlFreeHeap (HeapHandle=0x740000, Flags=0x0, BaseAddress=0x753d20) returned 1
	[0122.164] GetProcessHeap () returned 0x740000
	[0122.165] RtlFreeHeap (HeapHandle=0x740000, Flags=0x0, BaseAddress=0x74bcf8) returned 1
	[0122.165] GetConsoleOutputCP () returned 0x1b5
	[0122.166] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0122.167] GetUserDefaultLCID () returned 0x409
	[0122.167] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x13d34a0, cchData=8 | out: lpLCData=":") returned 2
	[0122.167] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0122.167] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0122.167] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2
	[0122.167] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x13d34b0, cchData=8 | out: lpLCData="/") returned 2
	[0122.167] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x13d3500, cchData=32 | out: lpLCData="Mon") returned 4
	[0122.167] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x13d3540, cchData=32 | out: lpLCData="Tue") returned 4
	[0122.167] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x13d3580, cchData=32 | out: lpLCData="Wed") returned 4
	[0122.167] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x13d35c0, cchData=32 | out: lpLCData="Thu") returned 4
	[0122.167] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x13d3600, cchData=32 | out: lpLCData="Fri") returned 4
	[0122.167] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x13d3640, cchData=32 | out: lpLCData="Sat") returned 4
	[0122.167] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x13d3680, cchData=32 | out: lpLCData="Sun") returned 4
	[0122.167] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x13d34c0, cchData=8 | out: lpLCData=".") returned 2
	[0122.167] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x13d34e0, cchData=8 | out: lpLCData=",") returned 2
	[0122.167] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0122.169] GetProcessHeap () returned 0x740000
	[0122.169] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x0, Size=0x20c) returned 0x74aa68
	[0122.169] GetConsoleTitleW (in: lpConsoleTitle=0x74aa68, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0122.170] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0122.170] GetProcAddress (hModule=0x75600000, lpProcName="CopyFileExW") returned 0x7561ffc0
	[0122.170] GetProcAddress (hModule=0x75600000, lpProcName="IsDebuggerPresent") returned 0x7561b0b0
	[0122.170] GetProcAddress (hModule=0x75600000, lpProcName="SetConsoleInputExeNameW") returned 0x7559b440
	[0122.170] GetProcessHeap () returned 0x740000
	[0122.170] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x400a) returned 0x74bcf8
	[0122.170] GetProcessHeap () returned 0x740000
	[0122.171] RtlFreeHeap (HeapHandle=0x740000, Flags=0x0, BaseAddress=0x74bcf8) returned 1
	[0122.171] _wcsicmp (_String1="taskkill", _String2=")") returned 75
	[0122.172] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14
	[0122.172] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14
	[0122.172] _wcsicmp (_String1="IF", _String2="taskkill") returned -11
	[0122.172] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11
	[0122.172] _wcsicmp (_String1="REM", _String2="taskkill") returned -2
	[0122.172] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2
	[0122.172] GetProcessHeap () returned 0x740000
	[0122.172] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x58) returned 0x74ac80
	[0122.172] GetProcessHeap () returned 0x740000
	[0122.172] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x1a) returned 0x74ace0
	[0122.172] GetProcessHeap () returned 0x740000
	[0122.172] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x38) returned 0x74ad08
	[0122.173] GetConsoleTitleW (in: lpConsoleTitle=0x19fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0122.175] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0122.175] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0122.175] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0122.175] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0122.175] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0122.175] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0122.175] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0122.175] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0122.175] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0122.175] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0122.176] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0122.176] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0122.176] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0122.176] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0122.176] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0122.176] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0122.176] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0122.176] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0122.176] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0122.176] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0122.176] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0122.176] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0122.176] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0122.176] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0122.176] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0122.176] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0122.176] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0122.176] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0122.176] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0122.176] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0122.176] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0122.176] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0122.176] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0122.176] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0122.176] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0122.176] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0122.176] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0122.176] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0122.176] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0122.176] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0122.176] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0122.176] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0122.176] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0122.176] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0122.177] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0122.177] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0122.177] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0122.177] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0122.177] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0122.177] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0122.177] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0122.177] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0122.177] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0122.177] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0122.177] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0122.177] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0122.177] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0122.177] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0122.177] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0122.177] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0122.177] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0122.177] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0122.177] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0122.177] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0122.177] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0122.177] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0122.177] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0122.177] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0122.177] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0122.177] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0122.177] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0122.177] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0122.177] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0122.177] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0122.177] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0122.177] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0122.177] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0122.177] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0122.177] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0122.177] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0122.178] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0122.178] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0122.178] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0122.178] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0122.178] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14
	[0122.178] _wcsicmp (_String1="taskkill", _String2="IF") returned 11
	[0122.178] _wcsicmp (_String1="taskkill", _String2="REM") returned 2
	[0122.178] GetProcessHeap () returned 0x740000
	[0122.178] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x210) returned 0x74ad48
	[0122.178] GetProcessHeap () returned 0x740000
	[0122.178] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x4a) returned 0x74af60
	[0122.178] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0122.178] GetProcessHeap () returned 0x740000
	[0122.178] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x418) returned 0x7405c8
	[0122.178] SetErrorMode (uMode=0x0) returned 0x8003
	[0122.179] SetErrorMode (uMode=0x1) returned 0x0
	[0122.179] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x7405d0, lpFilePart=0x19f57c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19f57c*="Desktop") returned 0x1d
	[0122.179] SetErrorMode (uMode=0x8003) returned 0x1
	[0122.179] GetProcessHeap () returned 0x740000
	[0122.179] RtlReAllocateHeap (Heap=0x740000, Flags=0x0, Ptr=0x7405c8, Size=0x56) returned 0x7405c8
	[0122.179] GetProcessHeap () returned 0x740000
	[0122.179] RtlSizeHeap (HeapHandle=0x740000, Flags=0x0, MemoryPointer=0x7405c8) returned 0x56
	[0122.179] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0122.179] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0122.179] GetProcessHeap () returned 0x740000
	[0122.179] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x110) returned 0x74afb8
	[0122.179] GetProcessHeap () returned 0x740000
	[0122.179] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x218) returned 0x740628
	[0122.184] GetProcessHeap () returned 0x740000
	[0122.184] RtlReAllocateHeap (Heap=0x740000, Flags=0x0, Ptr=0x740628, Size=0x112) returned 0x740628
	[0122.184] GetProcessHeap () returned 0x740000
	[0122.184] RtlSizeHeap (HeapHandle=0x740000, Flags=0x0, MemoryPointer=0x740628) returned 0x112
	[0122.184] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0122.184] GetProcessHeap () returned 0x740000
	[0122.184] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0xe0) returned 0x74b0d0
	[0122.186] GetProcessHeap () returned 0x740000
	[0122.186] RtlReAllocateHeap (Heap=0x740000, Flags=0x0, Ptr=0x74b0d0, Size=0x76) returned 0x74b0d0
	[0122.186] GetProcessHeap () returned 0x740000
	[0122.186] RtlSizeHeap (HeapHandle=0x740000, Flags=0x0, MemoryPointer=0x74b0d0) returned 0x76
	[0122.186] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0122.186] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0122.186] GetLastError () returned 0x2
	[0122.186] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0122.186] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x74b150
	[0122.187] GetProcessHeap () returned 0x740000
	[0122.187] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x0, Size=0x14) returned 0x7440c0
	[0122.187] FindClose (in: hFindFile=0x74b150 | out: hFindFile=0x74b150) returned 1
	[0122.187] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0122.187] GetLastError () returned 0x2
	[0122.187] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x74b150
	[0122.187] GetProcessHeap () returned 0x740000
	[0122.187] RtlReAllocateHeap (Heap=0x740000, Flags=0x0, Ptr=0x7440c0, Size=0x4) returned 0x744388
	[0122.187] FindClose (in: hFindFile=0x74b150 | out: hFindFile=0x74b150) returned 1
	[0122.187] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0122.187] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0122.187] GetConsoleTitleW (in: lpConsoleTitle=0x19f7fc, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0122.195] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f728, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f70c | out: lpAttributeList=0x19f728, lpSize=0x19f70c) returned 1
	[0122.195] UpdateProcThreadAttribute (in: lpAttributeList=0x19f728, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f714, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f728, lpPreviousValue=0x0) returned 1
	[0122.195] GetStartupInfoW (in: lpStartupInfo=0x19f760 | out: lpStartupInfo=0x19f760*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x154, hStdOutput=0x130, hStdError=0x13c)) 
	[0122.196] GetProcessHeap () returned 0x740000
	[0122.196] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x18) returned 0x743fc0
	[0122.196] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0122.196] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0122.196] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0122.196] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0122.196] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0122.196] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0122.196] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0122.196] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0122.196] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0122.196] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0122.196] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0122.196] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0122.196] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0122.196] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0122.196] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0122.196] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0122.196] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0122.196] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0122.196] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0122.196] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0122.196] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0122.196] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0122.196] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0122.196] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0122.196] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0122.196] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0122.197] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0122.197] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0122.197] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0122.197] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0122.197] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0122.197] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0122.197] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0122.197] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0122.197] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0122.197] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0122.197] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0122.197] GetProcessHeap () returned 0x740000
	[0122.197] RtlFreeHeap (HeapHandle=0x740000, Flags=0x0, BaseAddress=0x743fc0) returned 1
	[0122.197] GetProcessHeap () returned 0x740000
	[0122.197] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0xa) returned 0x74b150
	[0122.197] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1
	[0122.200] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill  /f /im sqlbrowser.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x19f6b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill  /f /im sqlbrowser.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f6fc | out: lpCommandLine="taskkill  /f /im sqlbrowser.exe ", lpProcessInformation=0x19f6fc*(hProcess=0x9c, hThread=0x98, dwProcessId=0x13d8, dwThreadId=0xcf0)) returned 1
	[0122.217] CloseHandle (hObject=0x98) returned 1
	[0122.217] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0122.218] GetProcessHeap () returned 0x740000
	[0122.218] RtlFreeHeap (HeapHandle=0x740000, Flags=0x0, BaseAddress=0x749df8) returned 1
	[0122.220] GetEnvironmentStringsW () returned 0x749df8*
	[0122.220] GetProcessHeap () returned 0x740000
	[0122.220] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0xa76) returned 0x747d68
	[0122.220] FreeEnvironmentStringsA (penv="=") returned 1
	[0122.221] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0
	[0123.351] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x19f694 | out: lpExitCode=0x19f694*=0x80) returned 1
	[0123.351] CloseHandle (hObject=0x9c) returned 1
	[0123.352] _vsnwprintf (in: _Buffer=0x19f77c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f69c | out: _Buffer="00000080") returned 8
	[0123.352] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1
	[0123.352] GetProcessHeap () returned 0x740000
	[0123.353] RtlFreeHeap (HeapHandle=0x740000, Flags=0x0, BaseAddress=0x747d68) returned 1
	[0123.353] GetEnvironmentStringsW () returned 0x747d68*
	[0123.353] GetProcessHeap () returned 0x740000
	[0123.353] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0xa9c) returned 0x74c7a0
	[0123.353] FreeEnvironmentStringsA (penv="=") returned 1
	[0123.353] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0123.353] GetProcessHeap () returned 0x740000
	[0123.354] RtlFreeHeap (HeapHandle=0x740000, Flags=0x0, BaseAddress=0x74c7a0) returned 1
	[0123.354] GetEnvironmentStringsW () returned 0x747d68*
	[0123.354] GetProcessHeap () returned 0x740000
	[0123.354] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0xa9c) returned 0x74c7a0
	[0123.354] FreeEnvironmentStringsA (penv="=") returned 1
	[0123.354] GetProcessHeap () returned 0x740000
	[0123.354] RtlFreeHeap (HeapHandle=0x740000, Flags=0x0, BaseAddress=0x74b150) returned 1
	[0123.354] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f728 | out: lpAttributeList=0x19f728) 
	[0123.355] _get_osfhandle (_FileHandle=1) returned 0x130
	[0123.355] SetConsoleMode (hConsoleHandle=0x130, dwMode=0x0) returned 0
	[0123.355] _get_osfhandle (_FileHandle=1) returned 0x130
	[0123.355] GetConsoleMode (in: hConsoleHandle=0x130, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0123.355] _get_osfhandle (_FileHandle=0) returned 0x154
	[0123.355] GetConsoleMode (in: hConsoleHandle=0x154, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0123.355] GetConsoleOutputCP () returned 0x1b5
	[0123.356] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0123.356] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0123.358] exit (_Code=128) 

Thread:
	id = 134
	os_tid = 0xbd4


Process:
	id = "10"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\syswow64\\taskkill.exe"
	page_root = "0x48317000"
	os_pid = "0x13d8"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "9"
	os_parent_pid = "0x654"
	cmd_line = "taskkill  /f /im sqlbrowser.exe "
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 1171
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 1172
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 1173
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 1174
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 1175
	        start_va = 0xa0000
	          end_va = 0xdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 1176
	        start_va = 0xe0000
	          end_va = 0xe3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 1177
	        start_va = 0xf0000
	          end_va = 0xf0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 1178
	        start_va = 0x100000
	          end_va = 0x101fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 1179
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 1180
	        start_va = 0x13b0000
	          end_va = 0x13c5fff
	       monitored = 0
	     entry_point = 0x13bde80
	     region_type = mapped_file
	            name = "taskkill.exe"
	        filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe")

Region:
	              id = 1181
	        start_va = 0x13d0000
	          end_va = 0x53cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000013d0000"
	        filename = ""

Region:
	              id = 1182
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 1183
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 1184
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1185
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 1186
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 1187
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 1188
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 1189
	        start_va = 0x110000
	          end_va = 0x1affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000110000"
	        filename = ""

Region:
	              id = 1190
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 1191
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 1192
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 1193
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 1194
	        start_va = 0x400000
	          end_va = 0x5cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 1195
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 1196
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 1197
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 1198
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 1199
	        start_va = 0x400000
	          end_va = 0x4bdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1200
	        start_va = 0x4d0000
	          end_va = 0x5cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004d0000"
	        filename = ""

Region:
	              id = 1201
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 1202
	        start_va = 0x74650000
	          end_va = 0x746cafff
	       monitored = 0
	     entry_point = 0x7466e970
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 1203
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 1204
	        start_va = 0x110000
	          end_va = 0x14ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000110000"
	        filename = ""

Region:
	              id = 1205
	        start_va = 0x150000
	          end_va = 0x18ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000150000"
	        filename = ""

Region:
	              id = 1206
	        start_va = 0x1a0000
	          end_va = 0x1affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001a0000"
	        filename = ""

Region:
	              id = 1207
	        start_va = 0x76ae0000
	          end_va = 0x76b23fff
	       monitored = 0
	     entry_point = 0x76af9d80
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 1208
	        start_va = 0x75260000
	          end_va = 0x7530cfff
	       monitored = 0
	     entry_point = 0x75274f00
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 1209
	        start_va = 0x74450000
	          end_va = 0x7446dfff
	       monitored = 0
	     entry_point = 0x7445b640
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 1210
	        start_va = 0x74440000
	          end_va = 0x74449fff
	       monitored = 0
	     entry_point = 0x74442a00
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 1211
	        start_va = 0x74590000
	          end_va = 0x745e7fff
	       monitored = 0
	     entry_point = 0x745d25c0
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 1212
	        start_va = 0x77450000
	          end_va = 0x77596fff
	       monitored = 0
	     entry_point = 0x77461cf0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 1213
	        start_va = 0x76b30000
	          end_va = 0x76c7efff
	       monitored = 0
	     entry_point = 0x76be6820
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 1214
	        start_va = 0x753c0000
	          end_va = 0x75451fff
	       monitored = 0
	     entry_point = 0x753f8cf0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 1215
	        start_va = 0x77290000
	          end_va = 0x7744cfff
	       monitored = 0
	     entry_point = 0x77372a10
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")

Region:
	              id = 1216
	        start_va = 0x75310000
	          end_va = 0x7536efff
	       monitored = 0
	     entry_point = 0x75314af0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 1217
	        start_va = 0x77240000
	          end_va = 0x77284fff
	       monitored = 0
	     entry_point = 0x7725de90
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 1218
	        start_va = 0x6cc90000
	          end_va = 0x6cc97fff
	       monitored = 0
	     entry_point = 0x6cc917b0
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 1219
	        start_va = 0x6cc70000
	          end_va = 0x6cc85fff
	       monitored = 0
	     entry_point = 0x6cc721d0
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")

Region:
	              id = 1220
	        start_va = 0x6cc30000
	          end_va = 0x6cc6efff
	       monitored = 0
	     entry_point = 0x6cc446c0
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll")

Region:
	              id = 1221
	        start_va = 0x6caf0000
	          end_va = 0x6cc2efff
	       monitored = 0
	     entry_point = 0x6cb1d880
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll")

Region:
	              id = 1222
	        start_va = 0x6cac0000
	          end_va = 0x6cac9fff
	       monitored = 0
	     entry_point = 0x6cac28d0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")

Region:
	              id = 1223
	        start_va = 0x6cad0000
	          end_va = 0x6caebfff
	       monitored = 0
	     entry_point = 0x6cad4720
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")

Region:
	              id = 1224
	        start_va = 0x5d0000
	          end_va = 0x68ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005d0000"
	        filename = ""

Region:
	              id = 1225
	        start_va = 0x1b0000
	          end_va = 0x1d9fff
	       monitored = 0
	     entry_point = 0x1b5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 1226
	        start_va = 0x690000
	          end_va = 0x817fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000690000"
	        filename = ""

Region:
	              id = 1227
	        start_va = 0x74ea0000
	          end_va = 0x74ecafff
	       monitored = 0
	     entry_point = 0x74ea5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 1228
	        start_va = 0x820000
	          end_va = 0x9a0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000820000"
	        filename = ""

Region:
	              id = 1229
	        start_va = 0x53d0000
	          end_va = 0x67cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000053d0000"
	        filename = ""

Region:
	              id = 1230
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 1231
	        start_va = 0x190000
	          end_va = 0x190fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000190000"
	        filename = ""

Region:
	              id = 1232
	        start_va = 0x1b0000
	          end_va = 0x1b4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taskkill.exe.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui")

Region:
	              id = 1233
	        start_va = 0x1c0000
	          end_va = 0x1c0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 1234
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001d0000"
	        filename = ""

Region:
	              id = 1235
	        start_va = 0x9b0000
	          end_va = 0xce6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 1236
	        start_va = 0xcf0000
	          end_va = 0xdd9fff
	       monitored = 0
	     entry_point = 0xd2d650
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 1237
	        start_va = 0x1e0000
	          end_va = 0x1e3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001e0000"
	        filename = ""

Region:
	              id = 1238
	        start_va = 0xcf0000
	          end_va = 0xdcffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 1239
	        start_va = 0x76e20000
	          end_va = 0x76e2bfff
	       monitored = 0
	     entry_point = 0x76e23930
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")

Region:
	              id = 1240
	        start_va = 0x1f0000
	          end_va = 0x1f0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001f0000"
	        filename = ""

Region:
	              id = 1241
	        start_va = 0x76c80000
	          end_va = 0x76d03fff
	       monitored = 0
	     entry_point = 0x76ca6220
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 1242
	        start_va = 0x4c0000
	          end_va = 0x4c0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004c0000"
	        filename = ""

Region:
	              id = 1243
	        start_va = 0x6cab0000
	          end_va = 0x6cabcfff
	       monitored = 0
	     entry_point = 0x6cab3520
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 1244
	        start_va = 0x6ca40000
	          end_va = 0x6caa6fff
	       monitored = 0
	     entry_point = 0x6ca5b610
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 1245
	        start_va = 0x740f0000
	          end_va = 0x7410afff
	       monitored = 0
	     entry_point = 0x740f9050
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 1246
	        start_va = 0x6c9f0000
	          end_va = 0x6ca33fff
	       monitored = 0
	     entry_point = 0x6ca0aaf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")

Region:
	              id = 1247
	        start_va = 0x5d0000
	          end_va = 0x60ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005d0000"
	        filename = ""

Region:
	              id = 1248
	        start_va = 0x610000
	          end_va = 0x64ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000610000"
	        filename = ""

Region:
	              id = 1249
	        start_va = 0x680000
	          end_va = 0x68ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000680000"
	        filename = ""

Region:
	              id = 1250
	        start_va = 0xdd0000
	          end_va = 0xe0ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000dd0000"
	        filename = ""

Region:
	              id = 1251
	        start_va = 0xe10000
	          end_va = 0xe4ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e10000"
	        filename = ""

Region:
	              id = 1252
	        start_va = 0xe50000
	          end_va = 0xe8ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e50000"
	        filename = ""

Region:
	              id = 1253
	        start_va = 0xe90000
	          end_va = 0xecffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e90000"
	        filename = ""

Region:
	              id = 1254
	        start_va = 0x6c9d0000
	          end_va = 0x6c9e0fff
	       monitored = 0
	     entry_point = 0x6c9d8fa0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 1255
	        start_va = 0x6c910000
	          end_va = 0x6c9cefff
	       monitored = 0
	     entry_point = 0x6c941e80
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 1257
	        start_va = 0x650000
	          end_va = 0x655fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000650000"
	        filename = ""


Thread:
	id = 135
	os_tid = 0xcf0


Thread:
	id = 136
	os_tid = 0x344


Thread:
	id = 137
	os_tid = 0x54c


Thread:
	id = 138
	os_tid = 0x494


Thread:
	id = 139
	os_tid = 0xdb0


Process:
	id = "11"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x5c0cf000"
	os_pid = "0x1258"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x614"
	cmd_line = "cmd.exe /c \"taskkill /f /im sqlservr.exe \""
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 1260
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 1261
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 1262
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 1263
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 1264
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 1265
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 1266
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 1267
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 1268
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 1269
	        start_va = 0x13a0000
	          end_va = 0x13f1fff
	       monitored = 1
	     entry_point = 0x13b4fd0
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")

Region:
	              id = 1270
	        start_va = 0x1400000
	          end_va = 0x53fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001400000"
	        filename = ""

Region:
	              id = 1271
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 1272
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 1273
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1274
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 1275
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 1276
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 1277
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 1278
	        start_va = 0x400000
	          end_va = 0x48ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 1279
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 1280
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 1281
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 1282
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 1283
	        start_va = 0x490000
	          end_va = 0x61ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000490000"
	        filename = ""

Region:
	              id = 1284
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 1285
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 1286
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 1287
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 1288
	        start_va = 0x620000
	          end_va = 0x6ddfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1289
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 1290
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 1291
	        start_va = 0x480000
	          end_va = 0x48ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 1292
	        start_va = 0x6e0000
	          end_va = 0x7dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006e0000"
	        filename = ""

Region:
	              id = 1293
	        start_va = 0x7e0000
	          end_va = 0x97ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000007e0000"
	        filename = ""

Region:
	              id = 1294
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 1295
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 1296
	        start_va = 0x980000
	          end_va = 0xcb6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 140
	os_tid = 0x121c

	[0123.778] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000
	[0123.778] __set_app_type (_Type=0x1) 
	[0123.778] __p__fmode () returned 0x74974d6c
	[0123.778] __p__commode () returned 0x74975b1c
	[0123.779] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13b5200) returned 0x0
	[0123.779] __getmainargs (in: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0, _DoWildCard=0, _StartInfo=0x13c60fc | out: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0) returned 0
	[0123.779] GetCurrentThreadId () returned 0x121c
	[0123.779] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x121c) returned 0x78
	[0123.779] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0123.780] GetProcAddress (hModule=0x75600000, lpProcName="SetThreadUILanguage") returned 0x75642510
	[0123.780] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0123.787] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0123.787] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2
	[0123.787] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0123.787] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0123.787] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0123.787] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0123.788] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0123.788] GetConsoleOutputCP () returned 0x1b5
	[0123.826] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0123.826] SetConsoleCtrlHandler (HandlerRoutine=0x13c0e40, Add=1) returned 1
	[0123.826] _get_osfhandle (_FileHandle=1) returned 0x154
	[0123.826] SetConsoleMode (hConsoleHandle=0x154, dwMode=0x0) returned 0
	[0123.826] _get_osfhandle (_FileHandle=1) returned 0x154
	[0123.826] GetConsoleMode (in: hConsoleHandle=0x154, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0123.826] _get_osfhandle (_FileHandle=0) returned 0x150
	[0123.826] GetConsoleMode (in: hConsoleHandle=0x150, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0123.826] GetEnvironmentStringsW () returned 0x527cc0*
	[0123.827] GetProcessHeap () returned 0x520000
	[0123.827] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xa1a) returned 0x5286e8
	[0123.827] FreeEnvironmentStringsA (penv="A") returned 1
	[0123.827] GetProcessHeap () returned 0x520000
	[0123.827] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x4) returned 0x520550
	[0123.827] GetEnvironmentStringsW () returned 0x527cc0*
	[0123.827] GetProcessHeap () returned 0x520000
	[0123.827] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xa1a) returned 0x529110
	[0123.827] FreeEnvironmentStringsA (penv="A") returned 1
	[0123.827] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0123.828] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0123.828] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0123.828] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0123.828] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0123.828] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0123.828] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0123.828] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0123.828] RegCloseKey (hKey=0x88) returned 0x0
	[0123.828] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0123.828] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0123.828] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0123.828] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0123.828] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0123.828] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0123.828] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0123.829] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0123.829] RegCloseKey (hKey=0x88) returned 0x0
	[0123.829] time (in: timer=0x0 | out: timer=0x0) returned 0x62344206
	[0123.829] srand (_Seed=0x62344206) 
	[0123.829] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im sqlservr.exe \""
	[0123.829] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im sqlservr.exe \""
	[0123.829] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0123.829] GetProcessHeap () returned 0x520000
	[0123.829] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x210) returned 0x529b38
	[0123.829] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x529b40, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0123.829] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0123.829] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0123.829] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0123.829] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0123.829] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0123.829] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0123.829] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0123.830] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0123.830] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0123.830] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0123.830] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0123.830] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0123.830] GetProcessHeap () returned 0x520000
	[0123.830] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x5286e8) returned 1
	[0123.831] GetEnvironmentStringsW () returned 0x527cc0*
	[0123.831] GetProcessHeap () returned 0x520000
	[0123.831] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xa32) returned 0x52a790
	[0123.831] FreeEnvironmentStringsA (penv="A") returned 1
	[0123.831] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b
	[0123.831] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0123.831] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0123.831] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0123.831] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0123.831] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0123.831] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0123.831] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0123.831] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0123.831] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0123.831] GetProcessHeap () returned 0x520000
	[0123.831] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x44) returned 0x5205c8
	[0123.831] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0123.832] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19fc4c*="Desktop") returned 0x1d
	[0123.832] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0123.832] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x520618
	[0123.832] FindClose (in: hFindFile=0x520618 | out: hFindFile=0x520618) returned 1
	[0123.832] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x520618
	[0123.832] FindClose (in: hFindFile=0x520618 | out: hFindFile=0x520618) returned 1
	[0123.832] _wcsnicmp (_String1="RDHJ0C~1", _String2="RDhJ0CNFevzX", _MaxCount=0xc) returned 16
	[0123.832] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x520618
	[0123.832] FindClose (in: hFindFile=0x520618 | out: hFindFile=0x520618) returned 1
	[0123.833] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0123.833] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1
	[0123.833] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 1
	[0123.833] GetProcessHeap () returned 0x520000
	[0123.833] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x52a790) returned 1
	[0123.833] GetEnvironmentStringsW () returned 0x527cc0*
	[0123.833] GetProcessHeap () returned 0x520000
	[0123.833] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xa76) returned 0x529d50
	[0123.833] FreeEnvironmentStringsA (penv="=") returned 1
	[0123.833] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0123.833] GetProcessHeap () returned 0x520000
	[0123.834] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x5205c8) returned 1
	[0123.834] GetProcessHeap () returned 0x520000
	[0123.834] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x400e) returned 0x52bc50
	[0123.834] GetProcessHeap () returned 0x520000
	[0123.834] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x4c) returned 0x52a7d0
	[0123.835] GetProcessHeap () returned 0x520000
	[0123.835] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x4008) returned 0x52fc68
	[0123.835] GetProcessHeap () returned 0x520000
	[0123.835] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x4008) returned 0x533c78
	[0123.836] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0123.837] GetProcessHeap () returned 0x520000
	[0123.837] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x418) returned 0x52a828
	[0123.837] SetErrorMode (uMode=0x0) returned 0x8003
	[0123.837] SetErrorMode (uMode=0x1) returned 0x0
	[0123.837] GetFullPathNameW (in: lpFileName="taskkill \\f \\.", nBufferLength=0x208, lpBuffer=0x52a830, lpFilePart=0x19fbac | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f", lpFilePart=0x19fbac*="f") returned 0x29
	[0123.837] SetErrorMode (uMode=0x8003) returned 0x1
	[0123.837] GetProcessHeap () returned 0x520000
	[0123.837] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x52a828, Size=0x7e) returned 0x52a828
	[0123.837] GetProcessHeap () returned 0x520000
	[0123.837] RtlSizeHeap (HeapHandle=0x520000, Flags=0x0, MemoryPointer=0x52a828) returned 0x7e
	[0123.837] NeedCurrentDirectoryForExePathW (ExeName="taskkill \\f \\.") returned 1
	[0123.837] GetProcessHeap () returned 0x520000
	[0123.838] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x62) returned 0x52a8b0
	[0123.838] GetProcessHeap () returned 0x520000
	[0123.838] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xb8) returned 0x52a920
	[0123.838] GetProcessHeap () returned 0x520000
	[0123.838] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x52a920, Size=0x62) returned 0x52a920
	[0123.838] GetProcessHeap () returned 0x520000
	[0123.838] RtlSizeHeap (HeapHandle=0x520000, Flags=0x0, MemoryPointer=0x52a920) returned 0x62
	[0123.838] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0123.838] GetProcessHeap () returned 0x520000
	[0123.838] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xe0) returned 0x52a990
	[0123.842] GetProcessHeap () returned 0x520000
	[0123.842] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x52a990, Size=0x76) returned 0x52a990
	[0123.842] GetProcessHeap () returned 0x520000
	[0123.842] RtlSizeHeap (HeapHandle=0x520000, Flags=0x0, MemoryPointer=0x52a990) returned 0x76
	[0123.842] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0123.843] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f\\im sqlservr.exe ", fInfoLevelId=0x1, lpFindFileData=0x19f958, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f958) returned 0xffffffff
	[0123.843] GetLastError () returned 0x3
	[0123.843] GetProcessHeap () returned 0x520000
	[0123.844] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x52fc68) returned 1
	[0123.844] GetProcessHeap () returned 0x520000
	[0123.844] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x533c78) returned 1
	[0123.844] GetProcessHeap () returned 0x520000
	[0123.845] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x52bc50) returned 1
	[0123.845] GetConsoleOutputCP () returned 0x1b5
	[0123.849] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0123.849] GetUserDefaultLCID () returned 0x409
	[0123.849] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x13d34a0, cchData=8 | out: lpLCData=":") returned 2
	[0123.849] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0123.849] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0123.849] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2
	[0123.849] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x13d34b0, cchData=8 | out: lpLCData="/") returned 2
	[0123.849] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x13d3500, cchData=32 | out: lpLCData="Mon") returned 4
	[0123.849] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x13d3540, cchData=32 | out: lpLCData="Tue") returned 4
	[0123.849] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x13d3580, cchData=32 | out: lpLCData="Wed") returned 4
	[0123.849] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x13d35c0, cchData=32 | out: lpLCData="Thu") returned 4
	[0123.850] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x13d3600, cchData=32 | out: lpLCData="Fri") returned 4
	[0123.850] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x13d3640, cchData=32 | out: lpLCData="Sat") returned 4
	[0123.850] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x13d3680, cchData=32 | out: lpLCData="Sun") returned 4
	[0123.850] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x13d34c0, cchData=8 | out: lpLCData=".") returned 2
	[0123.850] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x13d34e0, cchData=8 | out: lpLCData=",") returned 2
	[0123.850] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0123.852] GetProcessHeap () returned 0x520000
	[0123.852] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20c) returned 0x52aa58
	[0123.852] GetConsoleTitleW (in: lpConsoleTitle=0x52aa58, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0123.854] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0123.854] GetProcAddress (hModule=0x75600000, lpProcName="CopyFileExW") returned 0x7561ffc0
	[0123.854] GetProcAddress (hModule=0x75600000, lpProcName="IsDebuggerPresent") returned 0x7561b0b0
	[0123.855] GetProcAddress (hModule=0x75600000, lpProcName="SetConsoleInputExeNameW") returned 0x7559b440
	[0123.855] GetProcessHeap () returned 0x520000
	[0123.855] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x400a) returned 0x52bc50
	[0123.855] GetProcessHeap () returned 0x520000
	[0123.855] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x52bc50) returned 1
	[0123.856] _wcsicmp (_String1="taskkill", _String2=")") returned 75
	[0123.856] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14
	[0123.856] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14
	[0123.856] _wcsicmp (_String1="IF", _String2="taskkill") returned -11
	[0123.857] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11
	[0123.857] _wcsicmp (_String1="REM", _String2="taskkill") returned -2
	[0123.857] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2
	[0123.857] GetProcessHeap () returned 0x520000
	[0123.857] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x58) returned 0x52ac70
	[0123.857] GetProcessHeap () returned 0x520000
	[0123.857] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x1a) returned 0x520578
	[0123.857] GetProcessHeap () returned 0x520000
	[0123.857] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x34) returned 0x52acd0
	[0123.858] GetConsoleTitleW (in: lpConsoleTitle=0x19fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0123.860] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0123.860] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0123.860] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0123.860] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0123.860] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0123.860] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0123.860] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0123.860] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0123.860] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0123.860] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0123.860] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0123.860] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0123.860] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0123.860] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0123.860] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0123.860] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0123.860] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0123.860] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0123.860] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0123.860] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0123.860] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0123.860] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0123.860] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0123.860] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0123.860] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0123.860] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0123.860] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0123.860] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0123.861] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0123.861] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0123.861] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0123.861] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0123.861] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0123.861] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0123.861] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0123.861] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0123.861] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0123.861] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0123.861] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0123.861] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0123.861] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0123.861] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0123.861] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0123.861] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0123.861] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0123.861] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0123.861] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0123.861] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0123.861] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0123.861] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0123.861] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0123.861] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0123.861] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0123.861] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0123.861] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0123.861] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0123.861] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0123.862] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0123.862] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0123.862] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0123.862] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0123.862] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0123.862] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0123.862] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0123.862] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0123.862] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0123.862] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0123.862] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0123.862] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0123.862] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0123.862] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0123.862] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0123.862] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0123.862] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0123.862] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0123.862] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0123.862] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0123.862] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0123.862] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0123.862] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0123.862] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0123.862] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0123.862] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0123.862] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0123.862] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14
	[0123.862] _wcsicmp (_String1="taskkill", _String2="IF") returned 11
	[0123.863] _wcsicmp (_String1="taskkill", _String2="REM") returned 2
	[0123.863] GetProcessHeap () returned 0x520000
	[0123.863] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x210) returned 0x52ad10
	[0123.863] GetProcessHeap () returned 0x520000
	[0123.863] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x46) returned 0x52af28
	[0123.863] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0123.863] GetProcessHeap () returned 0x520000
	[0123.863] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x418) returned 0x5205c8
	[0123.863] SetErrorMode (uMode=0x0) returned 0x8003
	[0123.863] SetErrorMode (uMode=0x1) returned 0x0
	[0123.864] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x5205d0, lpFilePart=0x19f57c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19f57c*="Desktop") returned 0x1d
	[0123.864] SetErrorMode (uMode=0x8003) returned 0x1
	[0123.864] GetProcessHeap () returned 0x520000
	[0123.864] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5205c8, Size=0x56) returned 0x5205c8
	[0123.864] GetProcessHeap () returned 0x520000
	[0123.864] RtlSizeHeap (HeapHandle=0x520000, Flags=0x0, MemoryPointer=0x5205c8) returned 0x56
	[0123.864] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0123.864] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0123.864] GetProcessHeap () returned 0x520000
	[0123.864] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x110) returned 0x52af78
	[0123.864] GetProcessHeap () returned 0x520000
	[0123.864] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x218) returned 0x520628
	[0123.869] GetProcessHeap () returned 0x520000
	[0123.869] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x520628, Size=0x112) returned 0x520628
	[0123.869] GetProcessHeap () returned 0x520000
	[0123.869] RtlSizeHeap (HeapHandle=0x520000, Flags=0x0, MemoryPointer=0x520628) returned 0x112
	[0123.869] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0123.869] GetProcessHeap () returned 0x520000
	[0123.869] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xe0) returned 0x52b090
	[0123.871] GetProcessHeap () returned 0x520000
	[0123.871] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x52b090, Size=0x76) returned 0x52b090
	[0123.871] GetProcessHeap () returned 0x520000
	[0123.871] RtlSizeHeap (HeapHandle=0x520000, Flags=0x0, MemoryPointer=0x52b090) returned 0x76
	[0123.871] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0123.871] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0123.872] GetLastError () returned 0x2
	[0123.872] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0123.872] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x52b110
	[0123.872] GetProcessHeap () returned 0x520000
	[0123.872] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14) returned 0x5277c8
	[0123.872] FindClose (in: hFindFile=0x52b110 | out: hFindFile=0x52b110) returned 1
	[0123.872] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0123.872] GetLastError () returned 0x2
	[0123.873] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x52b110
	[0123.873] GetProcessHeap () returned 0x520000
	[0123.873] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5277c8, Size=0x4) returned 0x52b150
	[0123.873] FindClose (in: hFindFile=0x52b110 | out: hFindFile=0x52b110) returned 1
	[0123.873] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0123.873] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0123.873] GetConsoleTitleW (in: lpConsoleTitle=0x19f7fc, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0123.875] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f728, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f70c | out: lpAttributeList=0x19f728, lpSize=0x19f70c) returned 1
	[0123.875] UpdateProcThreadAttribute (in: lpAttributeList=0x19f728, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f714, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f728, lpPreviousValue=0x0) returned 1
	[0123.875] GetStartupInfoW (in: lpStartupInfo=0x19f760 | out: lpStartupInfo=0x19f760*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x150, hStdOutput=0x154, hStdError=0x130)) 
	[0123.875] GetProcessHeap () returned 0x520000
	[0123.875] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x18) returned 0x5274c8
	[0123.875] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0123.875] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0123.875] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0123.875] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0123.875] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0123.875] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0123.875] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0123.875] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0123.875] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0123.875] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0123.875] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0123.875] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0123.875] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0123.875] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0123.875] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0123.875] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0123.876] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0123.876] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0123.876] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0123.876] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0123.876] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0123.876] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0123.876] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0123.876] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0123.876] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0123.876] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0123.876] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0123.876] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0123.876] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0123.876] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0123.876] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0123.876] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0123.876] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0123.876] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0123.876] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0123.876] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0123.876] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0123.876] GetProcessHeap () returned 0x520000
	[0123.876] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x5274c8) returned 1
	[0123.876] GetProcessHeap () returned 0x520000
	[0123.876] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xa) returned 0x52b110
	[0123.877] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1
	[0123.879] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill  /f /im sqlservr.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x19f6b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill  /f /im sqlservr.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f6fc | out: lpCommandLine="taskkill  /f /im sqlservr.exe ", lpProcessInformation=0x19f6fc*(hProcess=0x9c, hThread=0x98, dwProcessId=0x1240, dwThreadId=0xa08)) returned 1
	[0123.895] CloseHandle (hObject=0x98) returned 1
	[0123.895] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0123.895] GetProcessHeap () returned 0x520000
	[0123.896] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x529d50) returned 1
	[0123.896] GetEnvironmentStringsW () returned 0x529d50*
	[0123.896] GetProcessHeap () returned 0x520000
	[0123.896] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xa76) returned 0x527cc0
	[0123.896] FreeEnvironmentStringsA (penv="=") returned 1
	[0123.896] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0
	[0124.873] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x19f694 | out: lpExitCode=0x19f694*=0x80) returned 1
	[0124.874] CloseHandle (hObject=0x9c) returned 1
	[0124.874] _vsnwprintf (in: _Buffer=0x19f77c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f69c | out: _Buffer="00000080") returned 8
	[0124.874] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1
	[0124.874] GetProcessHeap () returned 0x520000
	[0124.875] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x527cc0) returned 1
	[0124.875] GetEnvironmentStringsW () returned 0x52b160*
	[0124.875] GetProcessHeap () returned 0x520000
	[0124.876] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xa9c) returned 0x527cc0
	[0124.876] FreeEnvironmentStringsA (penv="=") returned 1
	[0124.876] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0124.876] GetProcessHeap () returned 0x520000
	[0124.876] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x527cc0) returned 1
	[0124.876] GetEnvironmentStringsW () returned 0x52b160*
	[0124.876] GetProcessHeap () returned 0x520000
	[0124.876] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xa9c) returned 0x527cc0
	[0124.876] FreeEnvironmentStringsA (penv="=") returned 1
	[0124.876] GetProcessHeap () returned 0x520000
	[0124.876] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x52b110) returned 1
	[0124.876] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f728 | out: lpAttributeList=0x19f728) 
	[0124.876] _get_osfhandle (_FileHandle=1) returned 0x154
	[0124.876] SetConsoleMode (hConsoleHandle=0x154, dwMode=0x0) returned 0
	[0124.876] _get_osfhandle (_FileHandle=1) returned 0x154
	[0124.876] GetConsoleMode (in: hConsoleHandle=0x154, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0124.876] _get_osfhandle (_FileHandle=0) returned 0x150
	[0124.876] GetConsoleMode (in: hConsoleHandle=0x150, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0124.876] GetConsoleOutputCP () returned 0x1b5
	[0124.878] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0124.878] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0124.880] exit (_Code=128) 

Thread:
	id = 141
	os_tid = 0x1374


Process:
	id = "12"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\syswow64\\taskkill.exe"
	page_root = "0x4c090000"
	os_pid = "0x1240"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "11"
	os_parent_pid = "0x1258"
	cmd_line = "taskkill  /f /im sqlservr.exe "
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 1297
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 1298
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 1299
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 1300
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 1301
	        start_va = 0xa0000
	          end_va = 0xdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 1302
	        start_va = 0xe0000
	          end_va = 0xe3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 1303
	        start_va = 0xf0000
	          end_va = 0xf0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 1304
	        start_va = 0x100000
	          end_va = 0x101fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 1305
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 1306
	        start_va = 0x13b0000
	          end_va = 0x13c5fff
	       monitored = 0
	     entry_point = 0x13bde80
	     region_type = mapped_file
	            name = "taskkill.exe"
	        filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe")

Region:
	              id = 1307
	        start_va = 0x13d0000
	          end_va = 0x53cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000013d0000"
	        filename = ""

Region:
	              id = 1308
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 1309
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 1310
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1311
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 1312
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 1313
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 1314
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 1315
	        start_va = 0x110000
	          end_va = 0x13ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000110000"
	        filename = ""

Region:
	              id = 1316
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 1317
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 1318
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 1319
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 1320
	        start_va = 0x400000
	          end_va = 0x50ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 1321
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 1322
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 1323
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 1324
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 1325
	        start_va = 0x140000
	          end_va = 0x1fdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1326
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 1327
	        start_va = 0x74650000
	          end_va = 0x746cafff
	       monitored = 0
	     entry_point = 0x7466e970
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 1328
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 1329
	        start_va = 0x510000
	          end_va = 0x54ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000510000"
	        filename = ""

Region:
	              id = 1330
	        start_va = 0x550000
	          end_va = 0x58ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000550000"
	        filename = ""

Region:
	              id = 1331
	        start_va = 0x76ae0000
	          end_va = 0x76b23fff
	       monitored = 0
	     entry_point = 0x76af9d80
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 1332
	        start_va = 0x75260000
	          end_va = 0x7530cfff
	       monitored = 0
	     entry_point = 0x75274f00
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 1333
	        start_va = 0x74450000
	          end_va = 0x7446dfff
	       monitored = 0
	     entry_point = 0x7445b640
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 1334
	        start_va = 0x74440000
	          end_va = 0x74449fff
	       monitored = 0
	     entry_point = 0x74442a00
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 1335
	        start_va = 0x74590000
	          end_va = 0x745e7fff
	       monitored = 0
	     entry_point = 0x745d25c0
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 1336
	        start_va = 0x77450000
	          end_va = 0x77596fff
	       monitored = 0
	     entry_point = 0x77461cf0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 1337
	        start_va = 0x76b30000
	          end_va = 0x76c7efff
	       monitored = 0
	     entry_point = 0x76be6820
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 1338
	        start_va = 0x6cc90000
	          end_va = 0x6cc97fff
	       monitored = 0
	     entry_point = 0x6cc917b0
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 1339
	        start_va = 0x753c0000
	          end_va = 0x75451fff
	       monitored = 0
	     entry_point = 0x753f8cf0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 1340
	        start_va = 0x6cc70000
	          end_va = 0x6cc85fff
	       monitored = 0
	     entry_point = 0x6cc721d0
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")

Region:
	              id = 1341
	        start_va = 0x77290000
	          end_va = 0x7744cfff
	       monitored = 0
	     entry_point = 0x77372a10
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")

Region:
	              id = 1342
	        start_va = 0x75310000
	          end_va = 0x7536efff
	       monitored = 0
	     entry_point = 0x75314af0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 1343
	        start_va = 0x77240000
	          end_va = 0x77284fff
	       monitored = 0
	     entry_point = 0x7725de90
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 1344
	        start_va = 0x6cc30000
	          end_va = 0x6cc6efff
	       monitored = 0
	     entry_point = 0x6cc446c0
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll")

Region:
	              id = 1345
	        start_va = 0x6caf0000
	          end_va = 0x6cc2efff
	       monitored = 0
	     entry_point = 0x6cb1d880
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll")

Region:
	              id = 1346
	        start_va = 0x6cad0000
	          end_va = 0x6caebfff
	       monitored = 0
	     entry_point = 0x6cad4720
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")

Region:
	              id = 1347
	        start_va = 0x6cac0000
	          end_va = 0x6cac9fff
	       monitored = 0
	     entry_point = 0x6cac28d0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")

Region:
	              id = 1348
	        start_va = 0x30000
	          end_va = 0x3ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 1349
	        start_va = 0x590000
	          end_va = 0x717fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000590000"
	        filename = ""

Region:
	              id = 1350
	        start_va = 0x720000
	          end_va = 0x749fff
	       monitored = 0
	     entry_point = 0x725680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 1351
	        start_va = 0x74ea0000
	          end_va = 0x74ecafff
	       monitored = 0
	     entry_point = 0x74ea5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 1352
	        start_va = 0x720000
	          end_va = 0x8a0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000720000"
	        filename = ""

Region:
	              id = 1353
	        start_va = 0x53d0000
	          end_va = 0x67cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000053d0000"
	        filename = ""

Region:
	              id = 1354
	        start_va = 0x110000
	          end_va = 0x111fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000110000"
	        filename = ""

Region:
	              id = 1355
	        start_va = 0x120000
	          end_va = 0x120fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000120000"
	        filename = ""

Region:
	              id = 1356
	        start_va = 0x130000
	          end_va = 0x13ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000130000"
	        filename = ""

Region:
	              id = 1357
	        start_va = 0x400000
	          end_va = 0x404fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taskkill.exe.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui")

Region:
	              id = 1358
	        start_va = 0x410000
	          end_va = 0x50ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000410000"
	        filename = ""

Region:
	              id = 1359
	        start_va = 0x8b0000
	          end_va = 0x8b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000008b0000"
	        filename = ""

Region:
	              id = 1360
	        start_va = 0x8c0000
	          end_va = 0x8c0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000008c0000"
	        filename = ""

Region:
	              id = 1361
	        start_va = 0x8d0000
	          end_va = 0xc06fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 1362
	        start_va = 0xc10000
	          end_va = 0xcf9fff
	       monitored = 0
	     entry_point = 0xc4d650
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 1363
	        start_va = 0xc10000
	          end_va = 0xc13fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000c10000"
	        filename = ""

Region:
	              id = 1364
	        start_va = 0xc20000
	          end_va = 0xcfffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 1365
	        start_va = 0x76e20000
	          end_va = 0x76e2bfff
	       monitored = 0
	     entry_point = 0x76e23930
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")

Region:
	              id = 1366
	        start_va = 0xd00000
	          end_va = 0xd00fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000d00000"
	        filename = ""

Region:
	              id = 1367
	        start_va = 0x76c80000
	          end_va = 0x76d03fff
	       monitored = 0
	     entry_point = 0x76ca6220
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 1368
	        start_va = 0xd10000
	          end_va = 0xd10fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000d10000"
	        filename = ""

Region:
	              id = 1369
	        start_va = 0x6cab0000
	          end_va = 0x6cabcfff
	       monitored = 0
	     entry_point = 0x6cab3520
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 1370
	        start_va = 0x6ca40000
	          end_va = 0x6caa6fff
	       monitored = 0
	     entry_point = 0x6ca5b610
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 1371
	        start_va = 0x740f0000
	          end_va = 0x7410afff
	       monitored = 0
	     entry_point = 0x740f9050
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 1372
	        start_va = 0x6c9f0000
	          end_va = 0x6ca33fff
	       monitored = 0
	     entry_point = 0x6ca0aaf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")

Region:
	              id = 1373
	        start_va = 0xd20000
	          end_va = 0xd5ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d20000"
	        filename = ""

Region:
	              id = 1374
	        start_va = 0xd60000
	          end_va = 0xd9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d60000"
	        filename = ""

Region:
	              id = 1375
	        start_va = 0xda0000
	          end_va = 0xddffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000da0000"
	        filename = ""

Region:
	              id = 1376
	        start_va = 0xde0000
	          end_va = 0xe1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000de0000"
	        filename = ""

Region:
	              id = 1377
	        start_va = 0xe20000
	          end_va = 0xe5ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e20000"
	        filename = ""

Region:
	              id = 1378
	        start_va = 0xe60000
	          end_va = 0xe9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e60000"
	        filename = ""

Region:
	              id = 1379
	        start_va = 0x6c9d0000
	          end_va = 0x6c9e0fff
	       monitored = 0
	     entry_point = 0x6c9d8fa0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 1380
	        start_va = 0x6c910000
	          end_va = 0x6c9cefff
	       monitored = 0
	     entry_point = 0x6c941e80
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 1382
	        start_va = 0xea0000
	          end_va = 0xea5fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000ea0000"
	        filename = ""


Thread:
	id = 142
	os_tid = 0xa08


Thread:
	id = 143
	os_tid = 0x99c


Thread:
	id = 144
	os_tid = 0xad8


Thread:
	id = 145
	os_tid = 0x9a0


Thread:
	id = 146
	os_tid = 0x9b0


Process:
	id = "13"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x481d7000"
	os_pid = "0x9a8"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x614"
	cmd_line = "cmd.exe /c \"taskkill /f /im sqlwriter.exe \""
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 1385
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 1386
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 1387
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 1388
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 1389
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 1390
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 1391
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 1392
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 1393
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 1394
	        start_va = 0x13a0000
	          end_va = 0x13f1fff
	       monitored = 1
	     entry_point = 0x13b4fd0
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")

Region:
	              id = 1395
	        start_va = 0x1400000
	          end_va = 0x53fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001400000"
	        filename = ""

Region:
	              id = 1396
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 1397
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 1398
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1399
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 1400
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 1401
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 1402
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 1403
	        start_va = 0x400000
	          end_va = 0x50ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 1404
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 1405
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 1406
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 1407
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 1408
	        start_va = 0x510000
	          end_va = 0x6effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000510000"
	        filename = ""

Region:
	              id = 1409
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 1410
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 1411
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 1412
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 1413
	        start_va = 0x400000
	          end_va = 0x4bdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1414
	        start_va = 0x500000
	          end_va = 0x50ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000500000"
	        filename = ""

Region:
	              id = 1415
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 1416
	        start_va = 0x4c0000
	          end_va = 0x4fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004c0000"
	        filename = ""

Region:
	              id = 1417
	        start_va = 0x6f0000
	          end_va = 0x7effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006f0000"
	        filename = ""

Region:
	              id = 1418
	        start_va = 0x7f0000
	          end_va = 0x9affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000007f0000"
	        filename = ""

Region:
	              id = 1419
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 1420
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 1421
	        start_va = 0x9b0000
	          end_va = 0xce6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 147
	os_tid = 0x998

	[0125.130] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000
	[0125.130] __set_app_type (_Type=0x1) 
	[0125.130] __p__fmode () returned 0x74974d6c
	[0125.130] __p__commode () returned 0x74975b1c
	[0125.130] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13b5200) returned 0x0
	[0125.131] __getmainargs (in: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0, _DoWildCard=0, _StartInfo=0x13c60fc | out: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0) returned 0
	[0125.131] GetCurrentThreadId () returned 0x998
	[0125.131] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x998) returned 0x78
	[0125.131] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0125.132] GetProcAddress (hModule=0x75600000, lpProcName="SetThreadUILanguage") returned 0x75642510
	[0125.132] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0125.142] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0125.142] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2
	[0125.143] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0125.143] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0125.143] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0125.143] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0125.143] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0125.143] GetConsoleOutputCP () returned 0x1b5
	[0125.144] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0125.145] SetConsoleCtrlHandler (HandlerRoutine=0x13c0e40, Add=1) returned 1
	[0125.145] _get_osfhandle (_FileHandle=1) returned 0x150
	[0125.145] SetConsoleMode (hConsoleHandle=0x150, dwMode=0x0) returned 0
	[0125.145] _get_osfhandle (_FileHandle=1) returned 0x150
	[0125.145] GetConsoleMode (in: hConsoleHandle=0x150, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0125.145] _get_osfhandle (_FileHandle=0) returned 0x144
	[0125.145] GetConsoleMode (in: hConsoleHandle=0x144, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0125.145] GetEnvironmentStringsW () returned 0x5f7cc0*
	[0125.145] GetProcessHeap () returned 0x5f0000
	[0125.145] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xa1a) returned 0x5f86e8
	[0125.146] FreeEnvironmentStringsA (penv="A") returned 1
	[0125.146] GetProcessHeap () returned 0x5f0000
	[0125.146] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x4) returned 0x5f0550
	[0125.146] GetEnvironmentStringsW () returned 0x5f7cc0*
	[0125.146] GetProcessHeap () returned 0x5f0000
	[0125.146] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xa1a) returned 0x5f9110
	[0125.146] FreeEnvironmentStringsA (penv="A") returned 1
	[0125.146] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0125.146] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0125.146] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0125.146] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0125.146] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0125.146] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0125.146] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0125.146] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0125.146] RegCloseKey (hKey=0x88) returned 0x0
	[0125.147] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0125.147] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0125.147] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0125.147] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0125.147] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0125.147] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0125.147] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0125.147] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0125.147] RegCloseKey (hKey=0x88) returned 0x0
	[0125.147] time (in: timer=0x0 | out: timer=0x0) returned 0x62344207
	[0125.147] srand (_Seed=0x62344207) 
	[0125.147] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im sqlwriter.exe \""
	[0125.147] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im sqlwriter.exe \""
	[0125.147] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0125.148] GetProcessHeap () returned 0x5f0000
	[0125.148] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x210) returned 0x5f9b38
	[0125.148] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5f9b40, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0125.148] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0125.148] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0125.148] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0125.148] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0125.148] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0125.148] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0125.148] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0125.148] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0125.148] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0125.148] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0125.148] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0125.148] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0125.148] GetProcessHeap () returned 0x5f0000
	[0125.149] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5f86e8) returned 1
	[0125.149] GetEnvironmentStringsW () returned 0x5f7cc0*
	[0125.149] GetProcessHeap () returned 0x5f0000
	[0125.149] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xa32) returned 0x5fa790
	[0125.149] FreeEnvironmentStringsA (penv="A") returned 1
	[0125.149] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b
	[0125.149] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0125.149] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0125.149] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0125.149] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0125.150] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0125.150] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0125.150] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0125.150] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0125.150] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0125.150] GetProcessHeap () returned 0x5f0000
	[0125.150] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x44) returned 0x5f05c8
	[0125.150] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0125.150] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19fc4c*="Desktop") returned 0x1d
	[0125.150] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0125.150] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x5f0618
	[0125.150] FindClose (in: hFindFile=0x5f0618 | out: hFindFile=0x5f0618) returned 1
	[0125.150] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x5f0618
	[0125.151] FindClose (in: hFindFile=0x5f0618 | out: hFindFile=0x5f0618) returned 1
	[0125.151] _wcsnicmp (_String1="RDHJ0C~1", _String2="RDhJ0CNFevzX", _MaxCount=0xc) returned 16
	[0125.151] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x5f0618
	[0125.151] FindClose (in: hFindFile=0x5f0618 | out: hFindFile=0x5f0618) returned 1
	[0125.151] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0125.151] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1
	[0125.151] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 1
	[0125.151] GetProcessHeap () returned 0x5f0000
	[0125.151] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5fa790) returned 1
	[0125.257] GetEnvironmentStringsW () returned 0x5f7cc0*
	[0125.257] GetProcessHeap () returned 0x5f0000
	[0125.258] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xa76) returned 0x5f9d50
	[0125.258] FreeEnvironmentStringsA (penv="=") returned 1
	[0125.258] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0125.258] GetProcessHeap () returned 0x5f0000
	[0125.258] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5f05c8) returned 1
	[0125.258] GetProcessHeap () returned 0x5f0000
	[0125.258] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x400e) returned 0x5fbc50
	[0125.259] GetProcessHeap () returned 0x5f0000
	[0125.259] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x4e) returned 0x5fa7d0
	[0125.259] GetProcessHeap () returned 0x5f0000
	[0125.259] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x4008) returned 0x5ffc68
	[0125.260] GetProcessHeap () returned 0x5f0000
	[0125.260] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x4008) returned 0x603c78
	[0125.261] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0125.262] GetProcessHeap () returned 0x5f0000
	[0125.262] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x418) returned 0x5fa828
	[0125.263] SetErrorMode (uMode=0x0) returned 0x8003
	[0125.263] SetErrorMode (uMode=0x1) returned 0x0
	[0125.272] GetFullPathNameW (in: lpFileName="taskkill \\f \\.", nBufferLength=0x208, lpBuffer=0x5fa830, lpFilePart=0x19fbac | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f", lpFilePart=0x19fbac*="f") returned 0x29
	[0125.272] SetErrorMode (uMode=0x8003) returned 0x1
	[0125.273] GetProcessHeap () returned 0x5f0000
	[0125.273] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x5fa828, Size=0x80) returned 0x5fa828
	[0125.273] GetProcessHeap () returned 0x5f0000
	[0125.273] RtlSizeHeap (HeapHandle=0x5f0000, Flags=0x0, MemoryPointer=0x5fa828) returned 0x80
	[0125.273] NeedCurrentDirectoryForExePathW (ExeName="taskkill \\f \\.") returned 1
	[0125.273] GetProcessHeap () returned 0x5f0000
	[0125.273] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x62) returned 0x5fa8b0
	[0125.273] GetProcessHeap () returned 0x5f0000
	[0125.273] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xb8) returned 0x5fa920
	[0125.273] GetProcessHeap () returned 0x5f0000
	[0125.273] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x5fa920, Size=0x62) returned 0x5fa920
	[0125.273] GetProcessHeap () returned 0x5f0000
	[0125.273] RtlSizeHeap (HeapHandle=0x5f0000, Flags=0x0, MemoryPointer=0x5fa920) returned 0x62
	[0125.273] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0125.274] GetProcessHeap () returned 0x5f0000
	[0125.274] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xe0) returned 0x5fa990
	[0125.280] GetProcessHeap () returned 0x5f0000
	[0125.280] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x5fa990, Size=0x76) returned 0x5fa990
	[0125.280] GetProcessHeap () returned 0x5f0000
	[0125.280] RtlSizeHeap (HeapHandle=0x5f0000, Flags=0x0, MemoryPointer=0x5fa990) returned 0x76
	[0125.281] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0125.281] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f\\im sqlwriter.exe ", fInfoLevelId=0x1, lpFindFileData=0x19f958, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f958) returned 0xffffffff
	[0125.281] GetLastError () returned 0x3
	[0125.281] GetProcessHeap () returned 0x5f0000
	[0125.282] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5ffc68) returned 1
	[0125.282] GetProcessHeap () returned 0x5f0000
	[0125.282] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x603c78) returned 1
	[0125.283] GetProcessHeap () returned 0x5f0000
	[0125.283] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5fbc50) returned 1
	[0125.283] GetConsoleOutputCP () returned 0x1b5
	[0125.290] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0125.290] GetUserDefaultLCID () returned 0x409
	[0125.291] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x13d34a0, cchData=8 | out: lpLCData=":") returned 2
	[0125.291] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0125.291] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0125.291] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2
	[0125.291] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x13d34b0, cchData=8 | out: lpLCData="/") returned 2
	[0125.292] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x13d3500, cchData=32 | out: lpLCData="Mon") returned 4
	[0125.292] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x13d3540, cchData=32 | out: lpLCData="Tue") returned 4
	[0125.292] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x13d3580, cchData=32 | out: lpLCData="Wed") returned 4
	[0125.292] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x13d35c0, cchData=32 | out: lpLCData="Thu") returned 4
	[0125.292] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x13d3600, cchData=32 | out: lpLCData="Fri") returned 4
	[0125.292] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x13d3640, cchData=32 | out: lpLCData="Sat") returned 4
	[0125.292] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x13d3680, cchData=32 | out: lpLCData="Sun") returned 4
	[0125.292] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x13d34c0, cchData=8 | out: lpLCData=".") returned 2
	[0125.292] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x13d34e0, cchData=8 | out: lpLCData=",") returned 2
	[0125.292] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0125.295] GetProcessHeap () returned 0x5f0000
	[0125.295] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x20c) returned 0x5faa58
	[0125.295] GetConsoleTitleW (in: lpConsoleTitle=0x5faa58, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0125.297] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0125.297] GetProcAddress (hModule=0x75600000, lpProcName="CopyFileExW") returned 0x7561ffc0
	[0125.297] GetProcAddress (hModule=0x75600000, lpProcName="IsDebuggerPresent") returned 0x7561b0b0
	[0125.297] GetProcAddress (hModule=0x75600000, lpProcName="SetConsoleInputExeNameW") returned 0x7559b440
	[0125.298] GetProcessHeap () returned 0x5f0000
	[0125.298] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x400a) returned 0x5fbc50
	[0125.298] GetProcessHeap () returned 0x5f0000
	[0125.298] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5fbc50) returned 1
	[0125.299] _wcsicmp (_String1="taskkill", _String2=")") returned 75
	[0125.299] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14
	[0125.299] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14
	[0125.299] _wcsicmp (_String1="IF", _String2="taskkill") returned -11
	[0125.299] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11
	[0125.299] _wcsicmp (_String1="REM", _String2="taskkill") returned -2
	[0125.299] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2
	[0125.299] GetProcessHeap () returned 0x5f0000
	[0125.299] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x58) returned 0x5fac70
	[0125.299] GetProcessHeap () returned 0x5f0000
	[0125.299] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x1a) returned 0x5f0578
	[0125.300] GetProcessHeap () returned 0x5f0000
	[0125.300] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x36) returned 0x5facd0
	[0125.301] GetConsoleTitleW (in: lpConsoleTitle=0x19fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0125.304] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0125.304] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0125.304] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0125.304] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0125.304] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0125.304] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0125.304] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0125.304] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0125.304] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0125.304] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0125.304] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0125.304] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0125.304] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0125.304] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0125.304] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0125.304] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0125.304] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0125.304] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0125.304] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0125.304] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0125.304] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0125.304] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0125.304] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0125.305] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0125.305] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0125.305] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0125.305] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0125.305] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0125.305] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0125.305] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0125.305] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0125.305] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0125.305] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0125.305] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0125.305] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0125.305] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0125.305] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0125.305] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0125.305] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0125.305] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0125.305] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0125.305] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0125.305] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0125.305] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0125.305] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0125.305] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0125.305] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0125.305] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0125.305] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0125.305] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0125.306] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0125.306] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0125.306] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0125.306] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0125.306] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0125.306] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0125.306] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0125.306] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0125.306] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0125.306] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0125.306] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0125.306] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0125.306] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0125.306] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0125.306] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0125.306] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0125.306] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0125.306] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0125.306] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0125.306] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0125.306] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0125.306] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0125.306] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0125.306] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0125.306] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0125.306] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0125.306] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0125.306] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0125.306] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0125.306] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0125.307] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0125.307] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0125.307] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0125.307] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0125.307] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14
	[0125.307] _wcsicmp (_String1="taskkill", _String2="IF") returned 11
	[0125.307] _wcsicmp (_String1="taskkill", _String2="REM") returned 2
	[0125.307] GetProcessHeap () returned 0x5f0000
	[0125.307] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x210) returned 0x5fad10
	[0125.307] GetProcessHeap () returned 0x5f0000
	[0125.307] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x48) returned 0x5faf28
	[0125.307] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0125.308] GetProcessHeap () returned 0x5f0000
	[0125.308] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x418) returned 0x5f05c8
	[0125.308] SetErrorMode (uMode=0x0) returned 0x8003
	[0125.308] SetErrorMode (uMode=0x1) returned 0x0
	[0125.308] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x5f05d0, lpFilePart=0x19f57c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19f57c*="Desktop") returned 0x1d
	[0125.308] SetErrorMode (uMode=0x8003) returned 0x1
	[0125.308] GetProcessHeap () returned 0x5f0000
	[0125.308] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x5f05c8, Size=0x56) returned 0x5f05c8
	[0125.308] GetProcessHeap () returned 0x5f0000
	[0125.308] RtlSizeHeap (HeapHandle=0x5f0000, Flags=0x0, MemoryPointer=0x5f05c8) returned 0x56
	[0125.308] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0125.308] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0125.308] GetProcessHeap () returned 0x5f0000
	[0125.308] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x110) returned 0x5faf78
	[0125.308] GetProcessHeap () returned 0x5f0000
	[0125.308] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x218) returned 0x5f0628
	[0125.313] GetProcessHeap () returned 0x5f0000
	[0125.313] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x5f0628, Size=0x112) returned 0x5f0628
	[0125.313] GetProcessHeap () returned 0x5f0000
	[0125.313] RtlSizeHeap (HeapHandle=0x5f0000, Flags=0x0, MemoryPointer=0x5f0628) returned 0x112
	[0125.313] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0125.313] GetProcessHeap () returned 0x5f0000
	[0125.313] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xe0) returned 0x5fb090
	[0125.315] GetProcessHeap () returned 0x5f0000
	[0125.315] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x5fb090, Size=0x76) returned 0x5fb090
	[0125.315] GetProcessHeap () returned 0x5f0000
	[0125.315] RtlSizeHeap (HeapHandle=0x5f0000, Flags=0x0, MemoryPointer=0x5fb090) returned 0x76
	[0125.315] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0125.315] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0125.316] GetLastError () returned 0x2
	[0125.316] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0125.316] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x5fb110
	[0125.316] GetProcessHeap () returned 0x5f0000
	[0125.316] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x14) returned 0x5f7588
	[0125.316] FindClose (in: hFindFile=0x5fb110 | out: hFindFile=0x5fb110) returned 1
	[0125.316] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0125.316] GetLastError () returned 0x2
	[0125.316] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x5fb110
	[0125.317] GetProcessHeap () returned 0x5f0000
	[0125.317] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x5f7588, Size=0x4) returned 0x5fb150
	[0125.317] FindClose (in: hFindFile=0x5fb110 | out: hFindFile=0x5fb110) returned 1
	[0125.317] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0125.317] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0125.317] GetConsoleTitleW (in: lpConsoleTitle=0x19f7fc, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0125.318] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f728, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f70c | out: lpAttributeList=0x19f728, lpSize=0x19f70c) returned 1
	[0125.318] UpdateProcThreadAttribute (in: lpAttributeList=0x19f728, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f714, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f728, lpPreviousValue=0x0) returned 1
	[0125.318] GetStartupInfoW (in: lpStartupInfo=0x19f760 | out: lpStartupInfo=0x19f760*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x144, hStdOutput=0x150, hStdError=0x154)) 
	[0125.318] GetProcessHeap () returned 0x5f0000
	[0125.318] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x18) returned 0x5f7488
	[0125.318] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0125.318] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0125.318] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0125.319] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0125.319] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0125.319] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0125.319] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0125.319] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0125.319] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0125.319] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0125.319] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0125.319] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0125.319] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0125.319] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0125.319] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0125.319] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0125.319] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0125.319] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0125.319] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0125.319] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0125.319] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0125.319] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0125.319] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0125.319] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0125.319] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0125.320] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0125.320] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0125.320] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0125.320] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0125.320] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0125.320] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0125.320] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0125.320] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0125.320] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0125.320] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0125.320] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0125.320] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0125.320] GetProcessHeap () returned 0x5f0000
	[0125.320] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5f7488) returned 1
	[0125.320] GetProcessHeap () returned 0x5f0000
	[0125.320] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xa) returned 0x5fb110
	[0125.320] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1
	[0125.326] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill  /f /im sqlwriter.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x19f6b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill  /f /im sqlwriter.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f6fc | out: lpCommandLine="taskkill  /f /im sqlwriter.exe ", lpProcessInformation=0x19f6fc*(hProcess=0x9c, hThread=0x98, dwProcessId=0x968, dwThreadId=0x7a0)) returned 1
	[0125.356] CloseHandle (hObject=0x98) returned 1
	[0125.356] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0125.357] GetProcessHeap () returned 0x5f0000
	[0125.357] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5f9d50) returned 1
	[0125.357] GetEnvironmentStringsW () returned 0x5f9d50*
	[0125.357] GetProcessHeap () returned 0x5f0000
	[0125.357] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xa76) returned 0x5f7cc0
	[0125.357] FreeEnvironmentStringsA (penv="=") returned 1
	[0125.357] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0
	[0126.655] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x19f694 | out: lpExitCode=0x19f694*=0x80) returned 1
	[0126.655] CloseHandle (hObject=0x9c) returned 1
	[0126.655] _vsnwprintf (in: _Buffer=0x19f77c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f69c | out: _Buffer="00000080") returned 8
	[0126.655] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1
	[0126.657] GetProcessHeap () returned 0x5f0000
	[0126.658] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5f7cc0) returned 1
	[0126.658] GetEnvironmentStringsW () returned 0x5fb160*
	[0126.658] GetProcessHeap () returned 0x5f0000
	[0126.658] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xa9c) returned 0x5f7cc0
	[0126.658] FreeEnvironmentStringsA (penv="=") returned 1
	[0126.658] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0126.658] GetProcessHeap () returned 0x5f0000
	[0126.658] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5f7cc0) returned 1
	[0126.659] GetEnvironmentStringsW () returned 0x5fb160*
	[0126.659] GetProcessHeap () returned 0x5f0000
	[0126.659] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xa9c) returned 0x5f7cc0
	[0126.659] FreeEnvironmentStringsA (penv="=") returned 1
	[0126.659] GetProcessHeap () returned 0x5f0000
	[0126.659] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5fb110) returned 1
	[0126.659] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f728 | out: lpAttributeList=0x19f728) 
	[0126.659] _get_osfhandle (_FileHandle=1) returned 0x150
	[0126.659] SetConsoleMode (hConsoleHandle=0x150, dwMode=0x0) returned 0
	[0126.659] _get_osfhandle (_FileHandle=1) returned 0x150
	[0126.659] GetConsoleMode (in: hConsoleHandle=0x150, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0126.659] _get_osfhandle (_FileHandle=0) returned 0x144
	[0126.659] GetConsoleMode (in: hConsoleHandle=0x144, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0126.659] GetConsoleOutputCP () returned 0x1b5
	[0126.686] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0126.686] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0126.700] exit (_Code=128) 

Thread:
	id = 148
	os_tid = 0x974


Process:
	id = "14"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\syswow64\\taskkill.exe"
	page_root = "0x47fb8000"
	os_pid = "0x968"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "13"
	os_parent_pid = "0x9a8"
	cmd_line = "taskkill  /f /im sqlwriter.exe "
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 1422
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 1423
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 1424
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 1425
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 1426
	        start_va = 0xa0000
	          end_va = 0xdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 1427
	        start_va = 0xe0000
	          end_va = 0xe3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 1428
	        start_va = 0xf0000
	          end_va = 0xf0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 1429
	        start_va = 0x100000
	          end_va = 0x101fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 1430
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 1431
	        start_va = 0x13b0000
	          end_va = 0x13c5fff
	       monitored = 0
	     entry_point = 0x13bde80
	     region_type = mapped_file
	            name = "taskkill.exe"
	        filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe")

Region:
	              id = 1432
	        start_va = 0x13d0000
	          end_va = 0x53cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000013d0000"
	        filename = ""

Region:
	              id = 1433
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 1434
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 1435
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1436
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 1437
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 1438
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 1439
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 1440
	        start_va = 0x400000
	          end_va = 0x5effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 1441
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 1442
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 1443
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 1444
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 1445
	        start_va = 0x5f0000
	          end_va = 0x85ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005f0000"
	        filename = ""

Region:
	              id = 1446
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 1447
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 1448
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 1449
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 1450
	        start_va = 0x110000
	          end_va = 0x1cdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1451
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 1452
	        start_va = 0x74650000
	          end_va = 0x746cafff
	       monitored = 0
	     entry_point = 0x7466e970
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 1453
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 1454
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 1455
	        start_va = 0x440000
	          end_va = 0x47ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000440000"
	        filename = ""

Region:
	              id = 1456
	        start_va = 0x5e0000
	          end_va = 0x5effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005e0000"
	        filename = ""

Region:
	              id = 1457
	        start_va = 0x76ae0000
	          end_va = 0x76b23fff
	       monitored = 0
	     entry_point = 0x76af9d80
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 1458
	        start_va = 0x75260000
	          end_va = 0x7530cfff
	       monitored = 0
	     entry_point = 0x75274f00
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 1459
	        start_va = 0x74450000
	          end_va = 0x7446dfff
	       monitored = 0
	     entry_point = 0x7445b640
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 1460
	        start_va = 0x74440000
	          end_va = 0x74449fff
	       monitored = 0
	     entry_point = 0x74442a00
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 1461
	        start_va = 0x74590000
	          end_va = 0x745e7fff
	       monitored = 0
	     entry_point = 0x745d25c0
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 1462
	        start_va = 0x77450000
	          end_va = 0x77596fff
	       monitored = 0
	     entry_point = 0x77461cf0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 1463
	        start_va = 0x76b30000
	          end_va = 0x76c7efff
	       monitored = 0
	     entry_point = 0x76be6820
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 1464
	        start_va = 0x753c0000
	          end_va = 0x75451fff
	       monitored = 0
	     entry_point = 0x753f8cf0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 1465
	        start_va = 0x77290000
	          end_va = 0x7744cfff
	       monitored = 0
	     entry_point = 0x77372a10
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")

Region:
	              id = 1466
	        start_va = 0x75310000
	          end_va = 0x7536efff
	       monitored = 0
	     entry_point = 0x75314af0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 1467
	        start_va = 0x77240000
	          end_va = 0x77284fff
	       monitored = 0
	     entry_point = 0x7725de90
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 1468
	        start_va = 0x6cc80000
	          end_va = 0x6cc95fff
	       monitored = 0
	     entry_point = 0x6cc821d0
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")

Region:
	              id = 1469
	        start_va = 0x6cc40000
	          end_va = 0x6cc7efff
	       monitored = 0
	     entry_point = 0x6cc546c0
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll")

Region:
	              id = 1470
	        start_va = 0x6cb00000
	          end_va = 0x6cc3efff
	       monitored = 0
	     entry_point = 0x6cb2d880
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll")

Region:
	              id = 1471
	        start_va = 0x6cad0000
	          end_va = 0x6cad7fff
	       monitored = 0
	     entry_point = 0x6cad17b0
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 1472
	        start_va = 0x6cac0000
	          end_va = 0x6cac9fff
	       monitored = 0
	     entry_point = 0x6cac28d0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")

Region:
	              id = 1473
	        start_va = 0x6cae0000
	          end_va = 0x6cafbfff
	       monitored = 0
	     entry_point = 0x6cae4720
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")

Region:
	              id = 1474
	        start_va = 0x480000
	          end_va = 0x4cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 1475
	        start_va = 0x1d0000
	          end_va = 0x1f9fff
	       monitored = 0
	     entry_point = 0x1d5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 1476
	        start_va = 0x860000
	          end_va = 0x9e7fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000860000"
	        filename = ""

Region:
	              id = 1477
	        start_va = 0x74ea0000
	          end_va = 0x74ecafff
	       monitored = 0
	     entry_point = 0x74ea5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 1478
	        start_va = 0x9f0000
	          end_va = 0xb70fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000009f0000"
	        filename = ""

Region:
	              id = 1479
	        start_va = 0x53d0000
	          end_va = 0x67cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000053d0000"
	        filename = ""

Region:
	              id = 1480
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 1481
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001d0000"
	        filename = ""

Region:
	              id = 1482
	        start_va = 0x1e0000
	          end_va = 0x1e4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taskkill.exe.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui")

Region:
	              id = 1483
	        start_va = 0x1f0000
	          end_va = 0x1f0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001f0000"
	        filename = ""

Region:
	              id = 1484
	        start_va = 0x480000
	          end_va = 0x480fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 1485
	        start_va = 0x4c0000
	          end_va = 0x4cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004c0000"
	        filename = ""

Region:
	              id = 1486
	        start_va = 0xb80000
	          end_va = 0xeb6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 1487
	        start_va = 0x4d0000
	          end_va = 0x5b9fff
	       monitored = 0
	     entry_point = 0x50d650
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 1488
	        start_va = 0x490000
	          end_va = 0x493fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000490000"
	        filename = ""

Region:
	              id = 1489
	        start_va = 0x4d0000
	          end_va = 0x5affff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 1490
	        start_va = 0x76e20000
	          end_va = 0x76e2bfff
	       monitored = 0
	     entry_point = 0x76e23930
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")

Region:
	              id = 1491
	        start_va = 0x4a0000
	          end_va = 0x4a0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004a0000"
	        filename = ""

Region:
	              id = 1492
	        start_va = 0x76c80000
	          end_va = 0x76d03fff
	       monitored = 0
	     entry_point = 0x76ca6220
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 1493
	        start_va = 0x4b0000
	          end_va = 0x4b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004b0000"
	        filename = ""

Region:
	              id = 1494
	        start_va = 0x6cab0000
	          end_va = 0x6cabcfff
	       monitored = 0
	     entry_point = 0x6cab3520
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 1495
	        start_va = 0x6ca40000
	          end_va = 0x6caa6fff
	       monitored = 0
	     entry_point = 0x6ca5b610
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 1496
	        start_va = 0x740f0000
	          end_va = 0x7410afff
	       monitored = 0
	     entry_point = 0x740f9050
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 1497
	        start_va = 0x6c9f0000
	          end_va = 0x6ca33fff
	       monitored = 0
	     entry_point = 0x6ca0aaf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")

Region:
	              id = 1498
	        start_va = 0x5f0000
	          end_va = 0x62ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005f0000"
	        filename = ""

Region:
	              id = 1499
	        start_va = 0x630000
	          end_va = 0x66ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000630000"
	        filename = ""

Region:
	              id = 1500
	        start_va = 0x760000
	          end_va = 0x85ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000760000"
	        filename = ""

Region:
	              id = 1501
	        start_va = 0x670000
	          end_va = 0x6affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000670000"
	        filename = ""

Region:
	              id = 1502
	        start_va = 0x6b0000
	          end_va = 0x6effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006b0000"
	        filename = ""

Region:
	              id = 1503
	        start_va = 0x6f0000
	          end_va = 0x72ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006f0000"
	        filename = ""

Region:
	              id = 1504
	        start_va = 0xec0000
	          end_va = 0xefffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ec0000"
	        filename = ""

Region:
	              id = 1505
	        start_va = 0x6c9d0000
	          end_va = 0x6c9e0fff
	       monitored = 0
	     entry_point = 0x6c9d8fa0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 1506
	        start_va = 0x6c910000
	          end_va = 0x6c9cefff
	       monitored = 0
	     entry_point = 0x6c941e80
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 1509
	        start_va = 0x5b0000
	          end_va = 0x5b5fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000005b0000"
	        filename = ""


Thread:
	id = 149
	os_tid = 0x7a0


Thread:
	id = 150
	os_tid = 0xf90


Thread:
	id = 151
	os_tid = 0x75c


Thread:
	id = 152
	os_tid = 0x884


Thread:
	id = 153
	os_tid = 0xb0c


Process:
	id = "15"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x488e3000"
	os_pid = "0x8ec"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x614"
	cmd_line = "cmd.exe /c \"taskkill /f /im oracle.exe \""
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 1510
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 1511
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 1512
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 1513
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 1514
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 1515
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 1516
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 1517
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 1518
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 1519
	        start_va = 0x13a0000
	          end_va = 0x13f1fff
	       monitored = 1
	     entry_point = 0x13b4fd0
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")

Region:
	              id = 1520
	        start_va = 0x1400000
	          end_va = 0x53fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001400000"
	        filename = ""

Region:
	              id = 1521
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 1522
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 1523
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1524
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 1525
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 1526
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 1527
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 1528
	        start_va = 0x400000
	          end_va = 0x47ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 1529
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 1530
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 1531
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 1532
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 1533
	        start_va = 0x480000
	          end_va = 0x6effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 1534
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 1535
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 1536
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 1537
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 1538
	        start_va = 0x480000
	          end_va = 0x53dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1539
	        start_va = 0x5f0000
	          end_va = 0x6effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005f0000"
	        filename = ""

Region:
	              id = 1540
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 1541
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 1542
	        start_va = 0x470000
	          end_va = 0x47ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000470000"
	        filename = ""

Region:
	              id = 1543
	        start_va = 0x6f0000
	          end_va = 0x7effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006f0000"
	        filename = ""

Region:
	              id = 1544
	        start_va = 0x7f0000
	          end_va = 0x99ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000007f0000"
	        filename = ""

Region:
	              id = 1545
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 1546
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 1547
	        start_va = 0x9a0000
	          end_va = 0xcd6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 154
	os_tid = 0xd2c

	[0127.073] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000
	[0127.073] __set_app_type (_Type=0x1) 
	[0127.073] __p__fmode () returned 0x74974d6c
	[0127.073] __p__commode () returned 0x74975b1c
	[0127.073] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13b5200) returned 0x0
	[0127.073] __getmainargs (in: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0, _DoWildCard=0, _StartInfo=0x13c60fc | out: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0) returned 0
	[0127.074] GetCurrentThreadId () returned 0xd2c
	[0127.074] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xd2c) returned 0x78
	[0127.074] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0127.074] GetProcAddress (hModule=0x75600000, lpProcName="SetThreadUILanguage") returned 0x75642510
	[0127.074] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0127.094] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0127.094] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2
	[0127.095] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0127.095] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0127.095] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0127.095] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0127.095] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0127.095] GetConsoleOutputCP () returned 0x1b5
	[0127.098] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0127.098] SetConsoleCtrlHandler (HandlerRoutine=0x13c0e40, Add=1) returned 1
	[0127.098] _get_osfhandle (_FileHandle=1) returned 0x144
	[0127.098] SetConsoleMode (hConsoleHandle=0x144, dwMode=0x0) returned 0
	[0127.098] _get_osfhandle (_FileHandle=1) returned 0x144
	[0127.098] GetConsoleMode (in: hConsoleHandle=0x144, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0127.098] _get_osfhandle (_FileHandle=0) returned 0x140
	[0127.098] GetConsoleMode (in: hConsoleHandle=0x140, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0127.098] GetEnvironmentStringsW () returned 0x5f7cc0*
	[0127.099] GetProcessHeap () returned 0x5f0000
	[0127.099] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xa1a) returned 0x5f86e8
	[0127.099] FreeEnvironmentStringsA (penv="A") returned 1
	[0127.099] GetProcessHeap () returned 0x5f0000
	[0127.099] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x4) returned 0x5f0550
	[0127.099] GetEnvironmentStringsW () returned 0x5f7cc0*
	[0127.099] GetProcessHeap () returned 0x5f0000
	[0127.099] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xa1a) returned 0x5f9110
	[0127.099] FreeEnvironmentStringsA (penv="A") returned 1
	[0127.099] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0127.100] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0127.100] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0127.100] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0127.100] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0127.100] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0127.100] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0127.100] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0127.100] RegCloseKey (hKey=0x88) returned 0x0
	[0127.100] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0127.101] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0127.101] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0127.101] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0127.101] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0127.101] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0127.101] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0127.101] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0127.101] RegCloseKey (hKey=0x88) returned 0x0
	[0127.101] time (in: timer=0x0 | out: timer=0x0) returned 0x62344209
	[0127.101] srand (_Seed=0x62344209) 
	[0127.101] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im oracle.exe \""
	[0127.101] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im oracle.exe \""
	[0127.101] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0127.102] GetProcessHeap () returned 0x5f0000
	[0127.102] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x210) returned 0x5f9b38
	[0127.102] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5f9b40, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0127.102] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0127.102] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0127.102] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0127.102] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0127.102] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0127.102] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0127.102] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0127.102] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0127.102] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0127.102] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0127.103] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0127.103] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0127.103] GetProcessHeap () returned 0x5f0000
	[0127.103] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5f86e8) returned 1
	[0127.104] GetEnvironmentStringsW () returned 0x5f7cc0*
	[0127.104] GetProcessHeap () returned 0x5f0000
	[0127.104] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xa32) returned 0x5fa790
	[0127.104] FreeEnvironmentStringsA (penv="A") returned 1
	[0127.104] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b
	[0127.104] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0127.104] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0127.104] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0127.104] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0127.104] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0127.104] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0127.104] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0127.104] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0127.104] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0127.107] GetProcessHeap () returned 0x5f0000
	[0127.107] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x44) returned 0x5f05c8
	[0127.107] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0127.107] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19fc4c*="Desktop") returned 0x1d
	[0127.107] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0127.108] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x5f0618
	[0127.108] FindClose (in: hFindFile=0x5f0618 | out: hFindFile=0x5f0618) returned 1
	[0127.108] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x5f0618
	[0127.108] FindClose (in: hFindFile=0x5f0618 | out: hFindFile=0x5f0618) returned 1
	[0127.108] _wcsnicmp (_String1="RDHJ0C~1", _String2="RDhJ0CNFevzX", _MaxCount=0xc) returned 16
	[0127.108] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x5f0618
	[0127.109] FindClose (in: hFindFile=0x5f0618 | out: hFindFile=0x5f0618) returned 1
	[0127.109] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0127.109] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1
	[0127.109] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 1
	[0127.109] GetProcessHeap () returned 0x5f0000
	[0127.110] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5fa790) returned 1
	[0127.110] GetEnvironmentStringsW () returned 0x5f7cc0*
	[0127.110] GetProcessHeap () returned 0x5f0000
	[0127.110] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xa76) returned 0x5f9d50
	[0127.110] FreeEnvironmentStringsA (penv="=") returned 1
	[0127.110] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0127.110] GetProcessHeap () returned 0x5f0000
	[0127.110] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5f05c8) returned 1
	[0127.110] GetProcessHeap () returned 0x5f0000
	[0127.110] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x400e) returned 0x5fbc50
	[0127.111] GetProcessHeap () returned 0x5f0000
	[0127.111] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x48) returned 0x5fa7d0
	[0127.111] GetProcessHeap () returned 0x5f0000
	[0127.111] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x4008) returned 0x5ffc68
	[0127.112] GetProcessHeap () returned 0x5f0000
	[0127.112] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x4008) returned 0x603c78
	[0127.113] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0127.114] GetProcessHeap () returned 0x5f0000
	[0127.114] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x418) returned 0x5fa820
	[0127.114] SetErrorMode (uMode=0x0) returned 0x8003
	[0127.114] SetErrorMode (uMode=0x1) returned 0x0
	[0127.114] GetFullPathNameW (in: lpFileName="taskkill \\f \\.", nBufferLength=0x208, lpBuffer=0x5fa828, lpFilePart=0x19fbac | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f", lpFilePart=0x19fbac*="f") returned 0x29
	[0127.114] SetErrorMode (uMode=0x8003) returned 0x1
	[0127.114] GetProcessHeap () returned 0x5f0000
	[0127.114] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x5fa820, Size=0x7a) returned 0x5fa820
	[0127.114] GetProcessHeap () returned 0x5f0000
	[0127.114] RtlSizeHeap (HeapHandle=0x5f0000, Flags=0x0, MemoryPointer=0x5fa820) returned 0x7a
	[0127.114] NeedCurrentDirectoryForExePathW (ExeName="taskkill \\f \\.") returned 1
	[0127.115] GetProcessHeap () returned 0x5f0000
	[0127.115] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x62) returned 0x5fa8a8
	[0127.115] GetProcessHeap () returned 0x5f0000
	[0127.115] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xb8) returned 0x5fa918
	[0127.115] GetProcessHeap () returned 0x5f0000
	[0127.115] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x5fa918, Size=0x62) returned 0x5fa918
	[0127.115] GetProcessHeap () returned 0x5f0000
	[0127.115] RtlSizeHeap (HeapHandle=0x5f0000, Flags=0x0, MemoryPointer=0x5fa918) returned 0x62
	[0127.115] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0127.115] GetProcessHeap () returned 0x5f0000
	[0127.115] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xe0) returned 0x5fa988
	[0127.122] GetProcessHeap () returned 0x5f0000
	[0127.122] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x5fa988, Size=0x76) returned 0x5fa988
	[0127.122] GetProcessHeap () returned 0x5f0000
	[0127.122] RtlSizeHeap (HeapHandle=0x5f0000, Flags=0x0, MemoryPointer=0x5fa988) returned 0x76
	[0127.122] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0127.123] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f\\im oracle.exe ", fInfoLevelId=0x1, lpFindFileData=0x19f958, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f958) returned 0xffffffff
	[0127.123] GetLastError () returned 0x3
	[0127.123] GetProcessHeap () returned 0x5f0000
	[0127.124] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5ffc68) returned 1
	[0127.124] GetProcessHeap () returned 0x5f0000
	[0127.124] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x603c78) returned 1
	[0127.124] GetProcessHeap () returned 0x5f0000
	[0127.125] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5fbc50) returned 1
	[0127.125] GetConsoleOutputCP () returned 0x1b5
	[0127.127] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0127.127] GetUserDefaultLCID () returned 0x409
	[0127.128] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x13d34a0, cchData=8 | out: lpLCData=":") returned 2
	[0127.128] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0127.128] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0127.128] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2
	[0127.128] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x13d34b0, cchData=8 | out: lpLCData="/") returned 2
	[0127.128] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x13d3500, cchData=32 | out: lpLCData="Mon") returned 4
	[0127.128] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x13d3540, cchData=32 | out: lpLCData="Tue") returned 4
	[0127.128] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x13d3580, cchData=32 | out: lpLCData="Wed") returned 4
	[0127.128] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x13d35c0, cchData=32 | out: lpLCData="Thu") returned 4
	[0127.128] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x13d3600, cchData=32 | out: lpLCData="Fri") returned 4
	[0127.128] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x13d3640, cchData=32 | out: lpLCData="Sat") returned 4
	[0127.128] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x13d3680, cchData=32 | out: lpLCData="Sun") returned 4
	[0127.129] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x13d34c0, cchData=8 | out: lpLCData=".") returned 2
	[0127.129] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x13d34e0, cchData=8 | out: lpLCData=",") returned 2
	[0127.129] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0127.131] GetProcessHeap () returned 0x5f0000
	[0127.131] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x20c) returned 0x5faa50
	[0127.131] GetConsoleTitleW (in: lpConsoleTitle=0x5faa50, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0127.132] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0127.132] GetProcAddress (hModule=0x75600000, lpProcName="CopyFileExW") returned 0x7561ffc0
	[0127.132] GetProcAddress (hModule=0x75600000, lpProcName="IsDebuggerPresent") returned 0x7561b0b0
	[0127.132] GetProcAddress (hModule=0x75600000, lpProcName="SetConsoleInputExeNameW") returned 0x7559b440
	[0127.133] GetProcessHeap () returned 0x5f0000
	[0127.133] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x400a) returned 0x5fbc50
	[0127.133] GetProcessHeap () returned 0x5f0000
	[0127.133] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5fbc50) returned 1
	[0127.134] _wcsicmp (_String1="taskkill", _String2=")") returned 75
	[0127.134] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14
	[0127.134] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14
	[0127.134] _wcsicmp (_String1="IF", _String2="taskkill") returned -11
	[0127.134] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11
	[0127.134] _wcsicmp (_String1="REM", _String2="taskkill") returned -2
	[0127.134] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2
	[0127.135] GetProcessHeap () returned 0x5f0000
	[0127.135] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x58) returned 0x5fac68
	[0127.135] GetProcessHeap () returned 0x5f0000
	[0127.135] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x1a) returned 0x5f0578
	[0127.135] GetProcessHeap () returned 0x5f0000
	[0127.136] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x30) returned 0x5facc8
	[0127.137] GetConsoleTitleW (in: lpConsoleTitle=0x19fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0127.140] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0127.140] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0127.140] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0127.140] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0127.140] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0127.140] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0127.140] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0127.140] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0127.140] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0127.141] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0127.141] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0127.141] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0127.141] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0127.141] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0127.141] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0127.141] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0127.141] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0127.141] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0127.141] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0127.141] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0127.141] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0127.141] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0127.141] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0127.141] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0127.141] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0127.141] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0127.141] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0127.141] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0127.141] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0127.141] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0127.141] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0127.142] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0127.142] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0127.142] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0127.142] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0127.142] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0127.142] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0127.142] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0127.142] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0127.142] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0127.142] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0127.142] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0127.142] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0127.142] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0127.142] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0127.142] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0127.142] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0127.142] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0127.142] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0127.142] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0127.142] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0127.142] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0127.142] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0127.142] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0127.142] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0127.142] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0127.143] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0127.143] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0127.143] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0127.143] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0127.143] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0127.143] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0127.143] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0127.143] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0127.143] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0127.143] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0127.143] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0127.143] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0127.143] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0127.143] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0127.143] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0127.143] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0127.143] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0127.143] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0127.143] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0127.143] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0127.143] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0127.143] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0127.144] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0127.144] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0127.144] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0127.144] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0127.144] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0127.144] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0127.144] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14
	[0127.144] _wcsicmp (_String1="taskkill", _String2="IF") returned 11
	[0127.144] _wcsicmp (_String1="taskkill", _String2="REM") returned 2
	[0127.144] GetProcessHeap () returned 0x5f0000
	[0127.144] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x210) returned 0x5fad00
	[0127.145] GetProcessHeap () returned 0x5f0000
	[0127.145] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x42) returned 0x5faf18
	[0127.145] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0127.145] GetProcessHeap () returned 0x5f0000
	[0127.145] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x418) returned 0x5f05c8
	[0127.145] SetErrorMode (uMode=0x0) returned 0x8003
	[0127.145] SetErrorMode (uMode=0x1) returned 0x0
	[0127.146] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x5f05d0, lpFilePart=0x19f57c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19f57c*="Desktop") returned 0x1d
	[0127.146] SetErrorMode (uMode=0x8003) returned 0x1
	[0127.146] GetProcessHeap () returned 0x5f0000
	[0127.146] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x5f05c8, Size=0x56) returned 0x5f05c8
	[0127.146] GetProcessHeap () returned 0x5f0000
	[0127.146] RtlSizeHeap (HeapHandle=0x5f0000, Flags=0x0, MemoryPointer=0x5f05c8) returned 0x56
	[0127.146] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0127.146] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0127.146] GetProcessHeap () returned 0x5f0000
	[0127.146] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x110) returned 0x5faf68
	[0127.146] GetProcessHeap () returned 0x5f0000
	[0127.146] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x218) returned 0x5f0628
	[0127.153] GetProcessHeap () returned 0x5f0000
	[0127.153] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x5f0628, Size=0x112) returned 0x5f0628
	[0127.153] GetProcessHeap () returned 0x5f0000
	[0127.153] RtlSizeHeap (HeapHandle=0x5f0000, Flags=0x0, MemoryPointer=0x5f0628) returned 0x112
	[0127.153] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0127.153] GetProcessHeap () returned 0x5f0000
	[0127.153] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xe0) returned 0x5fb080
	[0127.156] GetProcessHeap () returned 0x5f0000
	[0127.156] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x5fb080, Size=0x76) returned 0x5fb080
	[0127.156] GetProcessHeap () returned 0x5f0000
	[0127.156] RtlSizeHeap (HeapHandle=0x5f0000, Flags=0x0, MemoryPointer=0x5fb080) returned 0x76
	[0127.156] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0127.156] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0127.157] GetLastError () returned 0x2
	[0127.157] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0127.157] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x5fb100
	[0127.157] GetProcessHeap () returned 0x5f0000
	[0127.157] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x14) returned 0x5f75a8
	[0127.158] FindClose (in: hFindFile=0x5fb100 | out: hFindFile=0x5fb100) returned 1
	[0127.158] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0127.158] GetLastError () returned 0x2
	[0127.158] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x5fb100
	[0127.158] GetProcessHeap () returned 0x5f0000
	[0127.159] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x5f75a8, Size=0x4) returned 0x5fb140
	[0127.159] FindClose (in: hFindFile=0x5fb100 | out: hFindFile=0x5fb100) returned 1
	[0127.159] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0127.159] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0127.159] GetConsoleTitleW (in: lpConsoleTitle=0x19f7fc, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0127.162] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f728, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f70c | out: lpAttributeList=0x19f728, lpSize=0x19f70c) returned 1
	[0127.162] UpdateProcThreadAttribute (in: lpAttributeList=0x19f728, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f714, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f728, lpPreviousValue=0x0) returned 1
	[0127.162] GetStartupInfoW (in: lpStartupInfo=0x19f760 | out: lpStartupInfo=0x19f760*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x140, hStdOutput=0x144, hStdError=0x150)) 
	[0127.162] GetProcessHeap () returned 0x5f0000
	[0127.162] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x18) returned 0x5f7488
	[0127.162] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0127.162] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0127.162] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0127.162] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0127.162] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0127.162] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0127.162] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0127.162] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0127.162] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0127.162] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0127.163] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0127.163] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0127.163] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0127.163] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0127.163] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0127.163] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0127.163] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0127.163] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0127.163] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0127.163] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0127.163] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0127.163] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0127.163] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0127.163] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0127.163] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0127.163] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0127.163] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0127.163] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0127.163] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0127.163] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0127.163] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0127.163] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0127.163] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0127.163] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0127.164] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0127.164] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0127.164] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0127.164] GetProcessHeap () returned 0x5f0000
	[0127.164] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5f7488) returned 1
	[0127.164] GetProcessHeap () returned 0x5f0000
	[0127.164] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xa) returned 0x5fb100
	[0127.164] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1
	[0127.168] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill  /f /im oracle.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x19f6b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill  /f /im oracle.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f6fc | out: lpCommandLine="taskkill  /f /im oracle.exe ", lpProcessInformation=0x19f6fc*(hProcess=0x9c, hThread=0x98, dwProcessId=0xb0, dwThreadId=0x660)) returned 1
	[0127.191] CloseHandle (hObject=0x98) returned 1
	[0127.191] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0127.191] GetProcessHeap () returned 0x5f0000
	[0127.192] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5f9d50) returned 1
	[0127.192] GetEnvironmentStringsW () returned 0x5f9d50*
	[0127.192] GetProcessHeap () returned 0x5f0000
	[0127.192] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xa76) returned 0x5fbc50
	[0127.192] FreeEnvironmentStringsA (penv="=") returned 1
	[0127.192] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0
	[0128.273] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x19f694 | out: lpExitCode=0x19f694*=0x80) returned 1
	[0128.273] CloseHandle (hObject=0x9c) returned 1
	[0128.273] _vsnwprintf (in: _Buffer=0x19f77c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f69c | out: _Buffer="00000080") returned 8
	[0128.274] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1
	[0128.274] GetProcessHeap () returned 0x5f0000
	[0128.274] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5fbc50) returned 1
	[0128.275] GetEnvironmentStringsW () returned 0x5fb150*
	[0128.275] GetProcessHeap () returned 0x5f0000
	[0128.275] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xa9c) returned 0x5fbbf8
	[0128.275] FreeEnvironmentStringsA (penv="=") returned 1
	[0128.275] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0128.276] GetProcessHeap () returned 0x5f0000
	[0128.276] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5fbbf8) returned 1
	[0128.276] GetEnvironmentStringsW () returned 0x5fb150*
	[0128.276] GetProcessHeap () returned 0x5f0000
	[0128.276] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xa9c) returned 0x5fbbf8
	[0128.276] FreeEnvironmentStringsA (penv="=") returned 1
	[0128.276] GetProcessHeap () returned 0x5f0000
	[0128.276] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5fb100) returned 1
	[0128.276] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f728 | out: lpAttributeList=0x19f728) 
	[0128.277] _get_osfhandle (_FileHandle=1) returned 0x144
	[0128.277] SetConsoleMode (hConsoleHandle=0x144, dwMode=0x0) returned 0
	[0128.277] _get_osfhandle (_FileHandle=1) returned 0x144
	[0128.277] GetConsoleMode (in: hConsoleHandle=0x144, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0128.277] _get_osfhandle (_FileHandle=0) returned 0x140
	[0128.277] GetConsoleMode (in: hConsoleHandle=0x140, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0128.277] GetConsoleOutputCP () returned 0x1b5
	[0128.283] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0128.283] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0128.285] exit (_Code=128) 

Thread:
	id = 155
	os_tid = 0x81c


Process:
	id = "16"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\syswow64\\taskkill.exe"
	page_root = "0x47ce3000"
	os_pid = "0xb0"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "15"
	os_parent_pid = "0x8ec"
	cmd_line = "taskkill  /f /im oracle.exe "
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 1548
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 1549
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 1550
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 1551
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 1552
	        start_va = 0xa0000
	          end_va = 0xdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 1553
	        start_va = 0xe0000
	          end_va = 0xe3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 1554
	        start_va = 0xf0000
	          end_va = 0xf0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 1555
	        start_va = 0x100000
	          end_va = 0x101fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 1556
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 1557
	        start_va = 0x13b0000
	          end_va = 0x13c5fff
	       monitored = 0
	     entry_point = 0x13bde80
	     region_type = mapped_file
	            name = "taskkill.exe"
	        filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe")

Region:
	              id = 1558
	        start_va = 0x13d0000
	          end_va = 0x53cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000013d0000"
	        filename = ""

Region:
	              id = 1559
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 1560
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 1561
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1562
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 1563
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 1564
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 1565
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 1566
	        start_va = 0x5b0000
	          end_va = 0x5bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005b0000"
	        filename = ""

Region:
	              id = 1567
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 1568
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 1569
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 1570
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 1571
	        start_va = 0x400000
	          end_va = 0x4fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 1572
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 1573
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 1574
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 1575
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 1576
	        start_va = 0x110000
	          end_va = 0x1cdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1577
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 1578
	        start_va = 0x74650000
	          end_va = 0x746cafff
	       monitored = 0
	     entry_point = 0x7466e970
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 1579
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 1580
	        start_va = 0x500000
	          end_va = 0x53ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000500000"
	        filename = ""

Region:
	              id = 1581
	        start_va = 0x540000
	          end_va = 0x57ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000540000"
	        filename = ""

Region:
	              id = 1582
	        start_va = 0x76ae0000
	          end_va = 0x76b23fff
	       monitored = 0
	     entry_point = 0x76af9d80
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 1583
	        start_va = 0x75260000
	          end_va = 0x7530cfff
	       monitored = 0
	     entry_point = 0x75274f00
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 1584
	        start_va = 0x74450000
	          end_va = 0x7446dfff
	       monitored = 0
	     entry_point = 0x7445b640
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 1585
	        start_va = 0x74440000
	          end_va = 0x74449fff
	       monitored = 0
	     entry_point = 0x74442a00
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 1586
	        start_va = 0x74590000
	          end_va = 0x745e7fff
	       monitored = 0
	     entry_point = 0x745d25c0
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 1587
	        start_va = 0x77450000
	          end_va = 0x77596fff
	       monitored = 0
	     entry_point = 0x77461cf0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 1588
	        start_va = 0x76b30000
	          end_va = 0x76c7efff
	       monitored = 0
	     entry_point = 0x76be6820
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 1589
	        start_va = 0x753c0000
	          end_va = 0x75451fff
	       monitored = 0
	     entry_point = 0x753f8cf0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 1590
	        start_va = 0x77290000
	          end_va = 0x7744cfff
	       monitored = 0
	     entry_point = 0x77372a10
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")

Region:
	              id = 1591
	        start_va = 0x75310000
	          end_va = 0x7536efff
	       monitored = 0
	     entry_point = 0x75314af0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 1592
	        start_va = 0x77240000
	          end_va = 0x77284fff
	       monitored = 0
	     entry_point = 0x7725de90
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 1593
	        start_va = 0x6cc90000
	          end_va = 0x6cc97fff
	       monitored = 0
	     entry_point = 0x6cc917b0
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 1594
	        start_va = 0x6cc70000
	          end_va = 0x6cc85fff
	       monitored = 0
	     entry_point = 0x6cc721d0
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")

Region:
	              id = 1595
	        start_va = 0x6cc30000
	          end_va = 0x6cc6efff
	       monitored = 0
	     entry_point = 0x6cc446c0
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll")

Region:
	              id = 1596
	        start_va = 0x6caf0000
	          end_va = 0x6cc2efff
	       monitored = 0
	     entry_point = 0x6cb1d880
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll")

Region:
	              id = 1597
	        start_va = 0x6cad0000
	          end_va = 0x6caebfff
	       monitored = 0
	     entry_point = 0x6cad4720
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")

Region:
	              id = 1598
	        start_va = 0x6cac0000
	          end_va = 0x6cac9fff
	       monitored = 0
	     entry_point = 0x6cac28d0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")

Region:
	              id = 1599
	        start_va = 0x5c0000
	          end_va = 0x65ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005c0000"
	        filename = ""

Region:
	              id = 1600
	        start_va = 0x1d0000
	          end_va = 0x1f9fff
	       monitored = 0
	     entry_point = 0x1d5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 1601
	        start_va = 0x660000
	          end_va = 0x7e7fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000660000"
	        filename = ""

Region:
	              id = 1602
	        start_va = 0x74ea0000
	          end_va = 0x74ecafff
	       monitored = 0
	     entry_point = 0x74ea5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 1603
	        start_va = 0x7f0000
	          end_va = 0x970fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000007f0000"
	        filename = ""

Region:
	              id = 1604
	        start_va = 0x53d0000
	          end_va = 0x67cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000053d0000"
	        filename = ""

Region:
	              id = 1605
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 1606
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001d0000"
	        filename = ""

Region:
	              id = 1607
	        start_va = 0x1e0000
	          end_va = 0x1e4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taskkill.exe.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui")

Region:
	              id = 1608
	        start_va = 0x1f0000
	          end_va = 0x1f0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001f0000"
	        filename = ""

Region:
	              id = 1609
	        start_va = 0x580000
	          end_va = 0x580fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000580000"
	        filename = ""

Region:
	              id = 1610
	        start_va = 0x980000
	          end_va = 0xcb6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 1611
	        start_va = 0xcc0000
	          end_va = 0xda9fff
	       monitored = 0
	     entry_point = 0xcfd650
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 1612
	        start_va = 0x590000
	          end_va = 0x593fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000590000"
	        filename = ""

Region:
	              id = 1613
	        start_va = 0xcc0000
	          end_va = 0xd9ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 1614
	        start_va = 0x76e20000
	          end_va = 0x76e2bfff
	       monitored = 0
	     entry_point = 0x76e23930
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")

Region:
	              id = 1615
	        start_va = 0x5a0000
	          end_va = 0x5a0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000005a0000"
	        filename = ""

Region:
	              id = 1616
	        start_va = 0x76c80000
	          end_va = 0x76d03fff
	       monitored = 0
	     entry_point = 0x76ca6220
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 1617
	        start_va = 0x5c0000
	          end_va = 0x5c0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000005c0000"
	        filename = ""

Region:
	              id = 1618
	        start_va = 0x650000
	          end_va = 0x65ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000650000"
	        filename = ""

Region:
	              id = 1619
	        start_va = 0x6cab0000
	          end_va = 0x6cabcfff
	       monitored = 0
	     entry_point = 0x6cab3520
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 1620
	        start_va = 0x6ca40000
	          end_va = 0x6caa6fff
	       monitored = 0
	     entry_point = 0x6ca5b610
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 1621
	        start_va = 0x740f0000
	          end_va = 0x7410afff
	       monitored = 0
	     entry_point = 0x740f9050
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 1622
	        start_va = 0x6c9f0000
	          end_va = 0x6ca33fff
	       monitored = 0
	     entry_point = 0x6ca0aaf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")

Region:
	              id = 1623
	        start_va = 0x5d0000
	          end_va = 0x60ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005d0000"
	        filename = ""

Region:
	              id = 1624
	        start_va = 0x610000
	          end_va = 0x64ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000610000"
	        filename = ""

Region:
	              id = 1625
	        start_va = 0xda0000
	          end_va = 0xddffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000da0000"
	        filename = ""

Region:
	              id = 1626
	        start_va = 0xde0000
	          end_va = 0xe1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000de0000"
	        filename = ""

Region:
	              id = 1627
	        start_va = 0xe20000
	          end_va = 0xe5ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e20000"
	        filename = ""

Region:
	              id = 1628
	        start_va = 0xe60000
	          end_va = 0xe9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e60000"
	        filename = ""

Region:
	              id = 1629
	        start_va = 0x6c9d0000
	          end_va = 0x6c9e0fff
	       monitored = 0
	     entry_point = 0x6c9d8fa0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 1630
	        start_va = 0x6c910000
	          end_va = 0x6c9cefff
	       monitored = 0
	     entry_point = 0x6c941e80
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 1632
	        start_va = 0xea0000
	          end_va = 0xea5fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000ea0000"
	        filename = ""


Thread:
	id = 156
	os_tid = 0x660


Thread:
	id = 157
	os_tid = 0xd30


Thread:
	id = 158
	os_tid = 0xf1c


Thread:
	id = 159
	os_tid = 0x2f0


Thread:
	id = 160
	os_tid = 0x670


Process:
	id = "17"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x47aec000"
	os_pid = "0xb98"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x614"
	cmd_line = "cmd.exe /c \"taskkill /f /im ocssd.exe \""
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 1635
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 1636
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 1637
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 1638
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 1639
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 1640
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 1641
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 1642
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 1643
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 1644
	        start_va = 0x13a0000
	          end_va = 0x13f1fff
	       monitored = 1
	     entry_point = 0x13b4fd0
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")

Region:
	              id = 1645
	        start_va = 0x1400000
	          end_va = 0x53fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001400000"
	        filename = ""

Region:
	              id = 1646
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 1647
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 1648
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1649
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 1650
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 1651
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 1652
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 1653
	        start_va = 0x490000
	          end_va = 0x49ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000490000"
	        filename = ""

Region:
	              id = 1654
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 1655
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 1656
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 1657
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 1658
	        start_va = 0x4a0000
	          end_va = 0x5affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004a0000"
	        filename = ""

Region:
	              id = 1659
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 1660
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 1661
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 1662
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 1663
	        start_va = 0x5b0000
	          end_va = 0x66dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1664
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 1665
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 1666
	        start_va = 0x670000
	          end_va = 0x76ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000670000"
	        filename = ""

Region:
	              id = 1667
	        start_va = 0x770000
	          end_va = 0x94ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000770000"
	        filename = ""

Region:
	              id = 1668
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 1669
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 1670
	        start_va = 0x950000
	          end_va = 0xc86fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 161
	os_tid = 0x990

	[0128.643] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000
	[0128.643] __set_app_type (_Type=0x1) 
	[0128.643] __p__fmode () returned 0x74974d6c
	[0128.643] __p__commode () returned 0x74975b1c
	[0128.643] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13b5200) returned 0x0
	[0128.643] __getmainargs (in: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0, _DoWildCard=0, _StartInfo=0x13c60fc | out: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0) returned 0
	[0128.644] GetCurrentThreadId () returned 0x990
	[0128.644] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x990) returned 0x78
	[0128.644] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0128.644] GetProcAddress (hModule=0x75600000, lpProcName="SetThreadUILanguage") returned 0x75642510
	[0128.644] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0128.650] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0128.650] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2
	[0128.650] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0128.650] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0128.650] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0128.650] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0128.650] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0128.650] GetConsoleOutputCP () returned 0x1b5
	[0128.657] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0128.657] SetConsoleCtrlHandler (HandlerRoutine=0x13c0e40, Add=1) returned 1
	[0128.658] _get_osfhandle (_FileHandle=1) returned 0x140
	[0128.658] SetConsoleMode (hConsoleHandle=0x140, dwMode=0x0) returned 0
	[0128.658] _get_osfhandle (_FileHandle=1) returned 0x140
	[0128.658] GetConsoleMode (in: hConsoleHandle=0x140, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0128.658] _get_osfhandle (_FileHandle=0) returned 0x13c
	[0128.658] GetConsoleMode (in: hConsoleHandle=0x13c, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0128.658] GetEnvironmentStringsW () returned 0x4b7fd0*
	[0128.658] GetProcessHeap () returned 0x4b0000
	[0128.658] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0xa1a) returned 0x4b89f8
	[0128.658] FreeEnvironmentStringsA (penv="A") returned 1
	[0128.658] GetProcessHeap () returned 0x4b0000
	[0128.658] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x4) returned 0x4b7e58
	[0128.658] GetEnvironmentStringsW () returned 0x4b7fd0*
	[0128.659] GetProcessHeap () returned 0x4b0000
	[0128.659] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0xa1a) returned 0x4b9420
	[0128.659] FreeEnvironmentStringsA (penv="A") returned 1
	[0128.659] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0128.659] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0128.659] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0128.659] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0128.659] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0128.659] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0128.659] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0128.659] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0128.659] RegCloseKey (hKey=0x88) returned 0x0
	[0128.659] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0128.660] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0128.660] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0128.660] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0128.660] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0128.660] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0128.660] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0128.660] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0128.660] RegCloseKey (hKey=0x88) returned 0x0
	[0128.660] time (in: timer=0x0 | out: timer=0x0) returned 0x6234420a
	[0128.660] srand (_Seed=0x6234420a) 
	[0128.660] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im ocssd.exe \""
	[0128.660] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im ocssd.exe \""
	[0128.660] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0128.660] GetProcessHeap () returned 0x4b0000
	[0128.660] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x210) returned 0x4b6f88
	[0128.660] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4b6f90, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0128.660] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0128.660] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0128.661] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0128.661] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0128.661] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0128.661] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0128.661] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0128.661] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0128.661] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0128.661] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0128.661] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0128.661] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0128.661] GetProcessHeap () returned 0x4b0000
	[0128.662] RtlFreeHeap (HeapHandle=0x4b0000, Flags=0x0, BaseAddress=0x4b89f8) returned 1
	[0128.662] GetEnvironmentStringsW () returned 0x4b7fd0*
	[0128.662] GetProcessHeap () returned 0x4b0000
	[0128.662] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0xa32) returned 0x4ba888
	[0128.662] FreeEnvironmentStringsA (penv="A") returned 1
	[0128.662] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b
	[0128.662] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0128.662] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0128.662] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0128.662] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0128.662] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0128.662] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0128.662] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0128.663] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0128.663] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0128.663] GetProcessHeap () returned 0x4b0000
	[0128.663] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x44) returned 0x4b71a0
	[0128.663] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0128.663] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19fc4c*="Desktop") returned 0x1d
	[0128.663] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0128.663] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x4b71f0
	[0128.664] FindClose (in: hFindFile=0x4b71f0 | out: hFindFile=0x4b71f0) returned 1
	[0128.664] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x4b71f0
	[0128.664] FindClose (in: hFindFile=0x4b71f0 | out: hFindFile=0x4b71f0) returned 1
	[0128.664] _wcsnicmp (_String1="RDHJ0C~1", _String2="RDhJ0CNFevzX", _MaxCount=0xc) returned 16
	[0128.664] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x4b71f0
	[0128.664] FindClose (in: hFindFile=0x4b71f0 | out: hFindFile=0x4b71f0) returned 1
	[0128.664] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0128.664] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1
	[0128.665] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 1
	[0128.665] GetProcessHeap () returned 0x4b0000
	[0128.665] RtlFreeHeap (HeapHandle=0x4b0000, Flags=0x0, BaseAddress=0x4ba888) returned 1
	[0128.665] GetEnvironmentStringsW () returned 0x4b7fd0*
	[0128.665] GetProcessHeap () returned 0x4b0000
	[0128.665] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0xa76) returned 0x4b9e48
	[0128.665] FreeEnvironmentStringsA (penv="=") returned 1
	[0128.665] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0128.665] GetProcessHeap () returned 0x4b0000
	[0128.666] RtlFreeHeap (HeapHandle=0x4b0000, Flags=0x0, BaseAddress=0x4b71a0) returned 1
	[0128.666] GetProcessHeap () returned 0x4b0000
	[0128.666] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x400e) returned 0x4bbd48
	[0128.666] GetProcessHeap () returned 0x4b0000
	[0128.666] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x46) returned 0x4b71a0
	[0128.666] GetProcessHeap () returned 0x4b0000
	[0128.667] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x4008) returned 0x4bfd60
	[0128.667] GetProcessHeap () returned 0x4b0000
	[0128.667] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x4008) returned 0x4c3d70
	[0128.668] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0128.668] GetProcessHeap () returned 0x4b0000
	[0128.668] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x418) returned 0x4ba8c8
	[0128.668] SetErrorMode (uMode=0x0) returned 0x8003
	[0128.669] SetErrorMode (uMode=0x1) returned 0x0
	[0128.669] GetFullPathNameW (in: lpFileName="taskkill \\f \\.", nBufferLength=0x208, lpBuffer=0x4ba8d0, lpFilePart=0x19fbac | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f", lpFilePart=0x19fbac*="f") returned 0x29
	[0128.669] SetErrorMode (uMode=0x8003) returned 0x1
	[0128.669] GetProcessHeap () returned 0x4b0000
	[0128.669] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ba8c8, Size=0x78) returned 0x4ba8c8
	[0128.669] GetProcessHeap () returned 0x4b0000
	[0128.669] RtlSizeHeap (HeapHandle=0x4b0000, Flags=0x0, MemoryPointer=0x4ba8c8) returned 0x78
	[0128.669] NeedCurrentDirectoryForExePathW (ExeName="taskkill \\f \\.") returned 1
	[0128.669] GetProcessHeap () returned 0x4b0000
	[0128.669] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x62) returned 0x4b71f0
	[0128.669] GetProcessHeap () returned 0x4b0000
	[0128.669] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0xb8) returned 0x4ba948
	[0128.669] GetProcessHeap () returned 0x4b0000
	[0128.669] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ba948, Size=0x62) returned 0x4ba948
	[0128.669] GetProcessHeap () returned 0x4b0000
	[0128.669] RtlSizeHeap (HeapHandle=0x4b0000, Flags=0x0, MemoryPointer=0x4ba948) returned 0x62
	[0128.669] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0128.669] GetProcessHeap () returned 0x4b0000
	[0128.669] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0xe0) returned 0x4ba9b8
	[0128.678] GetProcessHeap () returned 0x4b0000
	[0128.678] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4ba9b8, Size=0x76) returned 0x4ba9b8
	[0128.678] GetProcessHeap () returned 0x4b0000
	[0128.678] RtlSizeHeap (HeapHandle=0x4b0000, Flags=0x0, MemoryPointer=0x4ba9b8) returned 0x76
	[0128.678] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0128.680] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f\\im ocssd.exe ", fInfoLevelId=0x1, lpFindFileData=0x19f958, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f958) returned 0xffffffff
	[0128.680] GetLastError () returned 0x3
	[0128.680] GetProcessHeap () returned 0x4b0000
	[0128.681] RtlFreeHeap (HeapHandle=0x4b0000, Flags=0x0, BaseAddress=0x4bfd60) returned 1
	[0128.681] GetProcessHeap () returned 0x4b0000
	[0128.682] RtlFreeHeap (HeapHandle=0x4b0000, Flags=0x0, BaseAddress=0x4c3d70) returned 1
	[0128.682] GetProcessHeap () returned 0x4b0000
	[0128.682] RtlFreeHeap (HeapHandle=0x4b0000, Flags=0x0, BaseAddress=0x4bbd48) returned 1
	[0128.683] GetConsoleOutputCP () returned 0x1b5
	[0128.689] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0128.689] GetUserDefaultLCID () returned 0x409
	[0128.689] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x13d34a0, cchData=8 | out: lpLCData=":") returned 2
	[0128.689] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0128.689] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0128.689] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2
	[0128.690] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x13d34b0, cchData=8 | out: lpLCData="/") returned 2
	[0128.690] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x13d3500, cchData=32 | out: lpLCData="Mon") returned 4
	[0128.690] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x13d3540, cchData=32 | out: lpLCData="Tue") returned 4
	[0128.690] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x13d3580, cchData=32 | out: lpLCData="Wed") returned 4
	[0128.690] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x13d35c0, cchData=32 | out: lpLCData="Thu") returned 4
	[0128.690] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x13d3600, cchData=32 | out: lpLCData="Fri") returned 4
	[0128.690] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x13d3640, cchData=32 | out: lpLCData="Sat") returned 4
	[0128.690] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x13d3680, cchData=32 | out: lpLCData="Sun") returned 4
	[0128.690] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x13d34c0, cchData=8 | out: lpLCData=".") returned 2
	[0128.690] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x13d34e0, cchData=8 | out: lpLCData=",") returned 2
	[0128.690] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0128.692] GetProcessHeap () returned 0x4b0000
	[0128.692] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x20c) returned 0x4baa80
	[0128.692] GetConsoleTitleW (in: lpConsoleTitle=0x4baa80, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0128.699] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0128.699] GetProcAddress (hModule=0x75600000, lpProcName="CopyFileExW") returned 0x7561ffc0
	[0128.699] GetProcAddress (hModule=0x75600000, lpProcName="IsDebuggerPresent") returned 0x7561b0b0
	[0128.699] GetProcAddress (hModule=0x75600000, lpProcName="SetConsoleInputExeNameW") returned 0x7559b440
	[0128.700] GetProcessHeap () returned 0x4b0000
	[0128.700] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x400a) returned 0x4bbd48
	[0128.700] GetProcessHeap () returned 0x4b0000
	[0128.700] RtlFreeHeap (HeapHandle=0x4b0000, Flags=0x0, BaseAddress=0x4bbd48) returned 1
	[0128.701] _wcsicmp (_String1="taskkill", _String2=")") returned 75
	[0128.701] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14
	[0128.701] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14
	[0128.701] _wcsicmp (_String1="IF", _String2="taskkill") returned -11
	[0128.701] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11
	[0128.701] _wcsicmp (_String1="REM", _String2="taskkill") returned -2
	[0128.701] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2
	[0128.701] GetProcessHeap () returned 0x4b0000
	[0128.701] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x58) returned 0x4bac98
	[0128.701] GetProcessHeap () returned 0x4b0000
	[0128.701] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x1a) returned 0x4b7e80
	[0128.702] GetProcessHeap () returned 0x4b0000
	[0128.702] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x2e) returned 0x4b7260
	[0128.703] GetConsoleTitleW (in: lpConsoleTitle=0x19fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0128.710] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0128.710] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0128.710] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0128.710] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0128.710] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0128.710] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0128.710] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0128.710] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0128.710] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0128.710] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0128.710] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0128.710] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0128.710] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0128.710] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0128.710] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0128.711] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0128.711] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0128.711] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0128.711] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0128.711] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0128.711] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0128.711] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0128.711] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0128.711] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0128.711] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0128.711] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0128.711] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0128.711] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0128.711] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0128.711] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0128.711] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0128.711] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0128.711] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0128.711] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0128.711] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0128.711] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0128.711] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0128.711] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0128.711] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0128.711] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0128.711] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0128.711] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0128.711] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0128.711] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0128.712] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0128.712] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0128.712] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0128.712] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0128.712] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0128.712] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0128.712] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0128.712] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0128.712] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0128.712] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0128.712] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0128.712] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0128.712] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0128.712] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0128.712] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0128.712] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0128.712] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0128.712] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0128.712] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0128.712] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0128.712] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0128.712] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0128.712] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0128.712] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0128.712] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0128.712] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0128.712] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0128.712] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0128.712] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0128.712] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0128.713] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0128.713] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0128.713] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0128.713] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0128.713] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0128.713] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0128.713] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0128.713] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0128.713] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0128.713] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0128.713] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14
	[0128.713] _wcsicmp (_String1="taskkill", _String2="IF") returned 11
	[0128.713] _wcsicmp (_String1="taskkill", _String2="REM") returned 2
	[0128.714] GetProcessHeap () returned 0x4b0000
	[0128.714] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x210) returned 0x4bacf8
	[0128.714] GetProcessHeap () returned 0x4b0000
	[0128.714] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x40) returned 0x4baf10
	[0128.714] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0128.714] GetProcessHeap () returned 0x4b0000
	[0128.714] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x418) returned 0x4b05c8
	[0128.714] SetErrorMode (uMode=0x0) returned 0x8003
	[0128.714] SetErrorMode (uMode=0x1) returned 0x0
	[0128.714] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4b05d0, lpFilePart=0x19f57c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19f57c*="Desktop") returned 0x1d
	[0128.714] SetErrorMode (uMode=0x8003) returned 0x1
	[0128.714] GetProcessHeap () returned 0x4b0000
	[0128.714] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4b05c8, Size=0x56) returned 0x4b05c8
	[0128.714] GetProcessHeap () returned 0x4b0000
	[0128.714] RtlSizeHeap (HeapHandle=0x4b0000, Flags=0x0, MemoryPointer=0x4b05c8) returned 0x56
	[0128.714] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0128.715] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0128.715] GetProcessHeap () returned 0x4b0000
	[0128.715] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x110) returned 0x4baf58
	[0128.715] GetProcessHeap () returned 0x4b0000
	[0128.715] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x218) returned 0x4bb070
	[0128.719] GetProcessHeap () returned 0x4b0000
	[0128.719] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4bb070, Size=0x112) returned 0x4bb070
	[0128.719] GetProcessHeap () returned 0x4b0000
	[0128.719] RtlSizeHeap (HeapHandle=0x4b0000, Flags=0x0, MemoryPointer=0x4bb070) returned 0x112
	[0128.719] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0128.720] GetProcessHeap () returned 0x4b0000
	[0128.720] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0xe0) returned 0x4bb190
	[0128.721] GetProcessHeap () returned 0x4b0000
	[0128.722] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4bb190, Size=0x76) returned 0x4bb190
	[0128.722] GetProcessHeap () returned 0x4b0000
	[0128.722] RtlSizeHeap (HeapHandle=0x4b0000, Flags=0x0, MemoryPointer=0x4bb190) returned 0x76
	[0128.722] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0128.722] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0128.722] GetLastError () returned 0x2
	[0128.722] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0128.722] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x4bb210
	[0128.723] GetProcessHeap () returned 0x4b0000
	[0128.723] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x0, Size=0x14) returned 0x4b78f0
	[0128.723] FindClose (in: hFindFile=0x4bb210 | out: hFindFile=0x4bb210) returned 1
	[0128.723] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0128.723] GetLastError () returned 0x2
	[0128.723] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x4bb210
	[0128.723] GetProcessHeap () returned 0x4b0000
	[0128.723] RtlReAllocateHeap (Heap=0x4b0000, Flags=0x0, Ptr=0x4b78f0, Size=0x4) returned 0x4bb250
	[0128.723] FindClose (in: hFindFile=0x4bb210 | out: hFindFile=0x4bb210) returned 1
	[0128.724] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0128.724] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0128.724] GetConsoleTitleW (in: lpConsoleTitle=0x19f7fc, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0128.726] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f728, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f70c | out: lpAttributeList=0x19f728, lpSize=0x19f70c) returned 1
	[0128.726] UpdateProcThreadAttribute (in: lpAttributeList=0x19f728, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f714, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f728, lpPreviousValue=0x0) returned 1
	[0128.726] GetStartupInfoW (in: lpStartupInfo=0x19f760 | out: lpStartupInfo=0x19f760*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x13c, hStdOutput=0x140, hStdError=0x144)) 
	[0128.726] GetProcessHeap () returned 0x4b0000
	[0128.726] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0x18) returned 0x4b7750
	[0128.726] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0128.726] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0128.726] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0128.726] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0128.726] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0128.726] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0128.726] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0128.726] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0128.726] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0128.726] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0128.726] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0128.726] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0128.726] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0128.726] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0128.726] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0128.726] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0128.726] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0128.727] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0128.727] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0128.727] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0128.727] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0128.727] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0128.727] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0128.727] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0128.727] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0128.727] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0128.727] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0128.727] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0128.727] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0128.727] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0128.727] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0128.727] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0128.727] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0128.727] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0128.727] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0128.727] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0128.727] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0128.727] GetProcessHeap () returned 0x4b0000
	[0128.727] RtlFreeHeap (HeapHandle=0x4b0000, Flags=0x0, BaseAddress=0x4b7750) returned 1
	[0128.727] GetProcessHeap () returned 0x4b0000
	[0128.727] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0xa) returned 0x4bb210
	[0128.727] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1
	[0128.731] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill  /f /im ocssd.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x19f6b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill  /f /im ocssd.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f6fc | out: lpCommandLine="taskkill  /f /im ocssd.exe ", lpProcessInformation=0x19f6fc*(hProcess=0x9c, hThread=0x98, dwProcessId=0xc40, dwThreadId=0x658)) returned 1
	[0128.749] CloseHandle (hObject=0x98) returned 1
	[0128.749] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0128.749] GetProcessHeap () returned 0x4b0000
	[0128.749] RtlFreeHeap (HeapHandle=0x4b0000, Flags=0x0, BaseAddress=0x4b9e48) returned 1
	[0128.749] GetEnvironmentStringsW () returned 0x4b9e48*
	[0128.749] GetProcessHeap () returned 0x4b0000
	[0128.749] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0xa76) returned 0x4bbd48
	[0128.749] FreeEnvironmentStringsA (penv="=") returned 1
	[0128.749] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0
	[0130.040] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x19f694 | out: lpExitCode=0x19f694*=0x80) returned 1
	[0130.040] CloseHandle (hObject=0x9c) returned 1
	[0130.041] _vsnwprintf (in: _Buffer=0x19f77c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f69c | out: _Buffer="00000080") returned 8
	[0130.041] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1
	[0130.041] GetProcessHeap () returned 0x4b0000
	[0130.042] RtlFreeHeap (HeapHandle=0x4b0000, Flags=0x0, BaseAddress=0x4bbd48) returned 1
	[0130.042] GetEnvironmentStringsW () returned 0x4bb260*
	[0130.042] GetProcessHeap () returned 0x4b0000
	[0130.042] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0xa9c) returned 0x4bbd08
	[0130.042] FreeEnvironmentStringsA (penv="=") returned 1
	[0130.042] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0130.042] GetProcessHeap () returned 0x4b0000
	[0130.042] RtlFreeHeap (HeapHandle=0x4b0000, Flags=0x0, BaseAddress=0x4bbd08) returned 1
	[0130.042] GetEnvironmentStringsW () returned 0x4bb260*
	[0130.043] GetProcessHeap () returned 0x4b0000
	[0130.043] RtlAllocateHeap (HeapHandle=0x4b0000, Flags=0x8, Size=0xa9c) returned 0x4bbd08
	[0130.043] FreeEnvironmentStringsA (penv="=") returned 1
	[0130.043] GetProcessHeap () returned 0x4b0000
	[0130.043] RtlFreeHeap (HeapHandle=0x4b0000, Flags=0x0, BaseAddress=0x4bb210) returned 1
	[0130.043] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f728 | out: lpAttributeList=0x19f728) 
	[0130.043] _get_osfhandle (_FileHandle=1) returned 0x140
	[0130.043] SetConsoleMode (hConsoleHandle=0x140, dwMode=0x0) returned 0
	[0130.043] _get_osfhandle (_FileHandle=1) returned 0x140
	[0130.043] GetConsoleMode (in: hConsoleHandle=0x140, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0130.043] _get_osfhandle (_FileHandle=0) returned 0x13c
	[0130.043] GetConsoleMode (in: hConsoleHandle=0x13c, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0130.043] GetConsoleOutputCP () returned 0x1b5
	[0130.046] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0130.046] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0130.047] exit (_Code=128) 

Thread:
	id = 162
	os_tid = 0xc54


Process:
	id = "18"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\syswow64\\taskkill.exe"
	page_root = "0x47d18000"
	os_pid = "0xc40"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "17"
	os_parent_pid = "0xb98"
	cmd_line = "taskkill  /f /im ocssd.exe "
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 1671
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 1672
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 1673
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 1674
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 1675
	        start_va = 0xa0000
	          end_va = 0xdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 1676
	        start_va = 0xe0000
	          end_va = 0xe3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 1677
	        start_va = 0xf0000
	          end_va = 0xf0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 1678
	        start_va = 0x100000
	          end_va = 0x101fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 1679
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 1680
	        start_va = 0x13b0000
	          end_va = 0x13c5fff
	       monitored = 0
	     entry_point = 0x13bde80
	     region_type = mapped_file
	            name = "taskkill.exe"
	        filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe")

Region:
	              id = 1681
	        start_va = 0x13d0000
	          end_va = 0x53cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000013d0000"
	        filename = ""

Region:
	              id = 1682
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 1683
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 1684
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1685
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 1686
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 1687
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 1688
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 1689
	        start_va = 0x5a0000
	          end_va = 0x5affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005a0000"
	        filename = ""

Region:
	              id = 1690
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 1691
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 1692
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 1693
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 1694
	        start_va = 0x5b0000
	          end_va = 0x82ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005b0000"
	        filename = ""

Region:
	              id = 1695
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 1696
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 1697
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 1698
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 1699
	        start_va = 0x110000
	          end_va = 0x1cdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1700
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 1701
	        start_va = 0x74650000
	          end_va = 0x746cafff
	       monitored = 0
	     entry_point = 0x7466e970
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 1702
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 1703
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 1704
	        start_va = 0x440000
	          end_va = 0x47ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000440000"
	        filename = ""

Region:
	              id = 1705
	        start_va = 0x76ae0000
	          end_va = 0x76b23fff
	       monitored = 0
	     entry_point = 0x76af9d80
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 1706
	        start_va = 0x75260000
	          end_va = 0x7530cfff
	       monitored = 0
	     entry_point = 0x75274f00
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 1707
	        start_va = 0x74450000
	          end_va = 0x7446dfff
	       monitored = 0
	     entry_point = 0x7445b640
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 1708
	        start_va = 0x74440000
	          end_va = 0x74449fff
	       monitored = 0
	     entry_point = 0x74442a00
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 1709
	        start_va = 0x74590000
	          end_va = 0x745e7fff
	       monitored = 0
	     entry_point = 0x745d25c0
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 1710
	        start_va = 0x77450000
	          end_va = 0x77596fff
	       monitored = 0
	     entry_point = 0x77461cf0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 1711
	        start_va = 0x76b30000
	          end_va = 0x76c7efff
	       monitored = 0
	     entry_point = 0x76be6820
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 1712
	        start_va = 0x753c0000
	          end_va = 0x75451fff
	       monitored = 0
	     entry_point = 0x753f8cf0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 1713
	        start_va = 0x77290000
	          end_va = 0x7744cfff
	       monitored = 0
	     entry_point = 0x77372a10
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")

Region:
	              id = 1714
	        start_va = 0x75310000
	          end_va = 0x7536efff
	       monitored = 0
	     entry_point = 0x75314af0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 1715
	        start_va = 0x77240000
	          end_va = 0x77284fff
	       monitored = 0
	     entry_point = 0x7725de90
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 1716
	        start_va = 0x6cc90000
	          end_va = 0x6cc97fff
	       monitored = 0
	     entry_point = 0x6cc917b0
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 1717
	        start_va = 0x6cc70000
	          end_va = 0x6cc85fff
	       monitored = 0
	     entry_point = 0x6cc721d0
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")

Region:
	              id = 1718
	        start_va = 0x6cc30000
	          end_va = 0x6cc6efff
	       monitored = 0
	     entry_point = 0x6cc446c0
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll")

Region:
	              id = 1719
	        start_va = 0x6cad0000
	          end_va = 0x6caebfff
	       monitored = 0
	     entry_point = 0x6cad4720
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")

Region:
	              id = 1720
	        start_va = 0x6cac0000
	          end_va = 0x6cac9fff
	       monitored = 0
	     entry_point = 0x6cac28d0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")

Region:
	              id = 1721
	        start_va = 0x6caf0000
	          end_va = 0x6cc2efff
	       monitored = 0
	     entry_point = 0x6cb1d880
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll")

Region:
	              id = 1722
	        start_va = 0x480000
	          end_va = 0x57ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 1723
	        start_va = 0x1d0000
	          end_va = 0x1f9fff
	       monitored = 0
	     entry_point = 0x1d5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 1724
	        start_va = 0x830000
	          end_va = 0x9b7fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000830000"
	        filename = ""

Region:
	              id = 1725
	        start_va = 0x74ea0000
	          end_va = 0x74ecafff
	       monitored = 0
	     entry_point = 0x74ea5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 1726
	        start_va = 0x9c0000
	          end_va = 0xb40fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000009c0000"
	        filename = ""

Region:
	              id = 1727
	        start_va = 0x53d0000
	          end_va = 0x67cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000053d0000"
	        filename = ""

Region:
	              id = 1728
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 1729
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001d0000"
	        filename = ""

Region:
	              id = 1730
	        start_va = 0x1e0000
	          end_va = 0x1e4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taskkill.exe.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui")

Region:
	              id = 1731
	        start_va = 0x1f0000
	          end_va = 0x1f0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001f0000"
	        filename = ""

Region:
	              id = 1732
	        start_va = 0x480000
	          end_va = 0x480fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 1733
	        start_va = 0x570000
	          end_va = 0x57ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000570000"
	        filename = ""

Region:
	              id = 1734
	        start_va = 0xb50000
	          end_va = 0xe86fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 1735
	        start_va = 0x5b0000
	          end_va = 0x699fff
	       monitored = 0
	     entry_point = 0x5ed650
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 1736
	        start_va = 0x730000
	          end_va = 0x82ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000730000"
	        filename = ""

Region:
	              id = 1737
	        start_va = 0x490000
	          end_va = 0x493fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000490000"
	        filename = ""

Region:
	              id = 1738
	        start_va = 0x5b0000
	          end_va = 0x68ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 1739
	        start_va = 0x76e20000
	          end_va = 0x76e2bfff
	       monitored = 0
	     entry_point = 0x76e23930
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")

Region:
	              id = 1740
	        start_va = 0x4a0000
	          end_va = 0x4a0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004a0000"
	        filename = ""

Region:
	              id = 1741
	        start_va = 0x76c80000
	          end_va = 0x76d03fff
	       monitored = 0
	     entry_point = 0x76ca6220
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 1742
	        start_va = 0x4b0000
	          end_va = 0x4b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004b0000"
	        filename = ""

Region:
	              id = 1743
	        start_va = 0x6cab0000
	          end_va = 0x6cabcfff
	       monitored = 0
	     entry_point = 0x6cab3520
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 1744
	        start_va = 0x6ca40000
	          end_va = 0x6caa6fff
	       monitored = 0
	     entry_point = 0x6ca5b610
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 1745
	        start_va = 0x740f0000
	          end_va = 0x7410afff
	       monitored = 0
	     entry_point = 0x740f9050
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 1746
	        start_va = 0x6c9f0000
	          end_va = 0x6ca33fff
	       monitored = 0
	     entry_point = 0x6ca0aaf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")

Region:
	              id = 1747
	        start_va = 0x4c0000
	          end_va = 0x4fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004c0000"
	        filename = ""

Region:
	              id = 1748
	        start_va = 0x500000
	          end_va = 0x53ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000500000"
	        filename = ""

Region:
	              id = 1749
	        start_va = 0x690000
	          end_va = 0x6cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000690000"
	        filename = ""

Region:
	              id = 1750
	        start_va = 0x6d0000
	          end_va = 0x70ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006d0000"
	        filename = ""

Region:
	              id = 1751
	        start_va = 0xe90000
	          end_va = 0xecffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e90000"
	        filename = ""

Region:
	              id = 1752
	        start_va = 0xed0000
	          end_va = 0xf0ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ed0000"
	        filename = ""

Region:
	              id = 1753
	        start_va = 0x6c9d0000
	          end_va = 0x6c9e0fff
	       monitored = 0
	     entry_point = 0x6c9d8fa0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 1754
	        start_va = 0x6c910000
	          end_va = 0x6c9cefff
	       monitored = 0
	     entry_point = 0x6c941e80
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 1756
	        start_va = 0x540000
	          end_va = 0x545fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000540000"
	        filename = ""


Thread:
	id = 163
	os_tid = 0x658


Thread:
	id = 164
	os_tid = 0x97c


Thread:
	id = 165
	os_tid = 0xf48


Thread:
	id = 166
	os_tid = 0x340


Thread:
	id = 167
	os_tid = 0x4e4


Process:
	id = "19"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x507f6000"
	os_pid = "0x92c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x614"
	cmd_line = "cmd.exe /c \"taskkill /f /im dbsnmp.exe \""
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 1759
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 1760
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 1761
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 1762
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 1763
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 1764
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 1765
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 1766
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 1767
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 1768
	        start_va = 0x13a0000
	          end_va = 0x13f1fff
	       monitored = 1
	     entry_point = 0x13b4fd0
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")

Region:
	              id = 1769
	        start_va = 0x1400000
	          end_va = 0x53fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001400000"
	        filename = ""

Region:
	              id = 1770
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 1771
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 1772
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1773
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 1774
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 1775
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 1776
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 1777
	        start_va = 0x5a0000
	          end_va = 0x5affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005a0000"
	        filename = ""

Region:
	              id = 1778
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 1779
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 1780
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 1781
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 1782
	        start_va = 0x5b0000
	          end_va = 0x83ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005b0000"
	        filename = ""

Region:
	              id = 1783
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 1784
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 1785
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 1786
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 1787
	        start_va = 0x400000
	          end_va = 0x4bdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1788
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 1789
	        start_va = 0x4c0000
	          end_va = 0x4fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004c0000"
	        filename = ""

Region:
	              id = 1790
	        start_va = 0x5b0000
	          end_va = 0x6affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005b0000"
	        filename = ""

Region:
	              id = 1791
	        start_va = 0x740000
	          end_va = 0x83ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000740000"
	        filename = ""

Region:
	              id = 1792
	        start_va = 0x840000
	          end_va = 0xa3ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000840000"
	        filename = ""

Region:
	              id = 1793
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 1794
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 1795
	        start_va = 0xa40000
	          end_va = 0xd76fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 168
	os_tid = 0x4c8

	[0130.373] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000
	[0130.373] __set_app_type (_Type=0x1) 
	[0130.374] __p__fmode () returned 0x74974d6c
	[0130.374] __p__commode () returned 0x74975b1c
	[0130.374] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13b5200) returned 0x0
	[0130.374] __getmainargs (in: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0, _DoWildCard=0, _StartInfo=0x13c60fc | out: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0) returned 0
	[0130.375] GetCurrentThreadId () returned 0x4c8
	[0130.375] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x4c8) returned 0x78
	[0130.375] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0130.375] GetProcAddress (hModule=0x75600000, lpProcName="SetThreadUILanguage") returned 0x75642510
	[0130.375] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0130.387] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0130.387] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2
	[0130.387] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0130.387] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0130.387] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0130.387] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0130.387] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0130.387] GetConsoleOutputCP () returned 0x1b5
	[0130.438] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0130.438] SetConsoleCtrlHandler (HandlerRoutine=0x13c0e40, Add=1) returned 1
	[0130.438] _get_osfhandle (_FileHandle=1) returned 0x13c
	[0130.438] SetConsoleMode (hConsoleHandle=0x13c, dwMode=0x0) returned 0
	[0130.438] _get_osfhandle (_FileHandle=1) returned 0x13c
	[0130.439] GetConsoleMode (in: hConsoleHandle=0x13c, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0130.439] _get_osfhandle (_FileHandle=0) returned 0x130
	[0130.439] GetConsoleMode (in: hConsoleHandle=0x130, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0130.439] GetEnvironmentStringsW () returned 0x747cc0*
	[0130.439] GetProcessHeap () returned 0x740000
	[0130.439] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0xa1a) returned 0x7486e8
	[0130.439] FreeEnvironmentStringsA (penv="A") returned 1
	[0130.439] GetProcessHeap () returned 0x740000
	[0130.439] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x4) returned 0x740550
	[0130.439] GetEnvironmentStringsW () returned 0x747cc0*
	[0130.439] GetProcessHeap () returned 0x740000
	[0130.439] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0xa1a) returned 0x749110
	[0130.439] FreeEnvironmentStringsA (penv="A") returned 1
	[0130.439] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0130.439] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0130.439] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0130.440] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0130.440] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0130.440] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0130.440] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0130.440] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0130.440] RegCloseKey (hKey=0x88) returned 0x0
	[0130.440] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0130.440] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0130.440] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0130.440] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0130.440] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0130.440] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0130.440] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0130.440] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0130.440] RegCloseKey (hKey=0x88) returned 0x0
	[0130.440] time (in: timer=0x0 | out: timer=0x0) returned 0x6234420c
	[0130.441] srand (_Seed=0x6234420c) 
	[0130.441] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im dbsnmp.exe \""
	[0130.441] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im dbsnmp.exe \""
	[0130.441] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0130.441] GetProcessHeap () returned 0x740000
	[0130.441] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x210) returned 0x749b38
	[0130.441] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x749b40, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0130.441] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0130.441] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0130.441] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0130.441] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0130.441] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0130.441] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0130.441] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0130.441] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0130.441] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0130.441] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0130.441] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0130.442] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0130.442] GetProcessHeap () returned 0x740000
	[0130.442] RtlFreeHeap (HeapHandle=0x740000, Flags=0x0, BaseAddress=0x7486e8) returned 1
	[0130.442] GetEnvironmentStringsW () returned 0x747cc0*
	[0130.442] GetProcessHeap () returned 0x740000
	[0130.443] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0xa32) returned 0x74a790
	[0130.443] FreeEnvironmentStringsA (penv="A") returned 1
	[0130.443] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b
	[0130.443] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0130.443] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0130.443] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0130.443] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0130.443] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0130.443] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0130.443] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0130.443] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0130.443] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0130.444] GetProcessHeap () returned 0x740000
	[0130.444] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x44) returned 0x7405c8
	[0130.444] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0130.444] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19fc4c*="Desktop") returned 0x1d
	[0130.444] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0130.444] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x740618
	[0130.445] FindClose (in: hFindFile=0x740618 | out: hFindFile=0x740618) returned 1
	[0130.445] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x740618
	[0130.445] FindClose (in: hFindFile=0x740618 | out: hFindFile=0x740618) returned 1
	[0130.445] _wcsnicmp (_String1="RDHJ0C~1", _String2="RDhJ0CNFevzX", _MaxCount=0xc) returned 16
	[0130.445] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x740618
	[0130.446] FindClose (in: hFindFile=0x740618 | out: hFindFile=0x740618) returned 1
	[0130.446] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0130.446] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1
	[0130.446] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 1
	[0130.446] GetProcessHeap () returned 0x740000
	[0130.447] RtlFreeHeap (HeapHandle=0x740000, Flags=0x0, BaseAddress=0x74a790) returned 1
	[0130.447] GetEnvironmentStringsW () returned 0x747cc0*
	[0130.447] GetProcessHeap () returned 0x740000
	[0130.447] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0xa76) returned 0x749d50
	[0130.447] FreeEnvironmentStringsA (penv="=") returned 1
	[0130.447] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0130.447] GetProcessHeap () returned 0x740000
	[0130.447] RtlFreeHeap (HeapHandle=0x740000, Flags=0x0, BaseAddress=0x7405c8) returned 1
	[0130.448] GetProcessHeap () returned 0x740000
	[0130.448] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x400e) returned 0x74bc50
	[0130.449] GetProcessHeap () returned 0x740000
	[0130.449] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x48) returned 0x74a7d0
	[0130.449] GetProcessHeap () returned 0x740000
	[0130.449] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x4008) returned 0x74fc68
	[0130.449] GetProcessHeap () returned 0x740000
	[0130.449] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x4008) returned 0x753c78
	[0130.451] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0130.452] GetProcessHeap () returned 0x740000
	[0130.452] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x418) returned 0x74a820
	[0130.452] SetErrorMode (uMode=0x0) returned 0x8003
	[0130.452] SetErrorMode (uMode=0x1) returned 0x0
	[0130.452] GetFullPathNameW (in: lpFileName="taskkill \\f \\.", nBufferLength=0x208, lpBuffer=0x74a828, lpFilePart=0x19fbac | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f", lpFilePart=0x19fbac*="f") returned 0x29
	[0130.452] SetErrorMode (uMode=0x8003) returned 0x1
	[0130.452] GetProcessHeap () returned 0x740000
	[0130.452] RtlReAllocateHeap (Heap=0x740000, Flags=0x0, Ptr=0x74a820, Size=0x7a) returned 0x74a820
	[0130.452] GetProcessHeap () returned 0x740000
	[0130.453] RtlSizeHeap (HeapHandle=0x740000, Flags=0x0, MemoryPointer=0x74a820) returned 0x7a
	[0130.453] NeedCurrentDirectoryForExePathW (ExeName="taskkill \\f \\.") returned 1
	[0130.453] GetProcessHeap () returned 0x740000
	[0130.453] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x62) returned 0x74a8a8
	[0130.453] GetProcessHeap () returned 0x740000
	[0130.453] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0xb8) returned 0x74a918
	[0130.453] GetProcessHeap () returned 0x740000
	[0130.453] RtlReAllocateHeap (Heap=0x740000, Flags=0x0, Ptr=0x74a918, Size=0x62) returned 0x74a918
	[0130.453] GetProcessHeap () returned 0x740000
	[0130.453] RtlSizeHeap (HeapHandle=0x740000, Flags=0x0, MemoryPointer=0x74a918) returned 0x62
	[0130.453] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0130.453] GetProcessHeap () returned 0x740000
	[0130.453] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0xe0) returned 0x74a988
	[0130.460] GetProcessHeap () returned 0x740000
	[0130.460] RtlReAllocateHeap (Heap=0x740000, Flags=0x0, Ptr=0x74a988, Size=0x76) returned 0x74a988
	[0130.460] GetProcessHeap () returned 0x740000
	[0130.460] RtlSizeHeap (HeapHandle=0x740000, Flags=0x0, MemoryPointer=0x74a988) returned 0x76
	[0130.460] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0130.461] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f\\im dbsnmp.exe ", fInfoLevelId=0x1, lpFindFileData=0x19f958, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f958) returned 0xffffffff
	[0130.461] GetLastError () returned 0x3
	[0130.461] GetProcessHeap () returned 0x740000
	[0130.461] RtlFreeHeap (HeapHandle=0x740000, Flags=0x0, BaseAddress=0x74fc68) returned 1
	[0130.462] GetProcessHeap () returned 0x740000
	[0130.462] RtlFreeHeap (HeapHandle=0x740000, Flags=0x0, BaseAddress=0x753c78) returned 1
	[0130.462] GetProcessHeap () returned 0x740000
	[0130.462] RtlFreeHeap (HeapHandle=0x740000, Flags=0x0, BaseAddress=0x74bc50) returned 1
	[0130.462] GetConsoleOutputCP () returned 0x1b5
	[0130.467] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0130.467] GetUserDefaultLCID () returned 0x409
	[0130.468] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x13d34a0, cchData=8 | out: lpLCData=":") returned 2
	[0130.468] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0130.468] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0130.468] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2
	[0130.468] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x13d34b0, cchData=8 | out: lpLCData="/") returned 2
	[0130.468] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x13d3500, cchData=32 | out: lpLCData="Mon") returned 4
	[0130.468] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x13d3540, cchData=32 | out: lpLCData="Tue") returned 4
	[0130.468] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x13d3580, cchData=32 | out: lpLCData="Wed") returned 4
	[0130.469] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x13d35c0, cchData=32 | out: lpLCData="Thu") returned 4
	[0130.469] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x13d3600, cchData=32 | out: lpLCData="Fri") returned 4
	[0130.469] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x13d3640, cchData=32 | out: lpLCData="Sat") returned 4
	[0130.469] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x13d3680, cchData=32 | out: lpLCData="Sun") returned 4
	[0130.469] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x13d34c0, cchData=8 | out: lpLCData=".") returned 2
	[0130.469] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x13d34e0, cchData=8 | out: lpLCData=",") returned 2
	[0130.469] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0130.471] GetProcessHeap () returned 0x740000
	[0130.471] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x0, Size=0x20c) returned 0x74aa50
	[0130.471] GetConsoleTitleW (in: lpConsoleTitle=0x74aa50, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0130.475] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0130.475] GetProcAddress (hModule=0x75600000, lpProcName="CopyFileExW") returned 0x7561ffc0
	[0130.475] GetProcAddress (hModule=0x75600000, lpProcName="IsDebuggerPresent") returned 0x7561b0b0
	[0130.475] GetProcAddress (hModule=0x75600000, lpProcName="SetConsoleInputExeNameW") returned 0x7559b440
	[0130.475] GetProcessHeap () returned 0x740000
	[0130.475] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x400a) returned 0x74bc50
	[0130.475] GetProcessHeap () returned 0x740000
	[0130.476] RtlFreeHeap (HeapHandle=0x740000, Flags=0x0, BaseAddress=0x74bc50) returned 1
	[0130.477] _wcsicmp (_String1="taskkill", _String2=")") returned 75
	[0130.477] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14
	[0130.477] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14
	[0130.477] _wcsicmp (_String1="IF", _String2="taskkill") returned -11
	[0130.477] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11
	[0130.477] _wcsicmp (_String1="REM", _String2="taskkill") returned -2
	[0130.477] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2
	[0130.477] GetProcessHeap () returned 0x740000
	[0130.477] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x58) returned 0x74ac68
	[0130.477] GetProcessHeap () returned 0x740000
	[0130.477] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x1a) returned 0x740578
	[0130.477] GetProcessHeap () returned 0x740000
	[0130.477] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x30) returned 0x74acc8
	[0130.478] GetConsoleTitleW (in: lpConsoleTitle=0x19fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0130.482] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0130.482] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0130.482] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0130.482] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0130.482] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0130.482] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0130.482] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0130.482] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0130.482] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0130.482] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0130.482] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0130.482] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0130.482] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0130.482] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0130.482] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0130.482] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0130.482] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0130.482] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0130.482] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0130.482] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0130.482] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0130.483] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0130.483] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0130.483] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0130.483] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0130.483] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0130.483] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0130.483] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0130.483] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0130.483] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0130.483] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0130.483] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0130.483] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0130.483] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0130.483] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0130.483] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0130.483] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0130.483] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0130.483] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0130.483] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0130.483] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0130.483] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0130.483] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0130.483] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0130.483] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0130.483] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0130.483] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0130.483] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0130.483] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0130.483] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0130.483] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0130.484] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0130.484] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0130.484] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0130.484] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0130.484] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0130.484] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0130.484] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0130.484] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0130.484] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0130.484] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0130.484] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0130.484] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0130.484] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0130.484] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0130.484] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0130.484] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0130.484] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0130.484] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0130.484] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0130.484] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0130.484] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0130.484] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0130.484] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0130.484] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0130.484] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0130.484] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0130.484] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0130.484] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0130.484] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0130.484] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0130.485] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0130.485] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0130.485] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0130.485] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14
	[0130.485] _wcsicmp (_String1="taskkill", _String2="IF") returned 11
	[0130.485] _wcsicmp (_String1="taskkill", _String2="REM") returned 2
	[0130.485] GetProcessHeap () returned 0x740000
	[0130.485] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x210) returned 0x74ad00
	[0130.485] GetProcessHeap () returned 0x740000
	[0130.485] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x42) returned 0x74af18
	[0130.485] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0130.486] GetProcessHeap () returned 0x740000
	[0130.486] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x418) returned 0x7405c8
	[0130.486] SetErrorMode (uMode=0x0) returned 0x8003
	[0130.486] SetErrorMode (uMode=0x1) returned 0x0
	[0130.486] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x7405d0, lpFilePart=0x19f57c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19f57c*="Desktop") returned 0x1d
	[0130.486] SetErrorMode (uMode=0x8003) returned 0x1
	[0130.486] GetProcessHeap () returned 0x740000
	[0130.486] RtlReAllocateHeap (Heap=0x740000, Flags=0x0, Ptr=0x7405c8, Size=0x56) returned 0x7405c8
	[0130.486] GetProcessHeap () returned 0x740000
	[0130.486] RtlSizeHeap (HeapHandle=0x740000, Flags=0x0, MemoryPointer=0x7405c8) returned 0x56
	[0130.486] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0130.486] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0130.486] GetProcessHeap () returned 0x740000
	[0130.486] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x110) returned 0x74af68
	[0130.486] GetProcessHeap () returned 0x740000
	[0130.487] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x218) returned 0x740628
	[0130.492] GetProcessHeap () returned 0x740000
	[0130.492] RtlReAllocateHeap (Heap=0x740000, Flags=0x0, Ptr=0x740628, Size=0x112) returned 0x740628
	[0130.492] GetProcessHeap () returned 0x740000
	[0130.492] RtlSizeHeap (HeapHandle=0x740000, Flags=0x0, MemoryPointer=0x740628) returned 0x112
	[0130.492] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0130.492] GetProcessHeap () returned 0x740000
	[0130.492] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0xe0) returned 0x74b080
	[0130.494] GetProcessHeap () returned 0x740000
	[0130.494] RtlReAllocateHeap (Heap=0x740000, Flags=0x0, Ptr=0x74b080, Size=0x76) returned 0x74b080
	[0130.494] GetProcessHeap () returned 0x740000
	[0130.494] RtlSizeHeap (HeapHandle=0x740000, Flags=0x0, MemoryPointer=0x74b080) returned 0x76
	[0130.494] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0130.494] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0130.494] GetLastError () returned 0x2
	[0130.494] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0130.494] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x74b100
	[0130.495] GetProcessHeap () returned 0x740000
	[0130.495] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x0, Size=0x14) returned 0x7474e8
	[0130.495] FindClose (in: hFindFile=0x74b100 | out: hFindFile=0x74b100) returned 1
	[0130.495] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0130.495] GetLastError () returned 0x2
	[0130.495] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x74b100
	[0130.495] GetProcessHeap () returned 0x740000
	[0130.495] RtlReAllocateHeap (Heap=0x740000, Flags=0x0, Ptr=0x7474e8, Size=0x4) returned 0x74b140
	[0130.495] FindClose (in: hFindFile=0x74b100 | out: hFindFile=0x74b100) returned 1
	[0130.495] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0130.496] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0130.496] GetConsoleTitleW (in: lpConsoleTitle=0x19f7fc, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0130.499] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f728, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f70c | out: lpAttributeList=0x19f728, lpSize=0x19f70c) returned 1
	[0130.499] UpdateProcThreadAttribute (in: lpAttributeList=0x19f728, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f714, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f728, lpPreviousValue=0x0) returned 1
	[0130.499] GetStartupInfoW (in: lpStartupInfo=0x19f760 | out: lpStartupInfo=0x19f760*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x130, hStdOutput=0x13c, hStdError=0x140)) 
	[0130.499] GetProcessHeap () returned 0x740000
	[0130.499] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0x18) returned 0x747668
	[0130.499] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0130.500] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0130.500] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0130.500] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0130.500] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0130.500] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0130.500] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0130.500] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0130.500] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0130.500] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0130.500] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0130.500] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0130.500] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0130.500] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0130.500] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0130.500] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0130.500] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0130.500] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0130.500] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0130.500] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0130.500] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0130.500] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0130.500] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0130.500] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0130.500] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0130.500] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0130.500] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0130.500] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0130.501] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0130.501] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0130.501] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0130.501] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0130.501] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0130.501] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0130.501] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0130.501] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0130.501] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0130.501] GetProcessHeap () returned 0x740000
	[0130.501] RtlFreeHeap (HeapHandle=0x740000, Flags=0x0, BaseAddress=0x747668) returned 1
	[0130.501] GetProcessHeap () returned 0x740000
	[0130.501] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0xa) returned 0x74b100
	[0130.501] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1
	[0130.504] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill  /f /im dbsnmp.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x19f6b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill  /f /im dbsnmp.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f6fc | out: lpCommandLine="taskkill  /f /im dbsnmp.exe ", lpProcessInformation=0x19f6fc*(hProcess=0x9c, hThread=0x98, dwProcessId=0x1004, dwThreadId=0x1008)) returned 1
	[0130.540] CloseHandle (hObject=0x98) returned 1
	[0130.540] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0130.540] GetProcessHeap () returned 0x740000
	[0130.541] RtlFreeHeap (HeapHandle=0x740000, Flags=0x0, BaseAddress=0x749d50) returned 1
	[0130.541] GetEnvironmentStringsW () returned 0x749d50*
	[0130.541] GetProcessHeap () returned 0x740000
	[0130.541] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0xa76) returned 0x74bc50
	[0130.541] FreeEnvironmentStringsA (penv="=") returned 1
	[0130.541] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0
	[0131.577] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x19f694 | out: lpExitCode=0x19f694*=0x80) returned 1
	[0131.578] CloseHandle (hObject=0x9c) returned 1
	[0131.578] _vsnwprintf (in: _Buffer=0x19f77c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f69c | out: _Buffer="00000080") returned 8
	[0131.578] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1
	[0131.578] GetProcessHeap () returned 0x740000
	[0131.579] RtlFreeHeap (HeapHandle=0x740000, Flags=0x0, BaseAddress=0x74bc50) returned 1
	[0131.579] GetEnvironmentStringsW () returned 0x74b150*
	[0131.579] GetProcessHeap () returned 0x740000
	[0131.579] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0xa9c) returned 0x74bbf8
	[0131.579] FreeEnvironmentStringsA (penv="=") returned 1
	[0131.579] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0131.579] GetProcessHeap () returned 0x740000
	[0131.579] RtlFreeHeap (HeapHandle=0x740000, Flags=0x0, BaseAddress=0x74bbf8) returned 1
	[0131.579] GetEnvironmentStringsW () returned 0x74b150*
	[0131.579] GetProcessHeap () returned 0x740000
	[0131.579] RtlAllocateHeap (HeapHandle=0x740000, Flags=0x8, Size=0xa9c) returned 0x74bbf8
	[0131.579] FreeEnvironmentStringsA (penv="=") returned 1
	[0131.579] GetProcessHeap () returned 0x740000
	[0131.580] RtlFreeHeap (HeapHandle=0x740000, Flags=0x0, BaseAddress=0x74b100) returned 1
	[0131.580] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f728 | out: lpAttributeList=0x19f728) 
	[0131.580] _get_osfhandle (_FileHandle=1) returned 0x13c
	[0131.580] SetConsoleMode (hConsoleHandle=0x13c, dwMode=0x0) returned 0
	[0131.580] _get_osfhandle (_FileHandle=1) returned 0x13c
	[0131.580] GetConsoleMode (in: hConsoleHandle=0x13c, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0131.580] _get_osfhandle (_FileHandle=0) returned 0x130
	[0131.580] GetConsoleMode (in: hConsoleHandle=0x130, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0131.580] GetConsoleOutputCP () returned 0x1b5
	[0131.583] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0131.583] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0131.583] exit (_Code=128) 

Thread:
	id = 169
	os_tid = 0x4c4


Process:
	id = "20"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\syswow64\\taskkill.exe"
	page_root = "0x47ad5000"
	os_pid = "0x1004"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "19"
	os_parent_pid = "0x92c"
	cmd_line = "taskkill  /f /im dbsnmp.exe "
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 1796
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 1797
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 1798
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 1799
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 1800
	        start_va = 0xa0000
	          end_va = 0xdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 1801
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 1802
	        start_va = 0x13b0000
	          end_va = 0x13c5fff
	       monitored = 0
	     entry_point = 0x13bde80
	     region_type = mapped_file
	            name = "taskkill.exe"
	        filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe")

Region:
	              id = 1803
	        start_va = 0x13d0000
	          end_va = 0x53cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000013d0000"
	        filename = ""

Region:
	              id = 1804
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 1805
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 1806
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1807
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 1808
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 1809
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 1810
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 1811
	        start_va = 0xe0000
	          end_va = 0xe3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 1812
	        start_va = 0xf0000
	          end_va = 0xf0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 1813
	        start_va = 0x100000
	          end_va = 0x101fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 1814
	        start_va = 0x500000
	          end_va = 0x50ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000500000"
	        filename = ""

Region:
	              id = 1815
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 1816
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 1817
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 1818
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 1819
	        start_va = 0x510000
	          end_va = 0x6bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000510000"
	        filename = ""

Region:
	              id = 1820
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 1821
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 1822
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 1823
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 1824
	        start_va = 0x110000
	          end_va = 0x1cdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1825
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 1826
	        start_va = 0x74650000
	          end_va = 0x746cafff
	       monitored = 0
	     entry_point = 0x7466e970
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 1827
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 1828
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 1829
	        start_va = 0x440000
	          end_va = 0x47ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000440000"
	        filename = ""

Region:
	              id = 1830
	        start_va = 0x76ae0000
	          end_va = 0x76b23fff
	       monitored = 0
	     entry_point = 0x76af9d80
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 1831
	        start_va = 0x75260000
	          end_va = 0x7530cfff
	       monitored = 0
	     entry_point = 0x75274f00
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 1832
	        start_va = 0x74450000
	          end_va = 0x7446dfff
	       monitored = 0
	     entry_point = 0x7445b640
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 1833
	        start_va = 0x74440000
	          end_va = 0x74449fff
	       monitored = 0
	     entry_point = 0x74442a00
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 1834
	        start_va = 0x74590000
	          end_va = 0x745e7fff
	       monitored = 0
	     entry_point = 0x745d25c0
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 1835
	        start_va = 0x77450000
	          end_va = 0x77596fff
	       monitored = 0
	     entry_point = 0x77461cf0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 1836
	        start_va = 0x76b30000
	          end_va = 0x76c7efff
	       monitored = 0
	     entry_point = 0x76be6820
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 1837
	        start_va = 0x753c0000
	          end_va = 0x75451fff
	       monitored = 0
	     entry_point = 0x753f8cf0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 1838
	        start_va = 0x77290000
	          end_va = 0x7744cfff
	       monitored = 0
	     entry_point = 0x77372a10
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")

Region:
	              id = 1839
	        start_va = 0x75310000
	          end_va = 0x7536efff
	       monitored = 0
	     entry_point = 0x75314af0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 1840
	        start_va = 0x77240000
	          end_va = 0x77284fff
	       monitored = 0
	     entry_point = 0x7725de90
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 1841
	        start_va = 0x6cc90000
	          end_va = 0x6cc97fff
	       monitored = 0
	     entry_point = 0x6cc917b0
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 1842
	        start_va = 0x6cc70000
	          end_va = 0x6cc85fff
	       monitored = 0
	     entry_point = 0x6cc721d0
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")

Region:
	              id = 1843
	        start_va = 0x6cc30000
	          end_va = 0x6cc6efff
	       monitored = 0
	     entry_point = 0x6cc446c0
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll")

Region:
	              id = 1844
	        start_va = 0x6caf0000
	          end_va = 0x6cc2efff
	       monitored = 0
	     entry_point = 0x6cb1d880
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll")

Region:
	              id = 1845
	        start_va = 0x6cad0000
	          end_va = 0x6caebfff
	       monitored = 0
	     entry_point = 0x6cad4720
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")

Region:
	              id = 1846
	        start_va = 0x6cac0000
	          end_va = 0x6cac9fff
	       monitored = 0
	     entry_point = 0x6cac28d0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")

Region:
	              id = 1847
	        start_va = 0x6c0000
	          end_va = 0x89ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006c0000"
	        filename = ""

Region:
	              id = 1848
	        start_va = 0x1d0000
	          end_va = 0x1f9fff
	       monitored = 0
	     entry_point = 0x1d5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 1849
	        start_va = 0x6c0000
	          end_va = 0x847fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000006c0000"
	        filename = ""

Region:
	              id = 1850
	        start_va = 0x890000
	          end_va = 0x89ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000890000"
	        filename = ""

Region:
	              id = 1851
	        start_va = 0x74ea0000
	          end_va = 0x74ecafff
	       monitored = 0
	     entry_point = 0x74ea5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 1852
	        start_va = 0x8a0000
	          end_va = 0xa20fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000008a0000"
	        filename = ""

Region:
	              id = 1853
	        start_va = 0x53d0000
	          end_va = 0x67cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000053d0000"
	        filename = ""

Region:
	              id = 1854
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 1855
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001d0000"
	        filename = ""

Region:
	              id = 1856
	        start_va = 0x1e0000
	          end_va = 0x1e4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taskkill.exe.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui")

Region:
	              id = 1857
	        start_va = 0x1f0000
	          end_va = 0x1f0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001f0000"
	        filename = ""

Region:
	              id = 1858
	        start_va = 0x480000
	          end_va = 0x480fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 1859
	        start_va = 0xa30000
	          end_va = 0xd66fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 1860
	        start_va = 0xd70000
	          end_va = 0xe59fff
	       monitored = 0
	     entry_point = 0xdad650
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 1861
	        start_va = 0x490000
	          end_va = 0x493fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000490000"
	        filename = ""

Region:
	              id = 1862
	        start_va = 0xd70000
	          end_va = 0xe4ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 1863
	        start_va = 0x76e20000
	          end_va = 0x76e2bfff
	       monitored = 0
	     entry_point = 0x76e23930
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")

Region:
	              id = 1864
	        start_va = 0x4a0000
	          end_va = 0x4a0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004a0000"
	        filename = ""

Region:
	              id = 1865
	        start_va = 0x76c80000
	          end_va = 0x76d03fff
	       monitored = 0
	     entry_point = 0x76ca6220
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 1866
	        start_va = 0x4b0000
	          end_va = 0x4b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004b0000"
	        filename = ""

Region:
	              id = 1867
	        start_va = 0x6cab0000
	          end_va = 0x6cabcfff
	       monitored = 0
	     entry_point = 0x6cab3520
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 1868
	        start_va = 0x6ca40000
	          end_va = 0x6caa6fff
	       monitored = 0
	     entry_point = 0x6ca5b610
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 1869
	        start_va = 0x740f0000
	          end_va = 0x7410afff
	       monitored = 0
	     entry_point = 0x740f9050
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 1870
	        start_va = 0x6c9f0000
	          end_va = 0x6ca33fff
	       monitored = 0
	     entry_point = 0x6ca0aaf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")

Region:
	              id = 1871
	        start_va = 0x4c0000
	          end_va = 0x4fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004c0000"
	        filename = ""

Region:
	              id = 1872
	        start_va = 0x510000
	          end_va = 0x54ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000510000"
	        filename = ""

Region:
	              id = 1873
	        start_va = 0x5c0000
	          end_va = 0x6bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005c0000"
	        filename = ""

Region:
	              id = 1874
	        start_va = 0x550000
	          end_va = 0x58ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000550000"
	        filename = ""

Region:
	              id = 1875
	        start_va = 0x850000
	          end_va = 0x88ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000850000"
	        filename = ""

Region:
	              id = 1876
	        start_va = 0xe50000
	          end_va = 0xe8ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e50000"
	        filename = ""

Region:
	              id = 1877
	        start_va = 0xe90000
	          end_va = 0xecffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e90000"
	        filename = ""

Region:
	              id = 1878
	        start_va = 0x6c9d0000
	          end_va = 0x6c9e0fff
	       monitored = 0
	     entry_point = 0x6c9d8fa0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 1879
	        start_va = 0x6c910000
	          end_va = 0x6c9cefff
	       monitored = 0
	     entry_point = 0x6c941e80
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 1881
	        start_va = 0x590000
	          end_va = 0x595fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000590000"
	        filename = ""


Thread:
	id = 170
	os_tid = 0x1008


Thread:
	id = 171
	os_tid = 0x100c


Thread:
	id = 172
	os_tid = 0x1010


Thread:
	id = 173
	os_tid = 0x1014


Thread:
	id = 174
	os_tid = 0x1018


Process:
	id = "21"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x16d03000"
	os_pid = "0x101c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x614"
	cmd_line = "cmd.exe /c \"taskkill /f /im synctime.exe \""
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 1887
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 1888
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 1889
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 1890
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 1891
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 1892
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 1893
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 1894
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 1895
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 1896
	        start_va = 0x13a0000
	          end_va = 0x13f1fff
	       monitored = 1
	     entry_point = 0x13b4fd0
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")

Region:
	              id = 1897
	        start_va = 0x1400000
	          end_va = 0x53fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001400000"
	        filename = ""

Region:
	              id = 1898
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 1899
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 1900
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1901
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 1902
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 1903
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 1904
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 1905
	        start_va = 0x440000
	          end_va = 0x44ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000440000"
	        filename = ""

Region:
	              id = 1906
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 1907
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 1908
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 1909
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 1910
	        start_va = 0x450000
	          end_va = 0x5cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000450000"
	        filename = ""

Region:
	              id = 1911
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 1912
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 1913
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 1914
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 1915
	        start_va = 0x5d0000
	          end_va = 0x68dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1916
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 1917
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 1918
	        start_va = 0x690000
	          end_va = 0x78ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000690000"
	        filename = ""

Region:
	              id = 1919
	        start_va = 0x790000
	          end_va = 0x91ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000790000"
	        filename = ""

Region:
	              id = 1920
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 1921
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 1922
	        start_va = 0x920000
	          end_va = 0xc56fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 175
	os_tid = 0x1030

	[0131.803] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000
	[0131.803] __set_app_type (_Type=0x1) 
	[0131.803] __p__fmode () returned 0x74974d6c
	[0131.803] __p__commode () returned 0x74975b1c
	[0131.804] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13b5200) returned 0x0
	[0131.804] __getmainargs (in: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0, _DoWildCard=0, _StartInfo=0x13c60fc | out: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0) returned 0
	[0131.804] GetCurrentThreadId () returned 0x1030
	[0131.804] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x1030) returned 0x78
	[0131.805] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0131.805] GetProcAddress (hModule=0x75600000, lpProcName="SetThreadUILanguage") returned 0x75642510
	[0131.805] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0131.811] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0131.811] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2
	[0131.811] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0131.811] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0131.811] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0131.811] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0131.811] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0131.811] GetConsoleOutputCP () returned 0x1b5
	[0131.813] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0131.813] SetConsoleCtrlHandler (HandlerRoutine=0x13c0e40, Add=1) returned 1
	[0131.813] _get_osfhandle (_FileHandle=1) returned 0x130
	[0131.813] SetConsoleMode (hConsoleHandle=0x130, dwMode=0x0) returned 0
	[0131.813] _get_osfhandle (_FileHandle=1) returned 0x130
	[0131.813] GetConsoleMode (in: hConsoleHandle=0x130, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0131.813] _get_osfhandle (_FileHandle=0) returned 0x154
	[0131.813] GetConsoleMode (in: hConsoleHandle=0x154, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0131.813] GetEnvironmentStringsW () returned 0x4d7cc0*
	[0131.814] GetProcessHeap () returned 0x4d0000
	[0131.814] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0xa1a) returned 0x4d86e8
	[0131.814] FreeEnvironmentStringsA (penv="A") returned 1
	[0131.814] GetProcessHeap () returned 0x4d0000
	[0131.814] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x4) returned 0x4d0550
	[0131.814] GetEnvironmentStringsW () returned 0x4d7cc0*
	[0131.814] GetProcessHeap () returned 0x4d0000
	[0131.814] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0xa1a) returned 0x4d9110
	[0131.814] FreeEnvironmentStringsA (penv="A") returned 1
	[0131.814] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0131.814] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0131.814] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0131.814] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0131.814] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0131.814] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0131.815] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0131.815] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0131.815] RegCloseKey (hKey=0x88) returned 0x0
	[0131.815] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0131.815] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0131.815] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0131.815] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0131.815] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0131.815] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0131.815] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0131.815] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0131.815] RegCloseKey (hKey=0x88) returned 0x0
	[0131.815] time (in: timer=0x0 | out: timer=0x0) returned 0x6234420e
	[0131.815] srand (_Seed=0x6234420e) 
	[0131.818] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im synctime.exe \""
	[0131.818] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im synctime.exe \""
	[0131.818] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0131.818] GetProcessHeap () returned 0x4d0000
	[0131.818] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x210) returned 0x4d9b38
	[0131.818] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4d9b40, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0131.818] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0131.818] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0131.819] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0131.819] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0131.819] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0131.819] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0131.819] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0131.819] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0131.819] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0131.819] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0131.819] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0131.819] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0131.819] GetProcessHeap () returned 0x4d0000
	[0131.820] RtlFreeHeap (HeapHandle=0x4d0000, Flags=0x0, BaseAddress=0x4d86e8) returned 1
	[0131.820] GetEnvironmentStringsW () returned 0x4d7cc0*
	[0131.820] GetProcessHeap () returned 0x4d0000
	[0131.820] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0xa32) returned 0x4da790
	[0131.820] FreeEnvironmentStringsA (penv="A") returned 1
	[0131.820] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b
	[0131.820] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0131.820] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0131.820] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0131.820] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0131.820] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0131.820] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0131.820] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0131.820] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0131.820] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0131.820] GetProcessHeap () returned 0x4d0000
	[0131.820] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x44) returned 0x4d05c8
	[0131.821] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0131.821] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19fc4c*="Desktop") returned 0x1d
	[0131.821] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0131.821] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x4d0618
	[0131.821] FindClose (in: hFindFile=0x4d0618 | out: hFindFile=0x4d0618) returned 1
	[0131.821] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x4d0618
	[0131.822] FindClose (in: hFindFile=0x4d0618 | out: hFindFile=0x4d0618) returned 1
	[0131.822] _wcsnicmp (_String1="RDHJ0C~1", _String2="RDhJ0CNFevzX", _MaxCount=0xc) returned 16
	[0131.822] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x4d0618
	[0131.822] FindClose (in: hFindFile=0x4d0618 | out: hFindFile=0x4d0618) returned 1
	[0131.822] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0131.822] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1
	[0131.822] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 1
	[0131.822] GetProcessHeap () returned 0x4d0000
	[0131.822] RtlFreeHeap (HeapHandle=0x4d0000, Flags=0x0, BaseAddress=0x4da790) returned 1
	[0131.822] GetEnvironmentStringsW () returned 0x4d7cc0*
	[0131.823] GetProcessHeap () returned 0x4d0000
	[0131.823] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0xa76) returned 0x4d9d50
	[0131.823] FreeEnvironmentStringsA (penv="=") returned 1
	[0131.823] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0131.823] GetProcessHeap () returned 0x4d0000
	[0131.823] RtlFreeHeap (HeapHandle=0x4d0000, Flags=0x0, BaseAddress=0x4d05c8) returned 1
	[0131.823] GetProcessHeap () returned 0x4d0000
	[0131.823] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x400e) returned 0x4dbc50
	[0131.824] GetProcessHeap () returned 0x4d0000
	[0131.824] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x4c) returned 0x4da7d0
	[0131.824] GetProcessHeap () returned 0x4d0000
	[0131.824] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x4008) returned 0x4dfc68
	[0131.824] GetProcessHeap () returned 0x4d0000
	[0131.824] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x4008) returned 0x4e3c78
	[0131.825] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0131.826] GetProcessHeap () returned 0x4d0000
	[0131.826] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x418) returned 0x4da828
	[0131.826] SetErrorMode (uMode=0x0) returned 0x8003
	[0131.826] SetErrorMode (uMode=0x1) returned 0x0
	[0131.826] GetFullPathNameW (in: lpFileName="taskkill \\f \\.", nBufferLength=0x208, lpBuffer=0x4da830, lpFilePart=0x19fbac | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f", lpFilePart=0x19fbac*="f") returned 0x29
	[0131.826] SetErrorMode (uMode=0x8003) returned 0x1
	[0131.826] GetProcessHeap () returned 0x4d0000
	[0131.826] RtlReAllocateHeap (Heap=0x4d0000, Flags=0x0, Ptr=0x4da828, Size=0x7e) returned 0x4da828
	[0131.826] GetProcessHeap () returned 0x4d0000
	[0131.826] RtlSizeHeap (HeapHandle=0x4d0000, Flags=0x0, MemoryPointer=0x4da828) returned 0x7e
	[0131.826] NeedCurrentDirectoryForExePathW (ExeName="taskkill \\f \\.") returned 1
	[0131.826] GetProcessHeap () returned 0x4d0000
	[0131.826] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x62) returned 0x4da8b0
	[0131.826] GetProcessHeap () returned 0x4d0000
	[0131.826] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0xb8) returned 0x4da920
	[0131.826] GetProcessHeap () returned 0x4d0000
	[0131.826] RtlReAllocateHeap (Heap=0x4d0000, Flags=0x0, Ptr=0x4da920, Size=0x62) returned 0x4da920
	[0131.826] GetProcessHeap () returned 0x4d0000
	[0131.827] RtlSizeHeap (HeapHandle=0x4d0000, Flags=0x0, MemoryPointer=0x4da920) returned 0x62
	[0131.827] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0131.827] GetProcessHeap () returned 0x4d0000
	[0131.827] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0xe0) returned 0x4da990
	[0131.830] GetProcessHeap () returned 0x4d0000
	[0131.830] RtlReAllocateHeap (Heap=0x4d0000, Flags=0x0, Ptr=0x4da990, Size=0x76) returned 0x4da990
	[0131.830] GetProcessHeap () returned 0x4d0000
	[0131.830] RtlSizeHeap (HeapHandle=0x4d0000, Flags=0x0, MemoryPointer=0x4da990) returned 0x76
	[0131.830] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0131.831] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f\\im synctime.exe ", fInfoLevelId=0x1, lpFindFileData=0x19f958, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f958) returned 0xffffffff
	[0131.831] GetLastError () returned 0x3
	[0131.831] GetProcessHeap () returned 0x4d0000
	[0131.832] RtlFreeHeap (HeapHandle=0x4d0000, Flags=0x0, BaseAddress=0x4dfc68) returned 1
	[0131.832] GetProcessHeap () returned 0x4d0000
	[0131.832] RtlFreeHeap (HeapHandle=0x4d0000, Flags=0x0, BaseAddress=0x4e3c78) returned 1
	[0131.832] GetProcessHeap () returned 0x4d0000
	[0131.833] RtlFreeHeap (HeapHandle=0x4d0000, Flags=0x0, BaseAddress=0x4dbc50) returned 1
	[0131.833] GetConsoleOutputCP () returned 0x1b5
	[0131.834] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0131.834] GetUserDefaultLCID () returned 0x409
	[0131.834] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x13d34a0, cchData=8 | out: lpLCData=":") returned 2
	[0131.834] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0131.834] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0131.834] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2
	[0131.834] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x13d34b0, cchData=8 | out: lpLCData="/") returned 2
	[0131.834] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x13d3500, cchData=32 | out: lpLCData="Mon") returned 4
	[0131.834] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x13d3540, cchData=32 | out: lpLCData="Tue") returned 4
	[0131.834] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x13d3580, cchData=32 | out: lpLCData="Wed") returned 4
	[0131.834] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x13d35c0, cchData=32 | out: lpLCData="Thu") returned 4
	[0131.835] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x13d3600, cchData=32 | out: lpLCData="Fri") returned 4
	[0131.835] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x13d3640, cchData=32 | out: lpLCData="Sat") returned 4
	[0131.835] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x13d3680, cchData=32 | out: lpLCData="Sun") returned 4
	[0131.835] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x13d34c0, cchData=8 | out: lpLCData=".") returned 2
	[0131.835] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x13d34e0, cchData=8 | out: lpLCData=",") returned 2
	[0131.835] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0131.836] GetProcessHeap () returned 0x4d0000
	[0131.836] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x20c) returned 0x4daa58
	[0131.836] GetConsoleTitleW (in: lpConsoleTitle=0x4daa58, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0131.841] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0131.841] GetProcAddress (hModule=0x75600000, lpProcName="CopyFileExW") returned 0x7561ffc0
	[0131.841] GetProcAddress (hModule=0x75600000, lpProcName="IsDebuggerPresent") returned 0x7561b0b0
	[0131.841] GetProcAddress (hModule=0x75600000, lpProcName="SetConsoleInputExeNameW") returned 0x7559b440
	[0131.841] GetProcessHeap () returned 0x4d0000
	[0131.841] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x400a) returned 0x4dbc50
	[0131.841] GetProcessHeap () returned 0x4d0000
	[0131.842] RtlFreeHeap (HeapHandle=0x4d0000, Flags=0x0, BaseAddress=0x4dbc50) returned 1
	[0131.843] _wcsicmp (_String1="taskkill", _String2=")") returned 75
	[0131.843] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14
	[0131.843] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14
	[0131.843] _wcsicmp (_String1="IF", _String2="taskkill") returned -11
	[0131.843] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11
	[0131.843] _wcsicmp (_String1="REM", _String2="taskkill") returned -2
	[0131.843] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2
	[0131.843] GetProcessHeap () returned 0x4d0000
	[0131.843] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x58) returned 0x4dac70
	[0131.843] GetProcessHeap () returned 0x4d0000
	[0131.843] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x1a) returned 0x4d0578
	[0131.844] GetProcessHeap () returned 0x4d0000
	[0131.844] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x34) returned 0x4dacd0
	[0131.844] GetConsoleTitleW (in: lpConsoleTitle=0x19fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0131.846] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0131.846] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0131.846] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0131.846] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0131.846] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0131.846] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0131.846] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0131.846] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0131.846] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0131.846] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0131.846] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0131.846] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0131.846] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0131.846] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0131.846] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0131.846] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0131.847] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0131.847] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0131.847] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0131.847] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0131.847] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0131.847] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0131.847] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0131.847] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0131.847] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0131.847] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0131.847] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0131.847] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0131.847] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0131.847] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0131.847] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0131.847] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0131.847] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0131.847] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0131.847] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0131.847] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0131.847] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0131.847] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0131.847] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0131.847] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0131.847] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0131.847] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0131.847] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0131.847] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0131.847] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0131.847] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0131.847] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0131.848] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0131.848] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0131.848] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0131.848] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0131.848] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0131.848] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0131.848] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0131.848] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0131.848] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0131.848] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0131.848] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0131.848] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0131.848] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0131.848] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0131.848] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0131.848] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0131.848] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0131.848] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0131.848] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0131.848] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0131.848] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0131.848] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0131.848] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0131.848] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0131.848] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0131.848] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0131.848] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0131.848] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0131.848] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0131.848] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0131.848] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0131.849] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0131.849] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0131.849] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0131.849] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0131.849] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0131.849] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0131.849] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14
	[0131.849] _wcsicmp (_String1="taskkill", _String2="IF") returned 11
	[0131.849] _wcsicmp (_String1="taskkill", _String2="REM") returned 2
	[0131.849] GetProcessHeap () returned 0x4d0000
	[0131.849] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x210) returned 0x4dad10
	[0131.849] GetProcessHeap () returned 0x4d0000
	[0131.849] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x46) returned 0x4daf28
	[0131.849] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0131.850] GetProcessHeap () returned 0x4d0000
	[0131.850] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x418) returned 0x4d05c8
	[0131.850] SetErrorMode (uMode=0x0) returned 0x8003
	[0131.850] SetErrorMode (uMode=0x1) returned 0x0
	[0131.850] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4d05d0, lpFilePart=0x19f57c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19f57c*="Desktop") returned 0x1d
	[0131.850] SetErrorMode (uMode=0x8003) returned 0x1
	[0131.850] GetProcessHeap () returned 0x4d0000
	[0131.850] RtlReAllocateHeap (Heap=0x4d0000, Flags=0x0, Ptr=0x4d05c8, Size=0x56) returned 0x4d05c8
	[0131.850] GetProcessHeap () returned 0x4d0000
	[0131.850] RtlSizeHeap (HeapHandle=0x4d0000, Flags=0x0, MemoryPointer=0x4d05c8) returned 0x56
	[0131.850] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0131.850] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0131.850] GetProcessHeap () returned 0x4d0000
	[0131.850] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x110) returned 0x4daf78
	[0131.850] GetProcessHeap () returned 0x4d0000
	[0131.850] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x218) returned 0x4d0628
	[0131.855] GetProcessHeap () returned 0x4d0000
	[0131.855] RtlReAllocateHeap (Heap=0x4d0000, Flags=0x0, Ptr=0x4d0628, Size=0x112) returned 0x4d0628
	[0131.855] GetProcessHeap () returned 0x4d0000
	[0131.855] RtlSizeHeap (HeapHandle=0x4d0000, Flags=0x0, MemoryPointer=0x4d0628) returned 0x112
	[0131.855] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0131.855] GetProcessHeap () returned 0x4d0000
	[0131.855] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0xe0) returned 0x4db090
	[0131.857] GetProcessHeap () returned 0x4d0000
	[0131.857] RtlReAllocateHeap (Heap=0x4d0000, Flags=0x0, Ptr=0x4db090, Size=0x76) returned 0x4db090
	[0131.857] GetProcessHeap () returned 0x4d0000
	[0131.857] RtlSizeHeap (HeapHandle=0x4d0000, Flags=0x0, MemoryPointer=0x4db090) returned 0x76
	[0131.857] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0131.857] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0131.858] GetLastError () returned 0x2
	[0131.858] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0131.858] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x4db110
	[0131.858] GetProcessHeap () returned 0x4d0000
	[0131.858] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x14) returned 0x4d7548
	[0131.858] FindClose (in: hFindFile=0x4db110 | out: hFindFile=0x4db110) returned 1
	[0131.858] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0131.858] GetLastError () returned 0x2
	[0131.859] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x4db110
	[0131.859] GetProcessHeap () returned 0x4d0000
	[0131.859] RtlReAllocateHeap (Heap=0x4d0000, Flags=0x0, Ptr=0x4d7548, Size=0x4) returned 0x4db150
	[0131.859] FindClose (in: hFindFile=0x4db110 | out: hFindFile=0x4db110) returned 1
	[0131.859] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0131.859] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0131.859] GetConsoleTitleW (in: lpConsoleTitle=0x19f7fc, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0131.860] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f728, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f70c | out: lpAttributeList=0x19f728, lpSize=0x19f70c) returned 1
	[0131.860] UpdateProcThreadAttribute (in: lpAttributeList=0x19f728, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f714, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f728, lpPreviousValue=0x0) returned 1
	[0131.860] GetStartupInfoW (in: lpStartupInfo=0x19f760 | out: lpStartupInfo=0x19f760*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x154, hStdOutput=0x130, hStdError=0x13c)) 
	[0131.860] GetProcessHeap () returned 0x4d0000
	[0131.860] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x18) returned 0x4d7548
	[0131.860] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0131.860] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0131.860] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0131.860] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0131.860] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0131.860] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0131.860] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0131.860] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0131.860] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0131.860] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0131.861] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0131.861] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0131.861] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0131.861] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0131.861] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0131.861] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0131.861] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0131.861] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0131.861] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0131.861] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0131.861] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0131.861] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0131.861] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0131.861] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0131.861] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0131.861] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0131.861] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0131.861] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0131.861] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0131.861] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0131.861] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0131.861] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0131.861] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0131.861] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0131.861] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0131.861] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0131.862] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0131.862] GetProcessHeap () returned 0x4d0000
	[0131.862] RtlFreeHeap (HeapHandle=0x4d0000, Flags=0x0, BaseAddress=0x4d7548) returned 1
	[0131.862] GetProcessHeap () returned 0x4d0000
	[0131.862] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0xa) returned 0x4db110
	[0131.862] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1
	[0131.865] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill  /f /im synctime.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x19f6b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill  /f /im synctime.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f6fc | out: lpCommandLine="taskkill  /f /im synctime.exe ", lpProcessInformation=0x19f6fc*(hProcess=0x9c, hThread=0x98, dwProcessId=0x1048, dwThreadId=0x1054)) returned 1
	[0131.882] CloseHandle (hObject=0x98) returned 1
	[0131.882] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0131.882] GetProcessHeap () returned 0x4d0000
	[0131.883] RtlFreeHeap (HeapHandle=0x4d0000, Flags=0x0, BaseAddress=0x4d9d50) returned 1
	[0131.883] GetEnvironmentStringsW () returned 0x4d9d50*
	[0131.883] GetProcessHeap () returned 0x4d0000
	[0131.883] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0xa76) returned 0x4d7cc0
	[0131.883] FreeEnvironmentStringsA (penv="=") returned 1
	[0131.883] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0
	[0132.996] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x19f694 | out: lpExitCode=0x19f694*=0x80) returned 1
	[0132.996] CloseHandle (hObject=0x9c) returned 1
	[0132.997] _vsnwprintf (in: _Buffer=0x19f77c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f69c | out: _Buffer="00000080") returned 8
	[0132.997] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1
	[0132.997] GetProcessHeap () returned 0x4d0000
	[0132.998] RtlFreeHeap (HeapHandle=0x4d0000, Flags=0x0, BaseAddress=0x4d7cc0) returned 1
	[0132.998] GetEnvironmentStringsW () returned 0x4db160*
	[0132.998] GetProcessHeap () returned 0x4d0000
	[0132.998] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0xa9c) returned 0x4d7cc0
	[0132.998] FreeEnvironmentStringsA (penv="=") returned 1
	[0132.998] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0132.998] GetProcessHeap () returned 0x4d0000
	[0132.999] RtlFreeHeap (HeapHandle=0x4d0000, Flags=0x0, BaseAddress=0x4d7cc0) returned 1
	[0132.999] GetEnvironmentStringsW () returned 0x4db160*
	[0132.999] GetProcessHeap () returned 0x4d0000
	[0132.999] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0xa9c) returned 0x4d7cc0
	[0132.999] FreeEnvironmentStringsA (penv="=") returned 1
	[0132.999] GetProcessHeap () returned 0x4d0000
	[0132.999] RtlFreeHeap (HeapHandle=0x4d0000, Flags=0x0, BaseAddress=0x4db110) returned 1
	[0132.999] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f728 | out: lpAttributeList=0x19f728) 
	[0132.999] _get_osfhandle (_FileHandle=1) returned 0x130
	[0132.999] SetConsoleMode (hConsoleHandle=0x130, dwMode=0x0) returned 0
	[0132.999] _get_osfhandle (_FileHandle=1) returned 0x130
	[0132.999] GetConsoleMode (in: hConsoleHandle=0x130, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0132.999] _get_osfhandle (_FileHandle=0) returned 0x154
	[0132.999] GetConsoleMode (in: hConsoleHandle=0x154, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0132.999] GetConsoleOutputCP () returned 0x1b5
	[0133.000] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0133.000] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0133.002] exit (_Code=128) 

Thread:
	id = 176
	os_tid = 0x1044


Process:
	id = "22"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\syswow64\\taskkill.exe"
	page_root = "0x47983000"
	os_pid = "0x1048"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "21"
	os_parent_pid = "0x101c"
	cmd_line = "taskkill  /f /im synctime.exe "
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 1923
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 1924
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 1925
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 1926
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 1927
	        start_va = 0xa0000
	          end_va = 0xdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 1928
	        start_va = 0xe0000
	          end_va = 0xe3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 1929
	        start_va = 0xf0000
	          end_va = 0xf0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 1930
	        start_va = 0x100000
	          end_va = 0x101fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 1931
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 1932
	        start_va = 0x13b0000
	          end_va = 0x13c5fff
	       monitored = 0
	     entry_point = 0x13bde80
	     region_type = mapped_file
	            name = "taskkill.exe"
	        filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe")

Region:
	              id = 1933
	        start_va = 0x13d0000
	          end_va = 0x53cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000013d0000"
	        filename = ""

Region:
	              id = 1934
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 1935
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 1936
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 1937
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 1938
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 1939
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 1940
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 1941
	        start_va = 0x110000
	          end_va = 0x11ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000110000"
	        filename = ""

Region:
	              id = 1942
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 1943
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 1944
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 1945
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 1946
	        start_va = 0x400000
	          end_va = 0x66ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 1947
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 1948
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 1949
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 1950
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 1951
	        start_va = 0x120000
	          end_va = 0x1ddfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 1952
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 1953
	        start_va = 0x74650000
	          end_va = 0x746cafff
	       monitored = 0
	     entry_point = 0x7466e970
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 1954
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 1955
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 1956
	        start_va = 0x440000
	          end_va = 0x47ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000440000"
	        filename = ""

Region:
	              id = 1957
	        start_va = 0x570000
	          end_va = 0x66ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000570000"
	        filename = ""

Region:
	              id = 1958
	        start_va = 0x76ae0000
	          end_va = 0x76b23fff
	       monitored = 0
	     entry_point = 0x76af9d80
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 1959
	        start_va = 0x75260000
	          end_va = 0x7530cfff
	       monitored = 0
	     entry_point = 0x75274f00
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 1960
	        start_va = 0x74450000
	          end_va = 0x7446dfff
	       monitored = 0
	     entry_point = 0x7445b640
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 1961
	        start_va = 0x74440000
	          end_va = 0x74449fff
	       monitored = 0
	     entry_point = 0x74442a00
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 1962
	        start_va = 0x74590000
	          end_va = 0x745e7fff
	       monitored = 0
	     entry_point = 0x745d25c0
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 1963
	        start_va = 0x77450000
	          end_va = 0x77596fff
	       monitored = 0
	     entry_point = 0x77461cf0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 1964
	        start_va = 0x76b30000
	          end_va = 0x76c7efff
	       monitored = 0
	     entry_point = 0x76be6820
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 1965
	        start_va = 0x753c0000
	          end_va = 0x75451fff
	       monitored = 0
	     entry_point = 0x753f8cf0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 1966
	        start_va = 0x77290000
	          end_va = 0x7744cfff
	       monitored = 0
	     entry_point = 0x77372a10
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")

Region:
	              id = 1967
	        start_va = 0x75310000
	          end_va = 0x7536efff
	       monitored = 0
	     entry_point = 0x75314af0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 1968
	        start_va = 0x77240000
	          end_va = 0x77284fff
	       monitored = 0
	     entry_point = 0x7725de90
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 1969
	        start_va = 0x6cc90000
	          end_va = 0x6cc97fff
	       monitored = 0
	     entry_point = 0x6cc917b0
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 1970
	        start_va = 0x6cc70000
	          end_va = 0x6cc85fff
	       monitored = 0
	     entry_point = 0x6cc721d0
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")

Region:
	              id = 1971
	        start_va = 0x6cc30000
	          end_va = 0x6cc6efff
	       monitored = 0
	     entry_point = 0x6cc446c0
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll")

Region:
	              id = 1972
	        start_va = 0x6cad0000
	          end_va = 0x6caebfff
	       monitored = 0
	     entry_point = 0x6cad4720
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")

Region:
	              id = 1973
	        start_va = 0x6cac0000
	          end_va = 0x6cac9fff
	       monitored = 0
	     entry_point = 0x6cac28d0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")

Region:
	              id = 1974
	        start_va = 0x6caf0000
	          end_va = 0x6cc2efff
	       monitored = 0
	     entry_point = 0x6cb1d880
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll")

Region:
	              id = 1975
	        start_va = 0x670000
	          end_va = 0x80ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000670000"
	        filename = ""

Region:
	              id = 1976
	        start_va = 0x480000
	          end_va = 0x4a9fff
	       monitored = 0
	     entry_point = 0x485680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 1977
	        start_va = 0x670000
	          end_va = 0x7f7fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000670000"
	        filename = ""

Region:
	              id = 1978
	        start_va = 0x800000
	          end_va = 0x80ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000800000"
	        filename = ""

Region:
	              id = 1979
	        start_va = 0x74ea0000
	          end_va = 0x74ecafff
	       monitored = 0
	     entry_point = 0x74ea5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 1980
	        start_va = 0x810000
	          end_va = 0x990fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000810000"
	        filename = ""

Region:
	              id = 1981
	        start_va = 0x53d0000
	          end_va = 0x67cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000053d0000"
	        filename = ""

Region:
	              id = 1982
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 1983
	        start_va = 0x1e0000
	          end_va = 0x1e0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001e0000"
	        filename = ""

Region:
	              id = 1984
	        start_va = 0x1f0000
	          end_va = 0x1f4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taskkill.exe.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui")

Region:
	              id = 1985
	        start_va = 0x480000
	          end_va = 0x480fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 1986
	        start_va = 0x490000
	          end_va = 0x490fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000490000"
	        filename = ""

Region:
	              id = 1987
	        start_va = 0x9a0000
	          end_va = 0xcd6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 1988
	        start_va = 0xce0000
	          end_va = 0xdc9fff
	       monitored = 0
	     entry_point = 0xd1d650
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 1989
	        start_va = 0x4a0000
	          end_va = 0x4a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004a0000"
	        filename = ""

Region:
	              id = 1990
	        start_va = 0xce0000
	          end_va = 0xdbffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 1991
	        start_va = 0x76e20000
	          end_va = 0x76e2bfff
	       monitored = 0
	     entry_point = 0x76e23930
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")

Region:
	              id = 1992
	        start_va = 0x4b0000
	          end_va = 0x4b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004b0000"
	        filename = ""

Region:
	              id = 1993
	        start_va = 0x76c80000
	          end_va = 0x76d03fff
	       monitored = 0
	     entry_point = 0x76ca6220
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 1994
	        start_va = 0x4c0000
	          end_va = 0x4c0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004c0000"
	        filename = ""

Region:
	              id = 1995
	        start_va = 0x6cab0000
	          end_va = 0x6cabcfff
	       monitored = 0
	     entry_point = 0x6cab3520
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 1996
	        start_va = 0x6ca40000
	          end_va = 0x6caa6fff
	       monitored = 0
	     entry_point = 0x6ca5b610
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 1997
	        start_va = 0x740f0000
	          end_va = 0x7410afff
	       monitored = 0
	     entry_point = 0x740f9050
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 1998
	        start_va = 0x6c9f0000
	          end_va = 0x6ca33fff
	       monitored = 0
	     entry_point = 0x6ca0aaf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")

Region:
	              id = 1999
	        start_va = 0x4d0000
	          end_va = 0x50ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004d0000"
	        filename = ""

Region:
	              id = 2000
	        start_va = 0x510000
	          end_va = 0x54ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000510000"
	        filename = ""

Region:
	              id = 2001
	        start_va = 0xdc0000
	          end_va = 0xdfffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000dc0000"
	        filename = ""

Region:
	              id = 2002
	        start_va = 0xe00000
	          end_va = 0xe3ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e00000"
	        filename = ""

Region:
	              id = 2003
	        start_va = 0xe40000
	          end_va = 0xe7ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e40000"
	        filename = ""

Region:
	              id = 2004
	        start_va = 0xe80000
	          end_va = 0xebffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e80000"
	        filename = ""

Region:
	              id = 2005
	        start_va = 0x6c9d0000
	          end_va = 0x6c9e0fff
	       monitored = 0
	     entry_point = 0x6c9d8fa0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 2006
	        start_va = 0x6c910000
	          end_va = 0x6c9cefff
	       monitored = 0
	     entry_point = 0x6c941e80
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 2008
	        start_va = 0x550000
	          end_va = 0x555fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000550000"
	        filename = ""


Thread:
	id = 177
	os_tid = 0x1054


Thread:
	id = 178
	os_tid = 0x1058


Thread:
	id = 179
	os_tid = 0x10ec


Thread:
	id = 180
	os_tid = 0x10f0


Thread:
	id = 181
	os_tid = 0x10f4


Process:
	id = "23"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x4770b000"
	os_pid = "0x10fc"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x614"
	cmd_line = "cmd.exe /c \"taskkill /f /im mydesktopqos.exe \""
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 2011
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 2012
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 2013
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 2014
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 2015
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 2016
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 2017
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 2018
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 2019
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 2020
	        start_va = 0x13a0000
	          end_va = 0x13f1fff
	       monitored = 1
	     entry_point = 0x13b4fd0
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")

Region:
	              id = 2021
	        start_va = 0x1400000
	          end_va = 0x53fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001400000"
	        filename = ""

Region:
	              id = 2022
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 2023
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 2024
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 2025
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 2026
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 2027
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 2028
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 2029
	        start_va = 0x4b0000
	          end_va = 0x4bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004b0000"
	        filename = ""

Region:
	              id = 2030
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 2031
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 2032
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 2033
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 2034
	        start_va = 0x4c0000
	          end_va = 0x64ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004c0000"
	        filename = ""

Region:
	              id = 2035
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 2036
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 2037
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 2038
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 2039
	        start_va = 0x650000
	          end_va = 0x70dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 2040
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 2041
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 2042
	        start_va = 0x710000
	          end_va = 0x80ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000710000"
	        filename = ""

Region:
	              id = 2043
	        start_va = 0x810000
	          end_va = 0x98ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000810000"
	        filename = ""

Region:
	              id = 2044
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 2045
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 2046
	        start_va = 0x990000
	          end_va = 0xcc6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 182
	os_tid = 0x1100

	[0133.605] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000
	[0133.605] __set_app_type (_Type=0x1) 
	[0133.605] __p__fmode () returned 0x74974d6c
	[0133.605] __p__commode () returned 0x74975b1c
	[0133.605] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13b5200) returned 0x0
	[0133.605] __getmainargs (in: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0, _DoWildCard=0, _StartInfo=0x13c60fc | out: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0) returned 0
	[0133.605] GetCurrentThreadId () returned 0x1100
	[0133.605] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x1100) returned 0x78
	[0133.606] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0133.606] GetProcAddress (hModule=0x75600000, lpProcName="SetThreadUILanguage") returned 0x75642510
	[0133.606] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0133.610] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0133.610] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2
	[0133.610] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0133.610] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0133.611] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0133.611] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0133.611] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0133.611] GetConsoleOutputCP () returned 0x1b5
	[0133.612] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0133.612] SetConsoleCtrlHandler (HandlerRoutine=0x13c0e40, Add=1) returned 1
	[0133.612] _get_osfhandle (_FileHandle=1) returned 0x154
	[0133.612] SetConsoleMode (hConsoleHandle=0x154, dwMode=0x0) returned 0
	[0133.612] _get_osfhandle (_FileHandle=1) returned 0x154
	[0133.613] GetConsoleMode (in: hConsoleHandle=0x154, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0133.613] _get_osfhandle (_FileHandle=0) returned 0x150
	[0133.613] GetConsoleMode (in: hConsoleHandle=0x150, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0133.613] GetEnvironmentStringsW () returned 0x557fe8*
	[0133.613] GetProcessHeap () returned 0x550000
	[0133.613] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xa1a) returned 0x558a10
	[0133.613] FreeEnvironmentStringsA (penv="A") returned 1
	[0133.613] GetProcessHeap () returned 0x550000
	[0133.613] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x4) returned 0x553420
	[0133.613] GetEnvironmentStringsW () returned 0x557fe8*
	[0133.613] GetProcessHeap () returned 0x550000
	[0133.613] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xa1a) returned 0x559438
	[0133.613] FreeEnvironmentStringsA (penv="A") returned 1
	[0133.613] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0133.613] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0133.614] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0133.614] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0133.614] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0133.614] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0133.614] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0133.614] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0133.614] RegCloseKey (hKey=0x88) returned 0x0
	[0133.614] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0133.614] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0133.614] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0133.614] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0133.614] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0133.614] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0133.614] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0133.615] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0133.615] RegCloseKey (hKey=0x88) returned 0x0
	[0133.615] time (in: timer=0x0 | out: timer=0x0) returned 0x6234420f
	[0133.615] srand (_Seed=0x6234420f) 
	[0133.615] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im mydesktopqos.exe \""
	[0133.615] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im mydesktopqos.exe \""
	[0133.615] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0133.615] GetProcessHeap () returned 0x550000
	[0133.615] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x210) returned 0x556fc0
	[0133.615] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x556fc8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0133.615] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0133.615] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0133.615] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0133.615] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0133.615] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0133.615] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0133.615] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0133.615] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0133.616] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0133.616] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0133.616] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0133.616] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0133.616] GetProcessHeap () returned 0x550000
	[0133.616] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x558a10) returned 1
	[0133.617] GetEnvironmentStringsW () returned 0x557fe8*
	[0133.617] GetProcessHeap () returned 0x550000
	[0133.617] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xa32) returned 0x55a8a0
	[0133.617] FreeEnvironmentStringsA (penv="A") returned 1
	[0133.617] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b
	[0133.617] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0133.617] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0133.617] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0133.618] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0133.618] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0133.618] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0133.618] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0133.618] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0133.618] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0133.618] GetProcessHeap () returned 0x550000
	[0133.618] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x44) returned 0x557e70
	[0133.618] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0133.618] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19fc4c*="Desktop") returned 0x1d
	[0133.619] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0133.619] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x5571d8
	[0133.619] FindClose (in: hFindFile=0x5571d8 | out: hFindFile=0x5571d8) returned 1
	[0133.619] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x5571d8
	[0133.620] FindClose (in: hFindFile=0x5571d8 | out: hFindFile=0x5571d8) returned 1
	[0133.620] _wcsnicmp (_String1="RDHJ0C~1", _String2="RDhJ0CNFevzX", _MaxCount=0xc) returned 16
	[0133.620] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x5571d8
	[0133.620] FindClose (in: hFindFile=0x5571d8 | out: hFindFile=0x5571d8) returned 1
	[0133.620] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0133.621] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1
	[0133.621] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 1
	[0133.621] GetProcessHeap () returned 0x550000
	[0133.622] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x55a8a0) returned 1
	[0133.622] GetEnvironmentStringsW () returned 0x557fe8*
	[0133.622] GetProcessHeap () returned 0x550000
	[0133.622] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xa76) returned 0x559e60
	[0133.622] FreeEnvironmentStringsA (penv="=") returned 1
	[0133.622] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0133.622] GetProcessHeap () returned 0x550000
	[0133.622] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x557e70) returned 1
	[0133.623] GetProcessHeap () returned 0x550000
	[0133.623] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x400e) returned 0x55bd60
	[0133.624] GetProcessHeap () returned 0x550000
	[0133.624] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x54) returned 0x5571d8
	[0133.624] GetProcessHeap () returned 0x550000
	[0133.624] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x4008) returned 0x55fd78
	[0133.625] GetProcessHeap () returned 0x550000
	[0133.625] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x4008) returned 0x563d88
	[0133.626] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0133.627] GetProcessHeap () returned 0x550000
	[0133.627] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x418) returned 0x55a8e0
	[0133.627] SetErrorMode (uMode=0x0) returned 0x8003
	[0133.627] SetErrorMode (uMode=0x1) returned 0x0
	[0133.627] GetFullPathNameW (in: lpFileName="taskkill \\f \\.", nBufferLength=0x208, lpBuffer=0x55a8e8, lpFilePart=0x19fbac | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f", lpFilePart=0x19fbac*="f") returned 0x29
	[0133.627] SetErrorMode (uMode=0x8003) returned 0x1
	[0133.627] GetProcessHeap () returned 0x550000
	[0133.627] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x55a8e0, Size=0x86) returned 0x55a8e0
	[0133.627] GetProcessHeap () returned 0x550000
	[0133.627] RtlSizeHeap (HeapHandle=0x550000, Flags=0x0, MemoryPointer=0x55a8e0) returned 0x86
	[0133.627] NeedCurrentDirectoryForExePathW (ExeName="taskkill \\f \\.") returned 1
	[0133.627] GetProcessHeap () returned 0x550000
	[0133.627] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x62) returned 0x557238
	[0133.627] GetProcessHeap () returned 0x550000
	[0133.627] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xb8) returned 0x55a970
	[0133.627] GetProcessHeap () returned 0x550000
	[0133.627] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x55a970, Size=0x62) returned 0x55a970
	[0133.627] GetProcessHeap () returned 0x550000
	[0133.627] RtlSizeHeap (HeapHandle=0x550000, Flags=0x0, MemoryPointer=0x55a970) returned 0x62
	[0133.628] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0133.628] GetProcessHeap () returned 0x550000
	[0133.628] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xe0) returned 0x55a9e0
	[0133.632] GetProcessHeap () returned 0x550000
	[0133.632] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x55a9e0, Size=0x76) returned 0x55a9e0
	[0133.632] GetProcessHeap () returned 0x550000
	[0133.632] RtlSizeHeap (HeapHandle=0x550000, Flags=0x0, MemoryPointer=0x55a9e0) returned 0x76
	[0133.632] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0133.632] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f\\im mydesktopqos.exe ", fInfoLevelId=0x1, lpFindFileData=0x19f958, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f958) returned 0xffffffff
	[0133.632] GetLastError () returned 0x3
	[0133.632] GetProcessHeap () returned 0x550000
	[0133.633] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x55fd78) returned 1
	[0133.633] GetProcessHeap () returned 0x550000
	[0133.633] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x563d88) returned 1
	[0133.633] GetProcessHeap () returned 0x550000
	[0133.634] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x55bd60) returned 1
	[0133.634] GetConsoleOutputCP () returned 0x1b5
	[0133.635] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0133.635] GetUserDefaultLCID () returned 0x409
	[0133.635] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x13d34a0, cchData=8 | out: lpLCData=":") returned 2
	[0133.635] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0133.635] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0133.635] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2
	[0133.635] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x13d34b0, cchData=8 | out: lpLCData="/") returned 2
	[0133.635] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x13d3500, cchData=32 | out: lpLCData="Mon") returned 4
	[0133.635] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x13d3540, cchData=32 | out: lpLCData="Tue") returned 4
	[0133.636] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x13d3580, cchData=32 | out: lpLCData="Wed") returned 4
	[0133.636] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x13d35c0, cchData=32 | out: lpLCData="Thu") returned 4
	[0133.636] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x13d3600, cchData=32 | out: lpLCData="Fri") returned 4
	[0133.636] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x13d3640, cchData=32 | out: lpLCData="Sat") returned 4
	[0133.636] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x13d3680, cchData=32 | out: lpLCData="Sun") returned 4
	[0133.636] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x13d34c0, cchData=8 | out: lpLCData=".") returned 2
	[0133.636] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x13d34e0, cchData=8 | out: lpLCData=",") returned 2
	[0133.636] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0133.637] GetProcessHeap () returned 0x550000
	[0133.637] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20c) returned 0x55aa60
	[0133.637] GetConsoleTitleW (in: lpConsoleTitle=0x55aa60, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0133.639] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0133.640] GetProcAddress (hModule=0x75600000, lpProcName="CopyFileExW") returned 0x7561ffc0
	[0133.640] GetProcAddress (hModule=0x75600000, lpProcName="IsDebuggerPresent") returned 0x7561b0b0
	[0133.640] GetProcAddress (hModule=0x75600000, lpProcName="SetConsoleInputExeNameW") returned 0x7559b440
	[0133.640] GetProcessHeap () returned 0x550000
	[0133.640] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x400a) returned 0x55bd60
	[0133.640] GetProcessHeap () returned 0x550000
	[0133.640] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x55bd60) returned 1
	[0133.641] _wcsicmp (_String1="taskkill", _String2=")") returned 75
	[0133.641] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14
	[0133.641] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14
	[0133.641] _wcsicmp (_String1="IF", _String2="taskkill") returned -11
	[0133.641] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11
	[0133.641] _wcsicmp (_String1="REM", _String2="taskkill") returned -2
	[0133.641] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2
	[0133.641] GetProcessHeap () returned 0x550000
	[0133.642] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x58) returned 0x55ac78
	[0133.642] GetProcessHeap () returned 0x550000
	[0133.642] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1a) returned 0x55acd8
	[0133.642] GetProcessHeap () returned 0x550000
	[0133.642] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3c) returned 0x55ad00
	[0133.643] GetConsoleTitleW (in: lpConsoleTitle=0x19fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0133.645] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0133.645] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0133.645] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0133.645] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0133.645] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0133.645] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0133.645] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0133.645] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0133.645] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0133.646] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0133.646] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0133.646] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0133.646] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0133.646] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0133.646] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0133.646] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0133.646] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0133.646] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0133.646] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0133.646] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0133.646] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0133.646] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0133.646] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0133.646] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0133.646] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0133.646] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0133.646] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0133.646] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0133.646] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0133.646] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0133.646] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0133.646] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0133.646] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0133.646] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0133.646] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0133.646] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0133.646] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0133.646] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0133.647] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0133.647] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0133.647] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0133.647] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0133.647] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0133.647] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0133.647] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0133.647] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0133.647] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0133.647] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0133.647] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0133.647] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0133.647] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0133.647] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0133.647] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0133.647] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0133.647] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0133.647] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0133.647] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0133.647] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0133.647] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0133.647] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0133.647] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0133.647] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0133.647] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0133.647] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0133.647] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0133.647] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0133.647] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0133.647] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0133.648] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0133.648] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0133.648] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0133.648] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0133.648] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0133.648] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0133.648] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0133.648] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0133.648] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0133.648] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0133.648] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0133.648] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0133.648] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0133.648] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0133.648] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0133.648] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0133.648] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14
	[0133.648] _wcsicmp (_String1="taskkill", _String2="IF") returned 11
	[0133.648] _wcsicmp (_String1="taskkill", _String2="REM") returned 2
	[0133.649] GetProcessHeap () returned 0x550000
	[0133.649] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x210) returned 0x55ad48
	[0133.649] GetProcessHeap () returned 0x550000
	[0133.649] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x4e) returned 0x55af60
	[0133.649] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0133.649] GetProcessHeap () returned 0x550000
	[0133.649] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x418) returned 0x5505c8
	[0133.649] SetErrorMode (uMode=0x0) returned 0x8003
	[0133.649] SetErrorMode (uMode=0x1) returned 0x0
	[0133.649] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x5505d0, lpFilePart=0x19f57c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19f57c*="Desktop") returned 0x1d
	[0133.649] SetErrorMode (uMode=0x8003) returned 0x1
	[0133.649] GetProcessHeap () returned 0x550000
	[0133.649] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5505c8, Size=0x56) returned 0x5505c8
	[0133.649] GetProcessHeap () returned 0x550000
	[0133.649] RtlSizeHeap (HeapHandle=0x550000, Flags=0x0, MemoryPointer=0x5505c8) returned 0x56
	[0133.649] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0133.649] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0133.650] GetProcessHeap () returned 0x550000
	[0133.650] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x110) returned 0x55afb8
	[0133.650] GetProcessHeap () returned 0x550000
	[0133.650] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x218) returned 0x550628
	[0133.654] GetProcessHeap () returned 0x550000
	[0133.654] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x550628, Size=0x112) returned 0x550628
	[0133.654] GetProcessHeap () returned 0x550000
	[0133.655] RtlSizeHeap (HeapHandle=0x550000, Flags=0x0, MemoryPointer=0x550628) returned 0x112
	[0133.655] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0133.655] GetProcessHeap () returned 0x550000
	[0133.655] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xe0) returned 0x55b0d0
	[0133.656] GetProcessHeap () returned 0x550000
	[0133.656] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x55b0d0, Size=0x76) returned 0x55b0d0
	[0133.656] GetProcessHeap () returned 0x550000
	[0133.657] RtlSizeHeap (HeapHandle=0x550000, Flags=0x0, MemoryPointer=0x55b0d0) returned 0x76
	[0133.657] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0133.657] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0133.657] GetLastError () returned 0x2
	[0133.657] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0133.657] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x55b150
	[0133.657] GetProcessHeap () returned 0x550000
	[0133.657] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x14) returned 0x5576c8
	[0133.657] FindClose (in: hFindFile=0x55b150 | out: hFindFile=0x55b150) returned 1
	[0133.658] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0133.658] GetLastError () returned 0x2
	[0133.658] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x55b150
	[0133.658] GetProcessHeap () returned 0x550000
	[0133.658] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5576c8, Size=0x4) returned 0x557eb8
	[0133.658] FindClose (in: hFindFile=0x55b150 | out: hFindFile=0x55b150) returned 1
	[0133.658] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0133.658] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0133.658] GetConsoleTitleW (in: lpConsoleTitle=0x19f7fc, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0133.661] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f728, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f70c | out: lpAttributeList=0x19f728, lpSize=0x19f70c) returned 1
	[0133.661] UpdateProcThreadAttribute (in: lpAttributeList=0x19f728, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f714, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f728, lpPreviousValue=0x0) returned 1
	[0133.661] GetStartupInfoW (in: lpStartupInfo=0x19f760 | out: lpStartupInfo=0x19f760*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x150, hStdOutput=0x154, hStdError=0x130)) 
	[0133.661] GetProcessHeap () returned 0x550000
	[0133.661] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x18) returned 0x5576c8
	[0133.661] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0133.661] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0133.661] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0133.661] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0133.661] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0133.661] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0133.661] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0133.661] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0133.661] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0133.661] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0133.661] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0133.661] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0133.661] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0133.661] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0133.662] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0133.662] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0133.662] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0133.662] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0133.662] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0133.662] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0133.662] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0133.662] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0133.662] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0133.662] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0133.662] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0133.662] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0133.662] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0133.662] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0133.662] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0133.662] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0133.662] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0133.662] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0133.662] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0133.662] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0133.662] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0133.662] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0133.662] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0133.662] GetProcessHeap () returned 0x550000
	[0133.662] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x5576c8) returned 1
	[0133.662] GetProcessHeap () returned 0x550000
	[0133.662] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xa) returned 0x55b150
	[0133.663] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1
	[0133.666] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill  /f /im mydesktopqos.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x19f6b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill  /f /im mydesktopqos.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f6fc | out: lpCommandLine="taskkill  /f /im mydesktopqos.exe ", lpProcessInformation=0x19f6fc*(hProcess=0x9c, hThread=0x98, dwProcessId=0x1108, dwThreadId=0x110c)) returned 1
	[0133.683] CloseHandle (hObject=0x98) returned 1
	[0133.683] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0133.683] GetProcessHeap () returned 0x550000
	[0133.683] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x559e60) returned 1
	[0133.684] GetEnvironmentStringsW () returned 0x559e60*
	[0133.684] GetProcessHeap () returned 0x550000
	[0133.684] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xa76) returned 0x557fe8
	[0133.684] FreeEnvironmentStringsA (penv="=") returned 1
	[0133.685] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0
	[0135.268] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x19f694 | out: lpExitCode=0x19f694*=0x80) returned 1
	[0135.268] CloseHandle (hObject=0x9c) returned 1
	[0135.269] _vsnwprintf (in: _Buffer=0x19f77c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f69c | out: _Buffer="00000080") returned 8
	[0135.269] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1
	[0135.269] GetProcessHeap () returned 0x550000
	[0135.270] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x557fe8) returned 1
	[0135.270] GetEnvironmentStringsW () returned 0x55b2b0*
	[0135.270] GetProcessHeap () returned 0x550000
	[0135.270] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xa9c) returned 0x557fe8
	[0135.270] FreeEnvironmentStringsA (penv="=") returned 1
	[0135.270] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0135.270] GetProcessHeap () returned 0x550000
	[0135.271] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x557fe8) returned 1
	[0135.271] GetEnvironmentStringsW () returned 0x55b2b0*
	[0135.271] GetProcessHeap () returned 0x550000
	[0135.271] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xa9c) returned 0x557fe8
	[0135.271] FreeEnvironmentStringsA (penv="=") returned 1
	[0135.271] GetProcessHeap () returned 0x550000
	[0135.271] RtlFreeHeap (HeapHandle=0x550000, Flags=0x0, BaseAddress=0x55b150) returned 1
	[0135.271] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f728 | out: lpAttributeList=0x19f728) 
	[0135.271] _get_osfhandle (_FileHandle=1) returned 0x154
	[0135.271] SetConsoleMode (hConsoleHandle=0x154, dwMode=0x0) returned 0
	[0135.271] _get_osfhandle (_FileHandle=1) returned 0x154
	[0135.271] GetConsoleMode (in: hConsoleHandle=0x154, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0135.271] _get_osfhandle (_FileHandle=0) returned 0x150
	[0135.271] GetConsoleMode (in: hConsoleHandle=0x150, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0135.271] GetConsoleOutputCP () returned 0x1b5
	[0135.275] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0135.275] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0135.278] exit (_Code=128) 

Thread:
	id = 183
	os_tid = 0x1104


Process:
	id = "24"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\syswow64\\taskkill.exe"
	page_root = "0x477fe000"
	os_pid = "0x1108"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "23"
	os_parent_pid = "0x10fc"
	cmd_line = "taskkill  /f /im mydesktopqos.exe "
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 2047
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 2048
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 2049
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 2050
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 2051
	        start_va = 0xa0000
	          end_va = 0xdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 2052
	        start_va = 0xe0000
	          end_va = 0xe3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 2053
	        start_va = 0xf0000
	          end_va = 0xf0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 2054
	        start_va = 0x100000
	          end_va = 0x101fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 2055
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 2056
	        start_va = 0x13b0000
	          end_va = 0x13c5fff
	       monitored = 0
	     entry_point = 0x13bde80
	     region_type = mapped_file
	            name = "taskkill.exe"
	        filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe")

Region:
	              id = 2057
	        start_va = 0x13d0000
	          end_va = 0x53cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000013d0000"
	        filename = ""

Region:
	              id = 2058
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 2059
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 2060
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 2061
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 2062
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 2063
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 2064
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 2065
	        start_va = 0x500000
	          end_va = 0x50ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000500000"
	        filename = ""

Region:
	              id = 2066
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 2067
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 2068
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 2069
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 2070
	        start_va = 0x510000
	          end_va = 0x7dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000510000"
	        filename = ""

Region:
	              id = 2071
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 2072
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 2073
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 2074
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 2108
	        start_va = 0x110000
	          end_va = 0x1cdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 2109
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 2110
	        start_va = 0x74650000
	          end_va = 0x746cafff
	       monitored = 0
	     entry_point = 0x7466e970
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 2111
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 2112
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 2113
	        start_va = 0x440000
	          end_va = 0x47ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000440000"
	        filename = ""

Region:
	              id = 2114
	        start_va = 0x76ae0000
	          end_va = 0x76b23fff
	       monitored = 0
	     entry_point = 0x76af9d80
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 2115
	        start_va = 0x75260000
	          end_va = 0x7530cfff
	       monitored = 0
	     entry_point = 0x75274f00
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 2116
	        start_va = 0x74450000
	          end_va = 0x7446dfff
	       monitored = 0
	     entry_point = 0x7445b640
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 2117
	        start_va = 0x74440000
	          end_va = 0x74449fff
	       monitored = 0
	     entry_point = 0x74442a00
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 2118
	        start_va = 0x74590000
	          end_va = 0x745e7fff
	       monitored = 0
	     entry_point = 0x745d25c0
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 2119
	        start_va = 0x77450000
	          end_va = 0x77596fff
	       monitored = 0
	     entry_point = 0x77461cf0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 2120
	        start_va = 0x76b30000
	          end_va = 0x76c7efff
	       monitored = 0
	     entry_point = 0x76be6820
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 2123
	        start_va = 0x6cc90000
	          end_va = 0x6cc97fff
	       monitored = 0
	     entry_point = 0x6cc917b0
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 2124
	        start_va = 0x753c0000
	          end_va = 0x75451fff
	       monitored = 0
	     entry_point = 0x753f8cf0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 2125
	        start_va = 0x77290000
	          end_va = 0x7744cfff
	       monitored = 0
	     entry_point = 0x77372a10
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")

Region:
	              id = 2126
	        start_va = 0x75310000
	          end_va = 0x7536efff
	       monitored = 0
	     entry_point = 0x75314af0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 2127
	        start_va = 0x77240000
	          end_va = 0x77284fff
	       monitored = 0
	     entry_point = 0x7725de90
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 2128
	        start_va = 0x6cc70000
	          end_va = 0x6cc85fff
	       monitored = 0
	     entry_point = 0x6cc721d0
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")

Region:
	              id = 2129
	        start_va = 0x6cc30000
	          end_va = 0x6cc6efff
	       monitored = 0
	     entry_point = 0x6cc446c0
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll")

Region:
	              id = 2130
	        start_va = 0x6caf0000
	          end_va = 0x6cc2efff
	       monitored = 0
	     entry_point = 0x6cb1d880
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll")

Region:
	              id = 2131
	        start_va = 0x6cad0000
	          end_va = 0x6caebfff
	       monitored = 0
	     entry_point = 0x6cad4720
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")

Region:
	              id = 2132
	        start_va = 0x6cac0000
	          end_va = 0x6cac9fff
	       monitored = 0
	     entry_point = 0x6cac28d0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")

Region:
	              id = 2133
	        start_va = 0x510000
	          end_va = 0x62ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000510000"
	        filename = ""

Region:
	              id = 2134
	        start_va = 0x6e0000
	          end_va = 0x7dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006e0000"
	        filename = ""

Region:
	              id = 2143
	        start_va = 0x1d0000
	          end_va = 0x1f9fff
	       monitored = 0
	     entry_point = 0x1d5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 2144
	        start_va = 0x7e0000
	          end_va = 0x967fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000007e0000"
	        filename = ""

Region:
	              id = 2145
	        start_va = 0x74ea0000
	          end_va = 0x74ecafff
	       monitored = 0
	     entry_point = 0x74ea5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 2146
	        start_va = 0x970000
	          end_va = 0xaf0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000970000"
	        filename = ""

Region:
	              id = 2147
	        start_va = 0x53d0000
	          end_va = 0x67cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000053d0000"
	        filename = ""

Region:
	              id = 2148
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 2149
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001d0000"
	        filename = ""

Region:
	              id = 2150
	        start_va = 0x1e0000
	          end_va = 0x1e4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taskkill.exe.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui")

Region:
	              id = 2151
	        start_va = 0x1f0000
	          end_va = 0x1f0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001f0000"
	        filename = ""

Region:
	              id = 2152
	        start_va = 0x480000
	          end_va = 0x480fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 2153
	        start_va = 0xb00000
	          end_va = 0xe36fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 2154
	        start_va = 0x510000
	          end_va = 0x5f9fff
	       monitored = 0
	     entry_point = 0x54d650
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 2155
	        start_va = 0x620000
	          end_va = 0x62ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000620000"
	        filename = ""

Region:
	              id = 2156
	        start_va = 0x490000
	          end_va = 0x493fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000490000"
	        filename = ""

Region:
	              id = 2167
	        start_va = 0x510000
	          end_va = 0x5effff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 2168
	        start_va = 0x76e20000
	          end_va = 0x76e2bfff
	       monitored = 0
	     entry_point = 0x76e23930
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")

Region:
	              id = 2170
	        start_va = 0x4a0000
	          end_va = 0x4a0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004a0000"
	        filename = ""

Region:
	              id = 2171
	        start_va = 0x76c80000
	          end_va = 0x76d03fff
	       monitored = 0
	     entry_point = 0x76ca6220
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 2172
	        start_va = 0x4b0000
	          end_va = 0x4b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004b0000"
	        filename = ""

Region:
	              id = 2173
	        start_va = 0x6cab0000
	          end_va = 0x6cabcfff
	       monitored = 0
	     entry_point = 0x6cab3520
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 2174
	        start_va = 0x6ca40000
	          end_va = 0x6caa6fff
	       monitored = 0
	     entry_point = 0x6ca5b610
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 2175
	        start_va = 0x740f0000
	          end_va = 0x7410afff
	       monitored = 0
	     entry_point = 0x740f9050
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 2176
	        start_va = 0x6c9f0000
	          end_va = 0x6ca33fff
	       monitored = 0
	     entry_point = 0x6ca0aaf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")

Region:
	              id = 2177
	        start_va = 0x4c0000
	          end_va = 0x4fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004c0000"
	        filename = ""

Region:
	              id = 2178
	        start_va = 0x630000
	          end_va = 0x66ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000630000"
	        filename = ""

Region:
	              id = 2179
	        start_va = 0x670000
	          end_va = 0x6affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000670000"
	        filename = ""

Region:
	              id = 2180
	        start_va = 0xe40000
	          end_va = 0xe7ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e40000"
	        filename = ""

Region:
	              id = 2181
	        start_va = 0xe80000
	          end_va = 0xebffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e80000"
	        filename = ""

Region:
	              id = 2182
	        start_va = 0xec0000
	          end_va = 0xefffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ec0000"
	        filename = ""

Region:
	              id = 2183
	        start_va = 0x6c9d0000
	          end_va = 0x6c9e0fff
	       monitored = 0
	     entry_point = 0x6c9d8fa0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 2184
	        start_va = 0x6c910000
	          end_va = 0x6c9cefff
	       monitored = 0
	     entry_point = 0x6c941e80
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 2186
	        start_va = 0x5f0000
	          end_va = 0x5f5fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000005f0000"
	        filename = ""


Thread:
	id = 184
	os_tid = 0x110c


Thread:
	id = 187
	os_tid = 0x1118


Thread:
	id = 188
	os_tid = 0x111c


Thread:
	id = 189
	os_tid = 0x1120


Thread:
	id = 190
	os_tid = 0x1124


Process:
	id = "25"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x34c52000"
	os_pid = "0x1158"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x614"
	cmd_line = "cmd.exe /c \"taskkill /f /im agntsvc.exeisqlplussvc.exe \""
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 2197
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 2198
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 2199
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 2200
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 2201
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 2202
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 2203
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 2204
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 2205
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 2206
	        start_va = 0x13a0000
	          end_va = 0x13f1fff
	       monitored = 1
	     entry_point = 0x13b4fd0
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")

Region:
	              id = 2207
	        start_va = 0x1400000
	          end_va = 0x53fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001400000"
	        filename = ""

Region:
	              id = 2208
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 2209
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 2210
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 2211
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 2212
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 2213
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 2214
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 2215
	        start_va = 0x560000
	          end_va = 0x56ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000560000"
	        filename = ""

Region:
	              id = 2216
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 2217
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 2218
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 2219
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 2220
	        start_va = 0x570000
	          end_va = 0x84ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000570000"
	        filename = ""

Region:
	              id = 2221
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 2222
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 2223
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 2224
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 2225
	        start_va = 0x400000
	          end_va = 0x4bdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 2226
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 2227
	        start_va = 0x4c0000
	          end_va = 0x4fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004c0000"
	        filename = ""

Region:
	              id = 2228
	        start_va = 0x570000
	          end_va = 0x66ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000570000"
	        filename = ""

Region:
	              id = 2229
	        start_va = 0x750000
	          end_va = 0x84ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000750000"
	        filename = ""

Region:
	              id = 2230
	        start_va = 0x500000
	          end_va = 0x55ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000500000"
	        filename = ""

Region:
	              id = 2231
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 2232
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 2233
	        start_va = 0x850000
	          end_va = 0xb86fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 192
	os_tid = 0x115c

	[0138.562] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000
	[0138.562] __set_app_type (_Type=0x1) 
	[0138.562] __p__fmode () returned 0x74974d6c
	[0138.562] __p__commode () returned 0x74975b1c
	[0138.562] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13b5200) returned 0x0
	[0138.562] __getmainargs (in: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0, _DoWildCard=0, _StartInfo=0x13c60fc | out: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0) returned 0
	[0138.562] GetCurrentThreadId () returned 0x115c
	[0138.562] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x115c) returned 0x78
	[0138.563] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0138.563] GetProcAddress (hModule=0x75600000, lpProcName="SetThreadUILanguage") returned 0x75642510
	[0138.567] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0138.575] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0138.575] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2
	[0138.576] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0138.576] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0138.576] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0138.576] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0138.576] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0138.576] GetConsoleOutputCP () returned 0x1b5
	[0138.579] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0138.579] SetConsoleCtrlHandler (HandlerRoutine=0x13c0e40, Add=1) returned 1
	[0138.579] _get_osfhandle (_FileHandle=1) returned 0x150
	[0138.579] SetConsoleMode (hConsoleHandle=0x150, dwMode=0x0) returned 0
	[0138.579] _get_osfhandle (_FileHandle=1) returned 0x150
	[0138.580] GetConsoleMode (in: hConsoleHandle=0x150, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0138.580] _get_osfhandle (_FileHandle=0) returned 0x144
	[0138.580] GetConsoleMode (in: hConsoleHandle=0x144, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0138.580] GetEnvironmentStringsW () returned 0x757f80*
	[0138.580] GetProcessHeap () returned 0x750000
	[0138.580] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0xa1a) returned 0x7589a8
	[0138.580] FreeEnvironmentStringsA (penv="A") returned 1
	[0138.580] GetProcessHeap () returned 0x750000
	[0138.580] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x4) returned 0x752748
	[0138.580] GetEnvironmentStringsW () returned 0x757f80*
	[0138.580] GetProcessHeap () returned 0x750000
	[0138.580] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0xa1a) returned 0x7593d0
	[0138.580] FreeEnvironmentStringsA (penv="A") returned 1
	[0138.580] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0138.581] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0138.581] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0138.581] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0138.581] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0138.581] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0138.581] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0138.581] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0138.581] RegCloseKey (hKey=0x88) returned 0x0
	[0138.582] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0138.582] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0138.582] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0138.582] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0138.582] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0138.582] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0138.582] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0138.582] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0138.582] RegCloseKey (hKey=0x88) returned 0x0
	[0138.582] time (in: timer=0x0 | out: timer=0x0) returned 0x62344214
	[0138.582] srand (_Seed=0x62344214) 
	[0138.582] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im agntsvc.exeisqlplussvc.exe \""
	[0138.582] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im agntsvc.exeisqlplussvc.exe \""
	[0138.582] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0138.583] GetProcessHeap () returned 0x750000
	[0138.583] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x210) returned 0x7570a0
	[0138.583] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7570a8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0138.583] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0138.583] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0138.583] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0138.583] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0138.583] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0138.583] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0138.583] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0138.583] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0138.583] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0138.583] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0138.584] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0138.584] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0138.584] GetProcessHeap () returned 0x750000
	[0138.584] RtlFreeHeap (HeapHandle=0x750000, Flags=0x0, BaseAddress=0x7589a8) returned 1
	[0138.586] GetEnvironmentStringsW () returned 0x757f80*
	[0138.586] GetProcessHeap () returned 0x750000
	[0138.586] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0xa32) returned 0x75a838
	[0138.586] FreeEnvironmentStringsA (penv="A") returned 1
	[0138.586] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b
	[0138.586] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0138.586] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0138.586] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0138.586] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0138.586] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0138.586] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0138.586] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0138.586] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0138.586] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0138.587] GetProcessHeap () returned 0x750000
	[0138.587] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x44) returned 0x757e68
	[0138.587] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0138.587] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19fc4c*="Desktop") returned 0x1d
	[0138.587] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0138.587] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x7505c8
	[0138.589] FindClose (in: hFindFile=0x7505c8 | out: hFindFile=0x7505c8) returned 1
	[0138.589] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x7505c8
	[0138.590] FindClose (in: hFindFile=0x7505c8 | out: hFindFile=0x7505c8) returned 1
	[0138.590] _wcsnicmp (_String1="RDHJ0C~1", _String2="RDhJ0CNFevzX", _MaxCount=0xc) returned 16
	[0138.590] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x7505c8
	[0138.590] FindClose (in: hFindFile=0x7505c8 | out: hFindFile=0x7505c8) returned 1
	[0138.591] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0138.591] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1
	[0138.591] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 1
	[0138.591] GetProcessHeap () returned 0x750000
	[0138.591] RtlFreeHeap (HeapHandle=0x750000, Flags=0x0, BaseAddress=0x75a838) returned 1
	[0138.592] GetEnvironmentStringsW () returned 0x757f80*
	[0138.592] GetProcessHeap () returned 0x750000
	[0138.592] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0xa76) returned 0x759df8
	[0138.592] FreeEnvironmentStringsA (penv="=") returned 1
	[0138.592] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0138.592] GetProcessHeap () returned 0x750000
	[0138.592] RtlFreeHeap (HeapHandle=0x750000, Flags=0x0, BaseAddress=0x757e68) returned 1
	[0138.592] GetProcessHeap () returned 0x750000
	[0138.592] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x400e) returned 0x75bcf8
	[0138.593] GetProcessHeap () returned 0x750000
	[0138.593] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x68) returned 0x757e68
	[0138.593] GetProcessHeap () returned 0x750000
	[0138.593] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x4008) returned 0x75fd10
	[0138.594] GetProcessHeap () returned 0x750000
	[0138.594] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x4008) returned 0x763d20
	[0138.595] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0138.596] GetProcessHeap () returned 0x750000
	[0138.596] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x418) returned 0x75a878
	[0138.596] SetErrorMode (uMode=0x0) returned 0x8003
	[0138.596] SetErrorMode (uMode=0x1) returned 0x0
	[0138.596] GetFullPathNameW (in: lpFileName="taskkill \\f \\.", nBufferLength=0x208, lpBuffer=0x75a880, lpFilePart=0x19fbac | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f", lpFilePart=0x19fbac*="f") returned 0x29
	[0138.596] SetErrorMode (uMode=0x8003) returned 0x1
	[0138.596] GetProcessHeap () returned 0x750000
	[0138.596] RtlReAllocateHeap (Heap=0x750000, Flags=0x0, Ptr=0x75a878, Size=0x9a) returned 0x75a878
	[0138.596] GetProcessHeap () returned 0x750000
	[0138.597] RtlSizeHeap (HeapHandle=0x750000, Flags=0x0, MemoryPointer=0x75a878) returned 0x9a
	[0138.597] NeedCurrentDirectoryForExePathW (ExeName="taskkill \\f \\.") returned 1
	[0138.597] GetProcessHeap () returned 0x750000
	[0138.597] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x62) returned 0x75a920
	[0138.597] GetProcessHeap () returned 0x750000
	[0138.597] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0xb8) returned 0x75a990
	[0138.597] GetProcessHeap () returned 0x750000
	[0138.597] RtlReAllocateHeap (Heap=0x750000, Flags=0x0, Ptr=0x75a990, Size=0x62) returned 0x75a990
	[0138.597] GetProcessHeap () returned 0x750000
	[0138.597] RtlSizeHeap (HeapHandle=0x750000, Flags=0x0, MemoryPointer=0x75a990) returned 0x62
	[0138.597] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0138.597] GetProcessHeap () returned 0x750000
	[0138.597] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0xe0) returned 0x75aa00
	[0138.603] GetProcessHeap () returned 0x750000
	[0138.603] RtlReAllocateHeap (Heap=0x750000, Flags=0x0, Ptr=0x75aa00, Size=0x76) returned 0x75aa00
	[0138.603] GetProcessHeap () returned 0x750000
	[0138.603] RtlSizeHeap (HeapHandle=0x750000, Flags=0x0, MemoryPointer=0x75aa00) returned 0x76
	[0138.603] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0138.603] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f\\im agntsvc.exeisqlplussvc.exe ", fInfoLevelId=0x1, lpFindFileData=0x19f958, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f958) returned 0xffffffff
	[0138.604] GetLastError () returned 0x3
	[0138.604] GetProcessHeap () returned 0x750000
	[0138.604] RtlFreeHeap (HeapHandle=0x750000, Flags=0x0, BaseAddress=0x75fd10) returned 1
	[0138.604] GetProcessHeap () returned 0x750000
	[0138.605] RtlFreeHeap (HeapHandle=0x750000, Flags=0x0, BaseAddress=0x763d20) returned 1
	[0138.605] GetProcessHeap () returned 0x750000
	[0138.605] RtlFreeHeap (HeapHandle=0x750000, Flags=0x0, BaseAddress=0x75bcf8) returned 1
	[0138.605] GetConsoleOutputCP () returned 0x1b5
	[0138.616] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0138.616] GetUserDefaultLCID () returned 0x409
	[0138.617] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x13d34a0, cchData=8 | out: lpLCData=":") returned 2
	[0138.617] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0138.617] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0138.617] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2
	[0138.617] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x13d34b0, cchData=8 | out: lpLCData="/") returned 2
	[0138.617] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x13d3500, cchData=32 | out: lpLCData="Mon") returned 4
	[0138.617] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x13d3540, cchData=32 | out: lpLCData="Tue") returned 4
	[0138.617] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x13d3580, cchData=32 | out: lpLCData="Wed") returned 4
	[0138.617] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x13d35c0, cchData=32 | out: lpLCData="Thu") returned 4
	[0138.617] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x13d3600, cchData=32 | out: lpLCData="Fri") returned 4
	[0138.617] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x13d3640, cchData=32 | out: lpLCData="Sat") returned 4
	[0138.618] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x13d3680, cchData=32 | out: lpLCData="Sun") returned 4
	[0138.618] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x13d34c0, cchData=8 | out: lpLCData=".") returned 2
	[0138.618] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x13d34e0, cchData=8 | out: lpLCData=",") returned 2
	[0138.618] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0138.620] GetProcessHeap () returned 0x750000
	[0138.620] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x20c) returned 0x75aac8
	[0138.620] GetConsoleTitleW (in: lpConsoleTitle=0x75aac8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0138.624] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0138.624] GetProcAddress (hModule=0x75600000, lpProcName="CopyFileExW") returned 0x7561ffc0
	[0138.624] GetProcAddress (hModule=0x75600000, lpProcName="IsDebuggerPresent") returned 0x7561b0b0
	[0138.624] GetProcAddress (hModule=0x75600000, lpProcName="SetConsoleInputExeNameW") returned 0x7559b440
	[0138.625] GetProcessHeap () returned 0x750000
	[0138.625] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x400a) returned 0x75bcf8
	[0138.625] GetProcessHeap () returned 0x750000
	[0138.626] RtlFreeHeap (HeapHandle=0x750000, Flags=0x0, BaseAddress=0x75bcf8) returned 1
	[0138.626] _wcsicmp (_String1="taskkill", _String2=")") returned 75
	[0138.627] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14
	[0138.627] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14
	[0138.627] _wcsicmp (_String1="IF", _String2="taskkill") returned -11
	[0138.627] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11
	[0138.627] _wcsicmp (_String1="REM", _String2="taskkill") returned -2
	[0138.627] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2
	[0138.627] GetProcessHeap () returned 0x750000
	[0138.627] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x58) returned 0x75ace0
	[0138.627] GetProcessHeap () returned 0x750000
	[0138.627] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x1a) returned 0x75ad40
	[0138.628] GetProcessHeap () returned 0x750000
	[0138.628] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x50) returned 0x75ad68
	[0138.629] GetConsoleTitleW (in: lpConsoleTitle=0x19fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0138.633] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0138.633] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0138.633] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0138.633] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0138.633] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0138.634] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0138.634] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0138.634] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0138.634] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0138.634] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0138.634] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0138.634] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0138.634] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0138.634] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0138.634] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0138.634] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0138.634] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0138.634] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0138.634] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0138.634] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0138.634] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0138.634] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0138.634] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0138.634] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0138.634] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0138.634] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0138.634] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0138.634] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0138.635] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0138.635] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0138.635] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0138.635] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0138.635] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0138.635] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0138.635] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0138.635] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0138.635] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0138.635] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0138.635] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0138.635] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0138.635] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0138.635] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0138.635] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0138.635] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0138.635] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0138.635] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0138.635] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0138.635] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0138.635] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0138.635] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0138.635] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0138.636] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0138.636] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0138.636] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0138.636] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0138.636] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0138.636] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0138.636] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0138.636] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0138.636] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0138.636] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0138.636] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0138.636] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0138.636] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0138.636] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0138.636] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0138.636] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0138.636] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0138.636] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0138.636] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0138.636] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0138.636] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0138.636] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0138.636] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0138.636] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0138.636] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0138.636] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0138.637] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0138.637] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0138.637] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0138.637] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0138.637] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0138.637] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0138.637] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0138.637] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14
	[0138.637] _wcsicmp (_String1="taskkill", _String2="IF") returned 11
	[0138.637] _wcsicmp (_String1="taskkill", _String2="REM") returned 2
	[0138.637] GetProcessHeap () returned 0x750000
	[0138.637] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x210) returned 0x75adc0
	[0138.637] GetProcessHeap () returned 0x750000
	[0138.637] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x62) returned 0x75afd8
	[0138.638] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0138.638] GetProcessHeap () returned 0x750000
	[0138.638] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x418) returned 0x7505c8
	[0138.638] SetErrorMode (uMode=0x0) returned 0x8003
	[0138.638] SetErrorMode (uMode=0x1) returned 0x0
	[0138.638] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x7505d0, lpFilePart=0x19f57c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19f57c*="Desktop") returned 0x1d
	[0138.638] SetErrorMode (uMode=0x8003) returned 0x1
	[0138.638] GetProcessHeap () returned 0x750000
	[0138.638] RtlReAllocateHeap (Heap=0x750000, Flags=0x0, Ptr=0x7505c8, Size=0x56) returned 0x7505c8
	[0138.639] GetProcessHeap () returned 0x750000
	[0138.639] RtlSizeHeap (HeapHandle=0x750000, Flags=0x0, MemoryPointer=0x7505c8) returned 0x56
	[0138.639] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0138.639] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0138.639] GetProcessHeap () returned 0x750000
	[0138.639] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x110) returned 0x75b048
	[0138.639] GetProcessHeap () returned 0x750000
	[0138.639] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x218) returned 0x750628
	[0138.645] GetProcessHeap () returned 0x750000
	[0138.645] RtlReAllocateHeap (Heap=0x750000, Flags=0x0, Ptr=0x750628, Size=0x112) returned 0x750628
	[0138.645] GetProcessHeap () returned 0x750000
	[0138.645] RtlSizeHeap (HeapHandle=0x750000, Flags=0x0, MemoryPointer=0x750628) returned 0x112
	[0138.646] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0138.646] GetProcessHeap () returned 0x750000
	[0138.646] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0xe0) returned 0x75b160
	[0138.648] GetProcessHeap () returned 0x750000
	[0138.648] RtlReAllocateHeap (Heap=0x750000, Flags=0x0, Ptr=0x75b160, Size=0x76) returned 0x75b160
	[0138.648] GetProcessHeap () returned 0x750000
	[0138.648] RtlSizeHeap (HeapHandle=0x750000, Flags=0x0, MemoryPointer=0x75b160) returned 0x76
	[0138.648] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0138.648] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0138.649] GetLastError () returned 0x2
	[0138.649] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0138.649] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x75b1e0
	[0138.649] GetProcessHeap () returned 0x750000
	[0138.649] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x0, Size=0x14) returned 0x757810
	[0138.649] FindClose (in: hFindFile=0x75b1e0 | out: hFindFile=0x75b1e0) returned 1
	[0138.650] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0138.650] GetLastError () returned 0x2
	[0138.650] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x75b1e0
	[0138.650] GetProcessHeap () returned 0x750000
	[0138.650] RtlReAllocateHeap (Heap=0x750000, Flags=0x0, Ptr=0x757810, Size=0x4) returned 0x757ed8
	[0138.650] FindClose (in: hFindFile=0x75b1e0 | out: hFindFile=0x75b1e0) returned 1
	[0138.650] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0138.650] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0138.650] GetConsoleTitleW (in: lpConsoleTitle=0x19f7fc, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0138.652] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f728, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f70c | out: lpAttributeList=0x19f728, lpSize=0x19f70c) returned 1
	[0138.652] UpdateProcThreadAttribute (in: lpAttributeList=0x19f728, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f714, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f728, lpPreviousValue=0x0) returned 1
	[0138.652] GetStartupInfoW (in: lpStartupInfo=0x19f760 | out: lpStartupInfo=0x19f760*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x144, hStdOutput=0x150, hStdError=0x154)) 
	[0138.652] GetProcessHeap () returned 0x750000
	[0138.652] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0x18) returned 0x7577d0
	[0138.652] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0138.652] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0138.652] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0138.653] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0138.653] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0138.653] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0138.653] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0138.653] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0138.653] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0138.653] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0138.653] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0138.653] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0138.653] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0138.653] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0138.653] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0138.653] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0138.653] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0138.653] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0138.653] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0138.653] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0138.653] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0138.653] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0138.653] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0138.653] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0138.653] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0138.654] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0138.654] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0138.654] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0138.654] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0138.654] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0138.654] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0138.654] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0138.654] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0138.654] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0138.654] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0138.654] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0138.654] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0138.654] GetProcessHeap () returned 0x750000
	[0138.654] RtlFreeHeap (HeapHandle=0x750000, Flags=0x0, BaseAddress=0x7577d0) returned 1
	[0138.654] GetProcessHeap () returned 0x750000
	[0138.654] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0xa) returned 0x7572b8
	[0138.654] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1
	[0138.658] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill  /f /im agntsvc.exeisqlplussvc.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x19f6b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill  /f /im agntsvc.exeisqlplussvc.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f6fc | out: lpCommandLine="taskkill  /f /im agntsvc.exeisqlplussvc.exe ", lpProcessInformation=0x19f6fc*(hProcess=0x9c, hThread=0x98, dwProcessId=0x1178, dwThreadId=0x118c)) returned 1
	[0138.681] CloseHandle (hObject=0x98) returned 1
	[0138.681] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0138.681] GetProcessHeap () returned 0x750000
	[0138.682] RtlFreeHeap (HeapHandle=0x750000, Flags=0x0, BaseAddress=0x759df8) returned 1
	[0138.682] GetEnvironmentStringsW () returned 0x759df8*
	[0138.682] GetProcessHeap () returned 0x750000
	[0138.682] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0xa76) returned 0x757f80
	[0138.682] FreeEnvironmentStringsA (penv="=") returned 1
	[0138.682] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0
	[0140.115] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x19f694 | out: lpExitCode=0x19f694*=0x80) returned 1
	[0140.116] CloseHandle (hObject=0x9c) returned 1
	[0140.116] _vsnwprintf (in: _Buffer=0x19f77c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f69c | out: _Buffer="00000080") returned 8
	[0140.117] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1
	[0140.117] GetProcessHeap () returned 0x750000
	[0140.118] RtlFreeHeap (HeapHandle=0x750000, Flags=0x0, BaseAddress=0x757f80) returned 1
	[0140.118] GetEnvironmentStringsW () returned 0x75b1f8*
	[0140.118] GetProcessHeap () returned 0x750000
	[0140.118] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0xa9c) returned 0x757f80
	[0140.118] FreeEnvironmentStringsA (penv="=") returned 1
	[0140.118] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0140.118] GetProcessHeap () returned 0x750000
	[0140.118] RtlFreeHeap (HeapHandle=0x750000, Flags=0x0, BaseAddress=0x757f80) returned 1
	[0140.118] GetEnvironmentStringsW () returned 0x75b1f8*
	[0140.118] GetProcessHeap () returned 0x750000
	[0140.119] RtlAllocateHeap (HeapHandle=0x750000, Flags=0x8, Size=0xa9c) returned 0x757f80
	[0140.119] FreeEnvironmentStringsA (penv="=") returned 1
	[0140.119] GetProcessHeap () returned 0x750000
	[0140.119] RtlFreeHeap (HeapHandle=0x750000, Flags=0x0, BaseAddress=0x7572b8) returned 1
	[0140.119] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f728 | out: lpAttributeList=0x19f728) 
	[0140.119] _get_osfhandle (_FileHandle=1) returned 0x150
	[0140.119] SetConsoleMode (hConsoleHandle=0x150, dwMode=0x0) returned 0
	[0140.119] _get_osfhandle (_FileHandle=1) returned 0x150
	[0140.119] GetConsoleMode (in: hConsoleHandle=0x150, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0140.119] _get_osfhandle (_FileHandle=0) returned 0x144
	[0140.119] GetConsoleMode (in: hConsoleHandle=0x144, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0140.119] GetConsoleOutputCP () returned 0x1b5
	[0140.143] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0140.143] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0140.146] exit (_Code=128) 

Thread:
	id = 193
	os_tid = 0x1174


Process:
	id = "26"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\syswow64\\taskkill.exe"
	page_root = "0x1a4ca000"
	os_pid = "0x1178"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "25"
	os_parent_pid = "0x1158"
	cmd_line = "taskkill  /f /im agntsvc.exeisqlplussvc.exe "
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 2234
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 2235
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 2236
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 2237
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 2238
	        start_va = 0xa0000
	          end_va = 0xdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 2239
	        start_va = 0xe0000
	          end_va = 0xe3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 2240
	        start_va = 0xf0000
	          end_va = 0xf0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 2241
	        start_va = 0x100000
	          end_va = 0x101fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 2242
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 2243
	        start_va = 0x13b0000
	          end_va = 0x13c5fff
	       monitored = 0
	     entry_point = 0x13bde80
	     region_type = mapped_file
	            name = "taskkill.exe"
	        filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe")

Region:
	              id = 2244
	        start_va = 0x13d0000
	          end_va = 0x53cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000013d0000"
	        filename = ""

Region:
	              id = 2245
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 2246
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 2247
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 2248
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 2249
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 2250
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 2251
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 2252
	        start_va = 0x4f0000
	          end_va = 0x4fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004f0000"
	        filename = ""

Region:
	              id = 2253
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 2254
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 2255
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 2256
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 2257
	        start_va = 0x500000
	          end_va = 0x69ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000500000"
	        filename = ""

Region:
	              id = 2258
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 2259
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 2260
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 2261
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 2262
	        start_va = 0x110000
	          end_va = 0x1cdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 2263
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 2264
	        start_va = 0x74650000
	          end_va = 0x746cafff
	       monitored = 0
	     entry_point = 0x7466e970
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 2265
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 2266
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 2267
	        start_va = 0x440000
	          end_va = 0x47ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000440000"
	        filename = ""

Region:
	              id = 2268
	        start_va = 0x76ae0000
	          end_va = 0x76b23fff
	       monitored = 0
	     entry_point = 0x76af9d80
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 2269
	        start_va = 0x75260000
	          end_va = 0x7530cfff
	       monitored = 0
	     entry_point = 0x75274f00
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 2270
	        start_va = 0x74450000
	          end_va = 0x7446dfff
	       monitored = 0
	     entry_point = 0x7445b640
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 2271
	        start_va = 0x74440000
	          end_va = 0x74449fff
	       monitored = 0
	     entry_point = 0x74442a00
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 2272
	        start_va = 0x74590000
	          end_va = 0x745e7fff
	       monitored = 0
	     entry_point = 0x745d25c0
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 2273
	        start_va = 0x77450000
	          end_va = 0x77596fff
	       monitored = 0
	     entry_point = 0x77461cf0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 2274
	        start_va = 0x76b30000
	          end_va = 0x76c7efff
	       monitored = 0
	     entry_point = 0x76be6820
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 2275
	        start_va = 0x753c0000
	          end_va = 0x75451fff
	       monitored = 0
	     entry_point = 0x753f8cf0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 2276
	        start_va = 0x77290000
	          end_va = 0x7744cfff
	       monitored = 0
	     entry_point = 0x77372a10
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")

Region:
	              id = 2277
	        start_va = 0x75310000
	          end_va = 0x7536efff
	       monitored = 0
	     entry_point = 0x75314af0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 2278
	        start_va = 0x6cc90000
	          end_va = 0x6cc97fff
	       monitored = 0
	     entry_point = 0x6cc917b0
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 2279
	        start_va = 0x6cc70000
	          end_va = 0x6cc85fff
	       monitored = 0
	     entry_point = 0x6cc721d0
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")

Region:
	              id = 2280
	        start_va = 0x77240000
	          end_va = 0x77284fff
	       monitored = 0
	     entry_point = 0x7725de90
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 2281
	        start_va = 0x6cc30000
	          end_va = 0x6cc6efff
	       monitored = 0
	     entry_point = 0x6cc446c0
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll")

Region:
	              id = 2282
	        start_va = 0x6caf0000
	          end_va = 0x6cc2efff
	       monitored = 0
	     entry_point = 0x6cb1d880
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll")

Region:
	              id = 2283
	        start_va = 0x6cad0000
	          end_va = 0x6caebfff
	       monitored = 0
	     entry_point = 0x6cad4720
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")

Region:
	              id = 2284
	        start_va = 0x6cac0000
	          end_va = 0x6cac9fff
	       monitored = 0
	     entry_point = 0x6cac28d0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")

Region:
	              id = 2285
	        start_va = 0x1d0000
	          end_va = 0x1fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001d0000"
	        filename = ""

Region:
	              id = 2286
	        start_va = 0x480000
	          end_va = 0x4a9fff
	       monitored = 0
	     entry_point = 0x485680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 2287
	        start_va = 0x6a0000
	          end_va = 0x827fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000006a0000"
	        filename = ""

Region:
	              id = 2288
	        start_va = 0x74ea0000
	          end_va = 0x74ecafff
	       monitored = 0
	     entry_point = 0x74ea5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 2289
	        start_va = 0x830000
	          end_va = 0x9b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000830000"
	        filename = ""

Region:
	              id = 2290
	        start_va = 0x53d0000
	          end_va = 0x67cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000053d0000"
	        filename = ""

Region:
	              id = 2291
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 2292
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001d0000"
	        filename = ""

Region:
	              id = 2293
	        start_va = 0x1e0000
	          end_va = 0x1e4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taskkill.exe.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui")

Region:
	              id = 2294
	        start_va = 0x1f0000
	          end_va = 0x1fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001f0000"
	        filename = ""

Region:
	              id = 2295
	        start_va = 0x480000
	          end_va = 0x480fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 2296
	        start_va = 0x490000
	          end_va = 0x490fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000490000"
	        filename = ""

Region:
	              id = 2297
	        start_va = 0x9c0000
	          end_va = 0xcf6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 2298
	        start_va = 0xd00000
	          end_va = 0xde9fff
	       monitored = 0
	     entry_point = 0xd3d650
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 2299
	        start_va = 0x4a0000
	          end_va = 0x4a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004a0000"
	        filename = ""

Region:
	              id = 2300
	        start_va = 0xd00000
	          end_va = 0xddffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 2301
	        start_va = 0x76e20000
	          end_va = 0x76e2bfff
	       monitored = 0
	     entry_point = 0x76e23930
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")

Region:
	              id = 2302
	        start_va = 0x4b0000
	          end_va = 0x4b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004b0000"
	        filename = ""

Region:
	              id = 2303
	        start_va = 0x76c80000
	          end_va = 0x76d03fff
	       monitored = 0
	     entry_point = 0x76ca6220
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 2304
	        start_va = 0x4c0000
	          end_va = 0x4c0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004c0000"
	        filename = ""

Region:
	              id = 2305
	        start_va = 0x6cab0000
	          end_va = 0x6cabcfff
	       monitored = 0
	     entry_point = 0x6cab3520
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 2306
	        start_va = 0x6ca40000
	          end_va = 0x6caa6fff
	       monitored = 0
	     entry_point = 0x6ca5b610
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 2307
	        start_va = 0x740f0000
	          end_va = 0x7410afff
	       monitored = 0
	     entry_point = 0x740f9050
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 2308
	        start_va = 0x6c9f0000
	          end_va = 0x6ca33fff
	       monitored = 0
	     entry_point = 0x6ca0aaf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")

Region:
	              id = 2309
	        start_va = 0x500000
	          end_va = 0x53ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000500000"
	        filename = ""

Region:
	              id = 2310
	        start_va = 0x540000
	          end_va = 0x57ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000540000"
	        filename = ""

Region:
	              id = 2311
	        start_va = 0x5a0000
	          end_va = 0x69ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005a0000"
	        filename = ""

Region:
	              id = 2312
	        start_va = 0xde0000
	          end_va = 0xe1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000de0000"
	        filename = ""

Region:
	              id = 2313
	        start_va = 0xe20000
	          end_va = 0xe5ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e20000"
	        filename = ""

Region:
	              id = 2314
	        start_va = 0xe60000
	          end_va = 0xe9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e60000"
	        filename = ""

Region:
	              id = 2315
	        start_va = 0xea0000
	          end_va = 0xedffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ea0000"
	        filename = ""

Region:
	              id = 2316
	        start_va = 0x6c9d0000
	          end_va = 0x6c9e0fff
	       monitored = 0
	     entry_point = 0x6c9d8fa0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 2317
	        start_va = 0x6c910000
	          end_va = 0x6c9cefff
	       monitored = 0
	     entry_point = 0x6c941e80
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 2319
	        start_va = 0x4d0000
	          end_va = 0x4d5fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004d0000"
	        filename = ""


Thread:
	id = 194
	os_tid = 0x118c


Thread:
	id = 195
	os_tid = 0x11a0


Thread:
	id = 196
	os_tid = 0x11a4


Thread:
	id = 197
	os_tid = 0x11b8


Thread:
	id = 198
	os_tid = 0x11bc


Process:
	id = "27"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x1512a000"
	os_pid = "0x11d4"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x614"
	cmd_line = "cmd.exe /c \"taskkill /f /im xfssvccon.exe \""
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 2323
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 2324
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 2325
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 2326
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 2327
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 2328
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 2329
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 2330
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 2331
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 2332
	        start_va = 0x13a0000
	          end_va = 0x13f1fff
	       monitored = 1
	     entry_point = 0x13b4fd0
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")

Region:
	              id = 2333
	        start_va = 0x1400000
	          end_va = 0x53fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001400000"
	        filename = ""

Region:
	              id = 2334
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 2335
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 2336
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 2337
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 2338
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 2339
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 2340
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 2341
	        start_va = 0x1f0000
	          end_va = 0x1fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001f0000"
	        filename = ""

Region:
	              id = 2342
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 2343
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 2344
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 2345
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 2346
	        start_va = 0x400000
	          end_va = 0x61ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 2347
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 2348
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 2349
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 2350
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 2351
	        start_va = 0x400000
	          end_va = 0x4bdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 2352
	        start_va = 0x520000
	          end_va = 0x61ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000520000"
	        filename = ""

Region:
	              id = 2353
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 2354
	        start_va = 0x4c0000
	          end_va = 0x4fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004c0000"
	        filename = ""

Region:
	              id = 2355
	        start_va = 0x620000
	          end_va = 0x71ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000620000"
	        filename = ""

Region:
	              id = 2356
	        start_va = 0x720000
	          end_va = 0x78ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000720000"
	        filename = ""

Region:
	              id = 2357
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 2358
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 2359
	        start_va = 0x790000
	          end_va = 0xac6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 199
	os_tid = 0x11d8

	[0140.580] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000
	[0140.580] __set_app_type (_Type=0x1) 
	[0140.580] __p__fmode () returned 0x74974d6c
	[0140.582] __p__commode () returned 0x74975b1c
	[0140.582] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13b5200) returned 0x0
	[0140.582] __getmainargs (in: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0, _DoWildCard=0, _StartInfo=0x13c60fc | out: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0) returned 0
	[0140.583] GetCurrentThreadId () returned 0x11d8
	[0140.583] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x11d8) returned 0x78
	[0140.583] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0140.583] GetProcAddress (hModule=0x75600000, lpProcName="SetThreadUILanguage") returned 0x75642510
	[0140.583] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0140.588] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0140.588] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2
	[0140.588] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0140.588] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0140.588] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0140.588] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0140.588] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0140.588] GetConsoleOutputCP () returned 0x1b5
	[0140.589] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0140.590] SetConsoleCtrlHandler (HandlerRoutine=0x13c0e40, Add=1) returned 1
	[0140.590] _get_osfhandle (_FileHandle=1) returned 0x144
	[0140.590] SetConsoleMode (hConsoleHandle=0x144, dwMode=0x0) returned 0
	[0140.590] _get_osfhandle (_FileHandle=1) returned 0x144
	[0140.590] GetConsoleMode (in: hConsoleHandle=0x144, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0140.590] _get_osfhandle (_FileHandle=0) returned 0x140
	[0140.590] GetConsoleMode (in: hConsoleHandle=0x140, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0140.590] GetEnvironmentStringsW () returned 0x527fe8*
	[0140.590] GetProcessHeap () returned 0x520000
	[0140.590] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xa1a) returned 0x528a10
	[0140.591] FreeEnvironmentStringsA (penv="A") returned 1
	[0140.591] GetProcessHeap () returned 0x520000
	[0140.591] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x4) returned 0x523418
	[0140.591] GetEnvironmentStringsW () returned 0x527fe8*
	[0140.591] GetProcessHeap () returned 0x520000
	[0140.591] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xa1a) returned 0x529438
	[0140.591] FreeEnvironmentStringsA (penv="A") returned 1
	[0140.591] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0140.591] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0140.591] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0140.591] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0140.592] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0140.592] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0140.592] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0140.592] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0140.592] RegCloseKey (hKey=0x88) returned 0x0
	[0140.592] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0140.592] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0140.592] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0140.592] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0140.592] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0140.592] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0140.593] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0140.593] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0140.593] RegCloseKey (hKey=0x88) returned 0x0
	[0140.593] time (in: timer=0x0 | out: timer=0x0) returned 0x62344216
	[0140.593] srand (_Seed=0x62344216) 
	[0140.593] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im xfssvccon.exe \""
	[0140.593] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im xfssvccon.exe \""
	[0140.593] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0140.593] GetProcessHeap () returned 0x520000
	[0140.593] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x210) returned 0x526fb8
	[0140.593] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x526fc0, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0140.593] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0140.593] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0140.594] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0140.594] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0140.594] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0140.594] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0140.594] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0140.594] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0140.594] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0140.594] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0140.594] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0140.594] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0140.594] GetProcessHeap () returned 0x520000
	[0140.595] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x528a10) returned 1
	[0140.595] GetEnvironmentStringsW () returned 0x527fe8*
	[0140.595] GetProcessHeap () returned 0x520000
	[0140.595] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xa32) returned 0x52a8a0
	[0140.595] FreeEnvironmentStringsA (penv="A") returned 1
	[0140.596] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b
	[0140.596] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0140.596] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0140.596] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0140.596] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0140.596] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0140.596] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0140.596] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0140.596] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0140.596] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0140.596] GetProcessHeap () returned 0x520000
	[0140.596] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x44) returned 0x527e68
	[0140.596] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0140.596] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19fc4c*="Desktop") returned 0x1d
	[0140.597] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0140.597] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x5271d0
	[0140.597] FindClose (in: hFindFile=0x5271d0 | out: hFindFile=0x5271d0) returned 1
	[0140.597] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x5271d0
	[0140.599] FindClose (in: hFindFile=0x5271d0 | out: hFindFile=0x5271d0) returned 1
	[0140.599] _wcsnicmp (_String1="RDHJ0C~1", _String2="RDhJ0CNFevzX", _MaxCount=0xc) returned 16
	[0140.599] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x5271d0
	[0140.599] FindClose (in: hFindFile=0x5271d0 | out: hFindFile=0x5271d0) returned 1
	[0140.599] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0140.599] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1
	[0140.600] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 1
	[0140.600] GetProcessHeap () returned 0x520000
	[0140.600] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x52a8a0) returned 1
	[0140.600] GetEnvironmentStringsW () returned 0x527fe8*
	[0140.600] GetProcessHeap () returned 0x520000
	[0140.600] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xa76) returned 0x529e60
	[0140.600] FreeEnvironmentStringsA (penv="=") returned 1
	[0140.600] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0140.601] GetProcessHeap () returned 0x520000
	[0140.601] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x527e68) returned 1
	[0140.601] GetProcessHeap () returned 0x520000
	[0140.601] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x400e) returned 0x52bd60
	[0140.602] GetProcessHeap () returned 0x520000
	[0140.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x4e) returned 0x527e68
	[0140.602] GetProcessHeap () returned 0x520000
	[0140.602] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x4008) returned 0x52fd78
	[0140.603] GetProcessHeap () returned 0x520000
	[0140.603] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x4008) returned 0x533d88
	[0140.606] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0140.606] GetProcessHeap () returned 0x520000
	[0140.606] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x418) returned 0x52a8e0
	[0140.607] SetErrorMode (uMode=0x0) returned 0x8003
	[0140.607] SetErrorMode (uMode=0x1) returned 0x0
	[0140.607] GetFullPathNameW (in: lpFileName="taskkill \\f \\.", nBufferLength=0x208, lpBuffer=0x52a8e8, lpFilePart=0x19fbac | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f", lpFilePart=0x19fbac*="f") returned 0x29
	[0140.607] SetErrorMode (uMode=0x8003) returned 0x1
	[0140.607] GetProcessHeap () returned 0x520000
	[0140.607] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x52a8e0, Size=0x80) returned 0x52a8e0
	[0140.607] GetProcessHeap () returned 0x520000
	[0140.607] RtlSizeHeap (HeapHandle=0x520000, Flags=0x0, MemoryPointer=0x52a8e0) returned 0x80
	[0140.607] NeedCurrentDirectoryForExePathW (ExeName="taskkill \\f \\.") returned 1
	[0140.607] GetProcessHeap () returned 0x520000
	[0140.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x62) returned 0x5271d0
	[0140.607] GetProcessHeap () returned 0x520000
	[0140.607] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xb8) returned 0x52a968
	[0140.607] GetProcessHeap () returned 0x520000
	[0140.608] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x52a968, Size=0x62) returned 0x52a968
	[0140.608] GetProcessHeap () returned 0x520000
	[0140.608] RtlSizeHeap (HeapHandle=0x520000, Flags=0x0, MemoryPointer=0x52a968) returned 0x62
	[0140.608] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0140.608] GetProcessHeap () returned 0x520000
	[0140.608] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xe0) returned 0x52a9d8
	[0140.612] GetProcessHeap () returned 0x520000
	[0140.612] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x52a9d8, Size=0x76) returned 0x52a9d8
	[0140.612] GetProcessHeap () returned 0x520000
	[0140.612] RtlSizeHeap (HeapHandle=0x520000, Flags=0x0, MemoryPointer=0x52a9d8) returned 0x76
	[0140.612] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0140.612] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f\\im xfssvccon.exe ", fInfoLevelId=0x1, lpFindFileData=0x19f958, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f958) returned 0xffffffff
	[0140.613] GetLastError () returned 0x3
	[0140.613] GetProcessHeap () returned 0x520000
	[0140.613] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x52fd78) returned 1
	[0140.613] GetProcessHeap () returned 0x520000
	[0140.614] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x533d88) returned 1
	[0140.614] GetProcessHeap () returned 0x520000
	[0140.614] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x52bd60) returned 1
	[0140.614] GetConsoleOutputCP () returned 0x1b5
	[0140.616] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0140.616] GetUserDefaultLCID () returned 0x409
	[0140.617] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x13d34a0, cchData=8 | out: lpLCData=":") returned 2
	[0140.617] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0140.617] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0140.617] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2
	[0140.617] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x13d34b0, cchData=8 | out: lpLCData="/") returned 2
	[0140.617] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x13d3500, cchData=32 | out: lpLCData="Mon") returned 4
	[0140.617] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x13d3540, cchData=32 | out: lpLCData="Tue") returned 4
	[0140.617] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x13d3580, cchData=32 | out: lpLCData="Wed") returned 4
	[0140.618] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x13d35c0, cchData=32 | out: lpLCData="Thu") returned 4
	[0140.618] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x13d3600, cchData=32 | out: lpLCData="Fri") returned 4
	[0140.618] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x13d3640, cchData=32 | out: lpLCData="Sat") returned 4
	[0140.618] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x13d3680, cchData=32 | out: lpLCData="Sun") returned 4
	[0140.618] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x13d34c0, cchData=8 | out: lpLCData=".") returned 2
	[0140.618] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x13d34e0, cchData=8 | out: lpLCData=",") returned 2
	[0140.618] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0140.621] GetProcessHeap () returned 0x520000
	[0140.621] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20c) returned 0x52aa58
	[0140.621] GetConsoleTitleW (in: lpConsoleTitle=0x52aa58, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0140.624] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0140.624] GetProcAddress (hModule=0x75600000, lpProcName="CopyFileExW") returned 0x7561ffc0
	[0140.624] GetProcAddress (hModule=0x75600000, lpProcName="IsDebuggerPresent") returned 0x7561b0b0
	[0140.624] GetProcAddress (hModule=0x75600000, lpProcName="SetConsoleInputExeNameW") returned 0x7559b440
	[0140.625] GetProcessHeap () returned 0x520000
	[0140.625] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x400a) returned 0x52bd60
	[0140.625] GetProcessHeap () returned 0x520000
	[0140.625] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x52bd60) returned 1
	[0140.626] _wcsicmp (_String1="taskkill", _String2=")") returned 75
	[0140.626] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14
	[0140.626] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14
	[0140.626] _wcsicmp (_String1="IF", _String2="taskkill") returned -11
	[0140.626] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11
	[0140.626] _wcsicmp (_String1="REM", _String2="taskkill") returned -2
	[0140.626] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2
	[0140.626] GetProcessHeap () returned 0x520000
	[0140.627] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x58) returned 0x52ac70
	[0140.627] GetProcessHeap () returned 0x520000
	[0140.627] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x1a) returned 0x52acd0
	[0140.627] GetProcessHeap () returned 0x520000
	[0140.627] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x36) returned 0x52acf8
	[0140.628] GetConsoleTitleW (in: lpConsoleTitle=0x19fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0140.632] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0140.632] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0140.632] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0140.632] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0140.632] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0140.632] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0140.632] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0140.632] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0140.632] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0140.632] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0140.632] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0140.632] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0140.632] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0140.632] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0140.632] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0140.632] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0140.632] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0140.633] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0140.633] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0140.633] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0140.633] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0140.633] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0140.633] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0140.633] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0140.633] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0140.633] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0140.633] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0140.633] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0140.633] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0140.633] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0140.633] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0140.633] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0140.633] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0140.633] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0140.633] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0140.633] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0140.633] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0140.633] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0140.633] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0140.633] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0140.633] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0140.633] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0140.633] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0140.633] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0140.633] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0140.633] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0140.633] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0140.633] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0140.634] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0140.634] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0140.634] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0140.634] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0140.634] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0140.634] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0140.634] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0140.634] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0140.634] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0140.634] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0140.634] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0140.634] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0140.635] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0140.635] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0140.635] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0140.635] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0140.635] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0140.635] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0140.635] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0140.635] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0140.635] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0140.635] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0140.635] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0140.635] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0140.635] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0140.635] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0140.635] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0140.635] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0140.635] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0140.635] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0140.635] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0140.635] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0140.635] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0140.635] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0140.635] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0140.635] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0140.635] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14
	[0140.635] _wcsicmp (_String1="taskkill", _String2="IF") returned 11
	[0140.635] _wcsicmp (_String1="taskkill", _String2="REM") returned 2
	[0140.636] GetProcessHeap () returned 0x520000
	[0140.636] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x210) returned 0x52ad38
	[0140.636] GetProcessHeap () returned 0x520000
	[0140.636] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x48) returned 0x52af50
	[0140.636] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0140.636] GetProcessHeap () returned 0x520000
	[0140.636] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x418) returned 0x5205c8
	[0140.637] SetErrorMode (uMode=0x0) returned 0x8003
	[0140.637] SetErrorMode (uMode=0x1) returned 0x0
	[0140.637] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x5205d0, lpFilePart=0x19f57c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19f57c*="Desktop") returned 0x1d
	[0140.637] SetErrorMode (uMode=0x8003) returned 0x1
	[0140.637] GetProcessHeap () returned 0x520000
	[0140.637] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5205c8, Size=0x56) returned 0x5205c8
	[0140.637] GetProcessHeap () returned 0x520000
	[0140.637] RtlSizeHeap (HeapHandle=0x520000, Flags=0x0, MemoryPointer=0x5205c8) returned 0x56
	[0140.637] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0140.637] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0140.637] GetProcessHeap () returned 0x520000
	[0140.637] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x110) returned 0x52afa0
	[0140.637] GetProcessHeap () returned 0x520000
	[0140.637] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x218) returned 0x52b0b8
	[0140.643] GetProcessHeap () returned 0x520000
	[0140.643] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x52b0b8, Size=0x112) returned 0x52b0b8
	[0140.643] GetProcessHeap () returned 0x520000
	[0140.643] RtlSizeHeap (HeapHandle=0x520000, Flags=0x0, MemoryPointer=0x52b0b8) returned 0x112
	[0140.644] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0140.644] GetProcessHeap () returned 0x520000
	[0140.644] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xe0) returned 0x52b1d8
	[0140.645] GetProcessHeap () returned 0x520000
	[0140.645] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x52b1d8, Size=0x76) returned 0x52b1d8
	[0140.645] GetProcessHeap () returned 0x520000
	[0140.645] RtlSizeHeap (HeapHandle=0x520000, Flags=0x0, MemoryPointer=0x52b1d8) returned 0x76
	[0140.645] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0140.646] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0140.646] GetLastError () returned 0x2
	[0140.646] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0140.646] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x52b258
	[0140.647] GetProcessHeap () returned 0x520000
	[0140.647] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14) returned 0x527760
	[0140.647] FindClose (in: hFindFile=0x52b258 | out: hFindFile=0x52b258) returned 1
	[0140.647] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0140.647] GetLastError () returned 0x2
	[0140.647] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x52b258
	[0140.647] GetProcessHeap () returned 0x520000
	[0140.647] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x527760, Size=0x4) returned 0x527288
	[0140.647] FindClose (in: hFindFile=0x52b258 | out: hFindFile=0x52b258) returned 1
	[0140.647] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0140.647] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0140.647] GetConsoleTitleW (in: lpConsoleTitle=0x19f7fc, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0140.660] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f728, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f70c | out: lpAttributeList=0x19f728, lpSize=0x19f70c) returned 1
	[0140.660] UpdateProcThreadAttribute (in: lpAttributeList=0x19f728, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f714, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f728, lpPreviousValue=0x0) returned 1
	[0140.660] GetStartupInfoW (in: lpStartupInfo=0x19f760 | out: lpStartupInfo=0x19f760*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x140, hStdOutput=0x144, hStdError=0x150)) 
	[0140.660] GetProcessHeap () returned 0x520000
	[0140.660] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x18) returned 0x527980
	[0140.660] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0140.660] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0140.660] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0140.660] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0140.660] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0140.660] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0140.660] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0140.660] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0140.660] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0140.660] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0140.660] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0140.660] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0140.660] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0140.660] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0140.660] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0140.660] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0140.660] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0140.661] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0140.661] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0140.661] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0140.661] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0140.661] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0140.661] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0140.661] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0140.661] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0140.661] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0140.661] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0140.661] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0140.661] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0140.661] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0140.661] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0140.661] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0140.661] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0140.661] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0140.661] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0140.661] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0140.661] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0140.661] GetProcessHeap () returned 0x520000
	[0140.661] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x527980) returned 1
	[0140.661] GetProcessHeap () returned 0x520000
	[0140.661] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xa) returned 0x52b258
	[0140.661] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1
	[0140.667] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill  /f /im xfssvccon.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x19f6b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill  /f /im xfssvccon.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f6fc | out: lpCommandLine="taskkill  /f /im xfssvccon.exe ", lpProcessInformation=0x19f6fc*(hProcess=0x9c, hThread=0x98, dwProcessId=0x1384, dwThreadId=0x12d0)) returned 1
	[0140.691] CloseHandle (hObject=0x98) returned 1
	[0140.691] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0140.691] GetProcessHeap () returned 0x520000
	[0140.692] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x529e60) returned 1
	[0140.692] GetEnvironmentStringsW () returned 0x529e60*
	[0140.692] GetProcessHeap () returned 0x520000
	[0140.692] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xa76) returned 0x527fe8
	[0140.692] FreeEnvironmentStringsA (penv="=") returned 1
	[0140.692] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0
	[0141.801] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x19f694 | out: lpExitCode=0x19f694*=0x80) returned 1
	[0141.801] CloseHandle (hObject=0x9c) returned 1
	[0141.801] _vsnwprintf (in: _Buffer=0x19f77c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f69c | out: _Buffer="00000080") returned 8
	[0141.802] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1
	[0141.802] GetProcessHeap () returned 0x520000
	[0141.803] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x527fe8) returned 1
	[0141.803] GetEnvironmentStringsW () returned 0x52b288*
	[0141.804] GetProcessHeap () returned 0x520000
	[0141.804] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xa9c) returned 0x527fe8
	[0141.804] FreeEnvironmentStringsA (penv="=") returned 1
	[0141.804] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0141.804] GetProcessHeap () returned 0x520000
	[0141.804] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x527fe8) returned 1
	[0141.804] GetEnvironmentStringsW () returned 0x52b288*
	[0141.804] GetProcessHeap () returned 0x520000
	[0141.804] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xa9c) returned 0x527fe8
	[0141.804] FreeEnvironmentStringsA (penv="=") returned 1
	[0141.804] GetProcessHeap () returned 0x520000
	[0141.804] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x52b258) returned 1
	[0141.804] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f728 | out: lpAttributeList=0x19f728) 
	[0141.805] _get_osfhandle (_FileHandle=1) returned 0x144
	[0141.805] SetConsoleMode (hConsoleHandle=0x144, dwMode=0x0) returned 0
	[0141.805] _get_osfhandle (_FileHandle=1) returned 0x144
	[0141.805] GetConsoleMode (in: hConsoleHandle=0x144, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0141.805] _get_osfhandle (_FileHandle=0) returned 0x140
	[0141.805] GetConsoleMode (in: hConsoleHandle=0x140, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0141.805] GetConsoleOutputCP () returned 0x1b5
	[0141.822] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0141.822] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0141.824] exit (_Code=128) 

Thread:
	id = 200
	os_tid = 0xf68


Process:
	id = "28"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\syswow64\\taskkill.exe"
	page_root = "0x34ada000"
	os_pid = "0x1384"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "27"
	os_parent_pid = "0x11d4"
	cmd_line = "taskkill  /f /im xfssvccon.exe "
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 2360
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 2361
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 2362
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 2363
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 2364
	        start_va = 0xa0000
	          end_va = 0xdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 2365
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 2366
	        start_va = 0x13b0000
	          end_va = 0x13c5fff
	       monitored = 0
	     entry_point = 0x13bde80
	     region_type = mapped_file
	            name = "taskkill.exe"
	        filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe")

Region:
	              id = 2367
	        start_va = 0x13d0000
	          end_va = 0x53cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000013d0000"
	        filename = ""

Region:
	              id = 2368
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 2369
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 2370
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 2371
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 2372
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 2373
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 2374
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 2375
	        start_va = 0xe0000
	          end_va = 0xe3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 2376
	        start_va = 0xf0000
	          end_va = 0xf0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 2377
	        start_va = 0x100000
	          end_va = 0x101fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 2378
	        start_va = 0x570000
	          end_va = 0x57ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000570000"
	        filename = ""

Region:
	              id = 2379
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 2380
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 2381
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 2382
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 2383
	        start_va = 0x400000
	          end_va = 0x4fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 2384
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 2385
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 2386
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 2387
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 2388
	        start_va = 0x110000
	          end_va = 0x1cdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 2389
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 2390
	        start_va = 0x74650000
	          end_va = 0x746cafff
	       monitored = 0
	     entry_point = 0x7466e970
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 2391
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 2392
	        start_va = 0x500000
	          end_va = 0x53ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000500000"
	        filename = ""

Region:
	              id = 2393
	        start_va = 0x580000
	          end_va = 0x5bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000580000"
	        filename = ""

Region:
	              id = 2394
	        start_va = 0x76ae0000
	          end_va = 0x76b23fff
	       monitored = 0
	     entry_point = 0x76af9d80
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 2395
	        start_va = 0x75260000
	          end_va = 0x7530cfff
	       monitored = 0
	     entry_point = 0x75274f00
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 2396
	        start_va = 0x74450000
	          end_va = 0x7446dfff
	       monitored = 0
	     entry_point = 0x7445b640
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 2397
	        start_va = 0x74440000
	          end_va = 0x74449fff
	       monitored = 0
	     entry_point = 0x74442a00
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 2398
	        start_va = 0x74590000
	          end_va = 0x745e7fff
	       monitored = 0
	     entry_point = 0x745d25c0
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 2399
	        start_va = 0x77450000
	          end_va = 0x77596fff
	       monitored = 0
	     entry_point = 0x77461cf0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 2400
	        start_va = 0x76b30000
	          end_va = 0x76c7efff
	       monitored = 0
	     entry_point = 0x76be6820
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 2401
	        start_va = 0x753c0000
	          end_va = 0x75451fff
	       monitored = 0
	     entry_point = 0x753f8cf0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 2402
	        start_va = 0x77290000
	          end_va = 0x7744cfff
	       monitored = 0
	     entry_point = 0x77372a10
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")

Region:
	              id = 2403
	        start_va = 0x75310000
	          end_va = 0x7536efff
	       monitored = 0
	     entry_point = 0x75314af0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 2404
	        start_va = 0x77240000
	          end_va = 0x77284fff
	       monitored = 0
	     entry_point = 0x7725de90
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 2405
	        start_va = 0x6cc90000
	          end_va = 0x6cc97fff
	       monitored = 0
	     entry_point = 0x6cc917b0
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 2406
	        start_va = 0x6cc50000
	          end_va = 0x6cc8efff
	       monitored = 0
	     entry_point = 0x6cc646c0
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll")

Region:
	              id = 2407
	        start_va = 0x6cb10000
	          end_va = 0x6cc4efff
	       monitored = 0
	     entry_point = 0x6cb3d880
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll")

Region:
	              id = 2408
	        start_va = 0x6caf0000
	          end_va = 0x6cb0bfff
	       monitored = 0
	     entry_point = 0x6caf4720
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")

Region:
	              id = 2409
	        start_va = 0x6cae0000
	          end_va = 0x6cae9fff
	       monitored = 0
	     entry_point = 0x6cae28d0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")

Region:
	              id = 2410
	        start_va = 0x6cac0000
	          end_va = 0x6cad5fff
	       monitored = 0
	     entry_point = 0x6cac21d0
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")

Region:
	              id = 2411
	        start_va = 0x5c0000
	          end_va = 0x69ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005c0000"
	        filename = ""

Region:
	              id = 2412
	        start_va = 0x1d0000
	          end_va = 0x1f9fff
	       monitored = 0
	     entry_point = 0x1d5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 2413
	        start_va = 0x6a0000
	          end_va = 0x827fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000006a0000"
	        filename = ""

Region:
	              id = 2414
	        start_va = 0x74ea0000
	          end_va = 0x74ecafff
	       monitored = 0
	     entry_point = 0x74ea5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 2415
	        start_va = 0x830000
	          end_va = 0x9b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000830000"
	        filename = ""

Region:
	              id = 2416
	        start_va = 0x53d0000
	          end_va = 0x67cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000053d0000"
	        filename = ""

Region:
	              id = 2417
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 2418
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001d0000"
	        filename = ""

Region:
	              id = 2419
	        start_va = 0x1e0000
	          end_va = 0x1e4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taskkill.exe.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui")

Region:
	              id = 2420
	        start_va = 0x1f0000
	          end_va = 0x1f0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001f0000"
	        filename = ""

Region:
	              id = 2421
	        start_va = 0x540000
	          end_va = 0x540fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000540000"
	        filename = ""

Region:
	              id = 2422
	        start_va = 0x9c0000
	          end_va = 0xcf6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 2423
	        start_va = 0xd00000
	          end_va = 0xde9fff
	       monitored = 0
	     entry_point = 0xd3d650
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 2424
	        start_va = 0x550000
	          end_va = 0x553fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000550000"
	        filename = ""

Region:
	              id = 2425
	        start_va = 0xd00000
	          end_va = 0xddffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 2426
	        start_va = 0x76e20000
	          end_va = 0x76e2bfff
	       monitored = 0
	     entry_point = 0x76e23930
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")

Region:
	              id = 2427
	        start_va = 0x560000
	          end_va = 0x560fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000560000"
	        filename = ""

Region:
	              id = 2428
	        start_va = 0x76c80000
	          end_va = 0x76d03fff
	       monitored = 0
	     entry_point = 0x76ca6220
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 2429
	        start_va = 0x5c0000
	          end_va = 0x5c0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000005c0000"
	        filename = ""

Region:
	              id = 2430
	        start_va = 0x690000
	          end_va = 0x69ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000690000"
	        filename = ""

Region:
	              id = 2431
	        start_va = 0x6cab0000
	          end_va = 0x6cabcfff
	       monitored = 0
	     entry_point = 0x6cab3520
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 2432
	        start_va = 0x6ca40000
	          end_va = 0x6caa6fff
	       monitored = 0
	     entry_point = 0x6ca5b610
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 2433
	        start_va = 0x740f0000
	          end_va = 0x7410afff
	       monitored = 0
	     entry_point = 0x740f9050
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 2434
	        start_va = 0x6c9f0000
	          end_va = 0x6ca33fff
	       monitored = 0
	     entry_point = 0x6ca0aaf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")

Region:
	              id = 2435
	        start_va = 0x5d0000
	          end_va = 0x60ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005d0000"
	        filename = ""

Region:
	              id = 2436
	        start_va = 0x610000
	          end_va = 0x64ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000610000"
	        filename = ""

Region:
	              id = 2437
	        start_va = 0x650000
	          end_va = 0x68ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000650000"
	        filename = ""

Region:
	              id = 2438
	        start_va = 0xde0000
	          end_va = 0xe1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000de0000"
	        filename = ""

Region:
	              id = 2439
	        start_va = 0xe20000
	          end_va = 0xe5ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e20000"
	        filename = ""

Region:
	              id = 2440
	        start_va = 0xe60000
	          end_va = 0xe9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e60000"
	        filename = ""

Region:
	              id = 2441
	        start_va = 0x6c9d0000
	          end_va = 0x6c9e0fff
	       monitored = 0
	     entry_point = 0x6c9d8fa0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 2442
	        start_va = 0x6c910000
	          end_va = 0x6c9cefff
	       monitored = 0
	     entry_point = 0x6c941e80
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 2444
	        start_va = 0xea0000
	          end_va = 0xea5fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000ea0000"
	        filename = ""


Thread:
	id = 201
	os_tid = 0x12d0


Thread:
	id = 202
	os_tid = 0xd58


Thread:
	id = 203
	os_tid = 0x1cc


Thread:
	id = 204
	os_tid = 0x88c


Thread:
	id = 205
	os_tid = 0xc60


Process:
	id = "29"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x68833000"
	os_pid = "0x2e4"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x614"
	cmd_line = "cmd.exe /c \"taskkill /f /im mydesktopservice.exe \""
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 2447
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 2448
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 2449
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 2450
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 2451
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 2452
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 2453
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 2454
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 2455
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 2456
	        start_va = 0x13a0000
	          end_va = 0x13f1fff
	       monitored = 1
	     entry_point = 0x13b4fd0
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")

Region:
	              id = 2457
	        start_va = 0x1400000
	          end_va = 0x53fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001400000"
	        filename = ""

Region:
	              id = 2458
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 2459
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 2460
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 2461
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 2462
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 2463
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 2464
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 2465
	        start_va = 0x470000
	          end_va = 0x47ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000470000"
	        filename = ""

Region:
	              id = 2466
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 2467
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 2468
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 2469
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 2470
	        start_va = 0x480000
	          end_va = 0x66ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 2471
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 2472
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 2473
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 2474
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 2475
	        start_va = 0x480000
	          end_va = 0x53dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 2476
	        start_va = 0x570000
	          end_va = 0x66ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000570000"
	        filename = ""

Region:
	              id = 2477
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 2478
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 2479
	        start_va = 0x670000
	          end_va = 0x76ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000670000"
	        filename = ""

Region:
	              id = 2480
	        start_va = 0x1d0000
	          end_va = 0x1fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001d0000"
	        filename = ""

Region:
	              id = 2481
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 2482
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 2483
	        start_va = 0x770000
	          end_va = 0xaa6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 206
	os_tid = 0x5dc

	[0142.040] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000
	[0142.040] __set_app_type (_Type=0x1) 
	[0142.040] __p__fmode () returned 0x74974d6c
	[0142.040] __p__commode () returned 0x74975b1c
	[0142.040] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13b5200) returned 0x0
	[0142.041] __getmainargs (in: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0, _DoWildCard=0, _StartInfo=0x13c60fc | out: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0) returned 0
	[0142.041] GetCurrentThreadId () returned 0x5dc
	[0142.041] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x5dc) returned 0x78
	[0142.041] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0142.041] GetProcAddress (hModule=0x75600000, lpProcName="SetThreadUILanguage") returned 0x75642510
	[0142.041] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0142.046] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0142.046] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2
	[0142.047] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0142.047] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0142.047] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0142.047] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0142.047] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0142.047] GetConsoleOutputCP () returned 0x1b5
	[0142.049] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0142.049] SetConsoleCtrlHandler (HandlerRoutine=0x13c0e40, Add=1) returned 1
	[0142.049] _get_osfhandle (_FileHandle=1) returned 0x140
	[0142.049] SetConsoleMode (hConsoleHandle=0x140, dwMode=0x0) returned 0
	[0142.049] _get_osfhandle (_FileHandle=1) returned 0x140
	[0142.049] GetConsoleMode (in: hConsoleHandle=0x140, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0142.049] _get_osfhandle (_FileHandle=0) returned 0x13c
	[0142.049] GetConsoleMode (in: hConsoleHandle=0x13c, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0142.049] GetEnvironmentStringsW () returned 0x577cd8*
	[0142.049] GetProcessHeap () returned 0x570000
	[0142.050] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xa1a) returned 0x578700
	[0142.050] FreeEnvironmentStringsA (penv="A") returned 1
	[0142.050] GetProcessHeap () returned 0x570000
	[0142.050] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x4) returned 0x570550
	[0142.050] GetEnvironmentStringsW () returned 0x577cd8*
	[0142.050] GetProcessHeap () returned 0x570000
	[0142.050] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xa1a) returned 0x579128
	[0142.050] FreeEnvironmentStringsA (penv="A") returned 1
	[0142.050] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0142.050] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0142.051] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0142.051] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0142.051] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0142.051] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0142.051] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0142.051] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0142.051] RegCloseKey (hKey=0x88) returned 0x0
	[0142.051] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0142.051] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0142.051] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0142.051] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0142.051] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0142.051] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0142.052] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0142.052] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0142.052] RegCloseKey (hKey=0x88) returned 0x0
	[0142.052] time (in: timer=0x0 | out: timer=0x0) returned 0x62344218
	[0142.052] srand (_Seed=0x62344218) 
	[0142.052] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im mydesktopservice.exe \""
	[0142.052] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im mydesktopservice.exe \""
	[0142.052] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0142.052] GetProcessHeap () returned 0x570000
	[0142.052] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x210) returned 0x579b50
	[0142.052] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x579b58, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0142.052] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0142.052] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0142.052] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0142.053] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0142.053] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0142.053] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0142.053] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0142.053] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0142.053] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0142.053] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0142.053] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0142.053] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0142.053] GetProcessHeap () returned 0x570000
	[0142.054] RtlFreeHeap (HeapHandle=0x570000, Flags=0x0, BaseAddress=0x578700) returned 1
	[0142.054] GetEnvironmentStringsW () returned 0x577cd8*
	[0142.054] GetProcessHeap () returned 0x570000
	[0142.054] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xa32) returned 0x57a7a8
	[0142.055] FreeEnvironmentStringsA (penv="A") returned 1
	[0142.055] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b
	[0142.055] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0142.055] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0142.056] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0142.056] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0142.056] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0142.056] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0142.056] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0142.056] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0142.056] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0142.056] GetProcessHeap () returned 0x570000
	[0142.056] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x44) returned 0x5705c8
	[0142.056] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0142.057] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19fc4c*="Desktop") returned 0x1d
	[0142.057] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0142.057] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x570618
	[0142.057] FindClose (in: hFindFile=0x570618 | out: hFindFile=0x570618) returned 1
	[0142.057] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x570618
	[0142.058] FindClose (in: hFindFile=0x570618 | out: hFindFile=0x570618) returned 1
	[0142.058] _wcsnicmp (_String1="RDHJ0C~1", _String2="RDhJ0CNFevzX", _MaxCount=0xc) returned 16
	[0142.058] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x570618
	[0142.058] FindClose (in: hFindFile=0x570618 | out: hFindFile=0x570618) returned 1
	[0142.058] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0142.058] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1
	[0142.058] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 1
	[0142.059] GetProcessHeap () returned 0x570000
	[0142.059] RtlFreeHeap (HeapHandle=0x570000, Flags=0x0, BaseAddress=0x57a7a8) returned 1
	[0142.059] GetEnvironmentStringsW () returned 0x577cd8*
	[0142.059] GetProcessHeap () returned 0x570000
	[0142.059] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xa76) returned 0x579d68
	[0142.059] FreeEnvironmentStringsA (penv="=") returned 1
	[0142.059] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0142.059] GetProcessHeap () returned 0x570000
	[0142.060] RtlFreeHeap (HeapHandle=0x570000, Flags=0x0, BaseAddress=0x5705c8) returned 1
	[0142.060] GetProcessHeap () returned 0x570000
	[0142.060] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x400e) returned 0x57bc68
	[0142.060] GetProcessHeap () returned 0x570000
	[0142.061] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x5c) returned 0x57a7e8
	[0142.061] GetProcessHeap () returned 0x570000
	[0142.061] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x4008) returned 0x57fc80
	[0142.061] GetProcessHeap () returned 0x570000
	[0142.061] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x4008) returned 0x583c90
	[0142.063] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0142.064] GetProcessHeap () returned 0x570000
	[0142.064] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x418) returned 0x57a850
	[0142.066] SetErrorMode (uMode=0x0) returned 0x8003
	[0142.066] SetErrorMode (uMode=0x1) returned 0x0
	[0142.066] GetFullPathNameW (in: lpFileName="taskkill \\f \\.", nBufferLength=0x208, lpBuffer=0x57a858, lpFilePart=0x19fbac | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f", lpFilePart=0x19fbac*="f") returned 0x29
	[0142.066] SetErrorMode (uMode=0x8003) returned 0x1
	[0142.066] GetProcessHeap () returned 0x570000
	[0142.066] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x57a850, Size=0x8e) returned 0x57a850
	[0142.066] GetProcessHeap () returned 0x570000
	[0142.066] RtlSizeHeap (HeapHandle=0x570000, Flags=0x0, MemoryPointer=0x57a850) returned 0x8e
	[0142.066] NeedCurrentDirectoryForExePathW (ExeName="taskkill \\f \\.") returned 1
	[0142.066] GetProcessHeap () returned 0x570000
	[0142.066] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x62) returned 0x57a8e8
	[0142.067] GetProcessHeap () returned 0x570000
	[0142.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xb8) returned 0x57a958
	[0142.067] GetProcessHeap () returned 0x570000
	[0142.067] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x57a958, Size=0x62) returned 0x57a958
	[0142.067] GetProcessHeap () returned 0x570000
	[0142.067] RtlSizeHeap (HeapHandle=0x570000, Flags=0x0, MemoryPointer=0x57a958) returned 0x62
	[0142.067] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0142.067] GetProcessHeap () returned 0x570000
	[0142.067] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xe0) returned 0x57a9c8
	[0142.071] GetProcessHeap () returned 0x570000
	[0142.071] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x57a9c8, Size=0x76) returned 0x57a9c8
	[0142.072] GetProcessHeap () returned 0x570000
	[0142.072] RtlSizeHeap (HeapHandle=0x570000, Flags=0x0, MemoryPointer=0x57a9c8) returned 0x76
	[0142.072] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0142.072] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f\\im mydesktopservice.exe ", fInfoLevelId=0x1, lpFindFileData=0x19f958, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f958) returned 0xffffffff
	[0142.072] GetLastError () returned 0x3
	[0142.072] GetProcessHeap () returned 0x570000
	[0142.073] RtlFreeHeap (HeapHandle=0x570000, Flags=0x0, BaseAddress=0x57fc80) returned 1
	[0142.073] GetProcessHeap () returned 0x570000
	[0142.074] RtlFreeHeap (HeapHandle=0x570000, Flags=0x0, BaseAddress=0x583c90) returned 1
	[0142.074] GetProcessHeap () returned 0x570000
	[0142.074] RtlFreeHeap (HeapHandle=0x570000, Flags=0x0, BaseAddress=0x57bc68) returned 1
	[0142.074] GetConsoleOutputCP () returned 0x1b5
	[0142.121] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0142.121] GetUserDefaultLCID () returned 0x409
	[0142.121] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x13d34a0, cchData=8 | out: lpLCData=":") returned 2
	[0142.121] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0142.121] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0142.121] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2
	[0142.121] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x13d34b0, cchData=8 | out: lpLCData="/") returned 2
	[0142.121] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x13d3500, cchData=32 | out: lpLCData="Mon") returned 4
	[0142.121] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x13d3540, cchData=32 | out: lpLCData="Tue") returned 4
	[0142.121] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x13d3580, cchData=32 | out: lpLCData="Wed") returned 4
	[0142.122] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x13d35c0, cchData=32 | out: lpLCData="Thu") returned 4
	[0142.122] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x13d3600, cchData=32 | out: lpLCData="Fri") returned 4
	[0142.122] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x13d3640, cchData=32 | out: lpLCData="Sat") returned 4
	[0142.122] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x13d3680, cchData=32 | out: lpLCData="Sun") returned 4
	[0142.122] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x13d34c0, cchData=8 | out: lpLCData=".") returned 2
	[0142.122] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x13d34e0, cchData=8 | out: lpLCData=",") returned 2
	[0142.122] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0142.123] GetProcessHeap () returned 0x570000
	[0142.123] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x20c) returned 0x57aa90
	[0142.124] GetConsoleTitleW (in: lpConsoleTitle=0x57aa90, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0142.127] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0142.127] GetProcAddress (hModule=0x75600000, lpProcName="CopyFileExW") returned 0x7561ffc0
	[0142.127] GetProcAddress (hModule=0x75600000, lpProcName="IsDebuggerPresent") returned 0x7561b0b0
	[0142.127] GetProcAddress (hModule=0x75600000, lpProcName="SetConsoleInputExeNameW") returned 0x7559b440
	[0142.127] GetProcessHeap () returned 0x570000
	[0142.127] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x400a) returned 0x57bc68
	[0142.127] GetProcessHeap () returned 0x570000
	[0142.128] RtlFreeHeap (HeapHandle=0x570000, Flags=0x0, BaseAddress=0x57bc68) returned 1
	[0142.129] _wcsicmp (_String1="taskkill", _String2=")") returned 75
	[0142.129] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14
	[0142.129] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14
	[0142.129] _wcsicmp (_String1="IF", _String2="taskkill") returned -11
	[0142.129] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11
	[0142.129] _wcsicmp (_String1="REM", _String2="taskkill") returned -2
	[0142.129] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2
	[0142.129] GetProcessHeap () returned 0x570000
	[0142.129] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x58) returned 0x57aca8
	[0142.129] GetProcessHeap () returned 0x570000
	[0142.129] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x1a) returned 0x570578
	[0142.130] GetProcessHeap () returned 0x570000
	[0142.130] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x44) returned 0x57ad08
	[0142.131] GetConsoleTitleW (in: lpConsoleTitle=0x19fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0142.133] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0142.134] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0142.134] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0142.134] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0142.134] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0142.134] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0142.134] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0142.134] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0142.134] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0142.134] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0142.134] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0142.134] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0142.134] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0142.134] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0142.134] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0142.134] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0142.134] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0142.134] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0142.134] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0142.134] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0142.134] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0142.134] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0142.134] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0142.134] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0142.134] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0142.134] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0142.134] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0142.135] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0142.135] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0142.135] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0142.135] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0142.135] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0142.135] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0142.135] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0142.135] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0142.135] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0142.135] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0142.135] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0142.135] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0142.135] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0142.135] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0142.135] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0142.135] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0142.135] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0142.135] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0142.135] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0142.135] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0142.135] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0142.135] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0142.135] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0142.135] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0142.135] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0142.135] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0142.135] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0142.135] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0142.136] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0142.136] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0142.136] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0142.136] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0142.136] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0142.136] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0142.136] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0142.136] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0142.136] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0142.136] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0142.136] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0142.136] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0142.136] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0142.136] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0142.136] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0142.136] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0142.136] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0142.136] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0142.136] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0142.136] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0142.136] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0142.136] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0142.136] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0142.137] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0142.137] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0142.137] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0142.137] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0142.137] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0142.137] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0142.137] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14
	[0142.137] _wcsicmp (_String1="taskkill", _String2="IF") returned 11
	[0142.137] _wcsicmp (_String1="taskkill", _String2="REM") returned 2
	[0142.137] GetProcessHeap () returned 0x570000
	[0142.137] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x210) returned 0x57ad58
	[0142.137] GetProcessHeap () returned 0x570000
	[0142.137] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x56) returned 0x57af70
	[0142.137] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0142.138] GetProcessHeap () returned 0x570000
	[0142.138] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x418) returned 0x5705c8
	[0142.138] SetErrorMode (uMode=0x0) returned 0x8003
	[0142.138] SetErrorMode (uMode=0x1) returned 0x0
	[0142.138] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x5705d0, lpFilePart=0x19f57c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19f57c*="Desktop") returned 0x1d
	[0142.138] SetErrorMode (uMode=0x8003) returned 0x1
	[0142.138] GetProcessHeap () returned 0x570000
	[0142.138] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x5705c8, Size=0x56) returned 0x5705c8
	[0142.138] GetProcessHeap () returned 0x570000
	[0142.138] RtlSizeHeap (HeapHandle=0x570000, Flags=0x0, MemoryPointer=0x5705c8) returned 0x56
	[0142.138] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0142.138] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0142.138] GetProcessHeap () returned 0x570000
	[0142.139] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x110) returned 0x57afd0
	[0142.139] GetProcessHeap () returned 0x570000
	[0142.139] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x218) returned 0x570628
	[0142.143] GetProcessHeap () returned 0x570000
	[0142.143] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x570628, Size=0x112) returned 0x570628
	[0142.143] GetProcessHeap () returned 0x570000
	[0142.144] RtlSizeHeap (HeapHandle=0x570000, Flags=0x0, MemoryPointer=0x570628) returned 0x112
	[0142.144] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0142.144] GetProcessHeap () returned 0x570000
	[0142.144] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xe0) returned 0x57b0e8
	[0142.146] GetProcessHeap () returned 0x570000
	[0142.146] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x57b0e8, Size=0x76) returned 0x57b0e8
	[0142.146] GetProcessHeap () returned 0x570000
	[0142.146] RtlSizeHeap (HeapHandle=0x570000, Flags=0x0, MemoryPointer=0x57b0e8) returned 0x76
	[0142.146] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0142.146] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0142.146] GetLastError () returned 0x2
	[0142.146] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0142.146] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x57b168
	[0142.147] GetProcessHeap () returned 0x570000
	[0142.147] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x0, Size=0x14) returned 0x577500
	[0142.147] FindClose (in: hFindFile=0x57b168 | out: hFindFile=0x57b168) returned 1
	[0142.147] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0142.147] GetLastError () returned 0x2
	[0142.147] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x57b168
	[0142.147] GetProcessHeap () returned 0x570000
	[0142.147] RtlReAllocateHeap (Heap=0x570000, Flags=0x0, Ptr=0x577500, Size=0x4) returned 0x57b1a8
	[0142.147] FindClose (in: hFindFile=0x57b168 | out: hFindFile=0x57b168) returned 1
	[0142.147] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0142.147] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0142.147] GetConsoleTitleW (in: lpConsoleTitle=0x19f7fc, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0142.149] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f728, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f70c | out: lpAttributeList=0x19f728, lpSize=0x19f70c) returned 1
	[0142.149] UpdateProcThreadAttribute (in: lpAttributeList=0x19f728, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f714, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f728, lpPreviousValue=0x0) returned 1
	[0142.149] GetStartupInfoW (in: lpStartupInfo=0x19f760 | out: lpStartupInfo=0x19f760*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x13c, hStdOutput=0x140, hStdError=0x144)) 
	[0142.149] GetProcessHeap () returned 0x570000
	[0142.149] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0x18) returned 0x577680
	[0142.149] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0142.149] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0142.149] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0142.149] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0142.149] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0142.149] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0142.149] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0142.149] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0142.149] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0142.149] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0142.149] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0142.149] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0142.149] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0142.150] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0142.150] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0142.150] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0142.150] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0142.150] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0142.150] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0142.150] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0142.150] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0142.150] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0142.150] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0142.150] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0142.150] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0142.150] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0142.150] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0142.150] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0142.150] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0142.150] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0142.150] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0142.150] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0142.150] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0142.150] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0142.150] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0142.150] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0142.150] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0142.150] GetProcessHeap () returned 0x570000
	[0142.150] RtlFreeHeap (HeapHandle=0x570000, Flags=0x0, BaseAddress=0x577680) returned 1
	[0142.150] GetProcessHeap () returned 0x570000
	[0142.150] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xa) returned 0x57b1b8
	[0142.150] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1
	[0142.153] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill  /f /im mydesktopservice.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x19f6b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill  /f /im mydesktopservice.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f6fc | out: lpCommandLine="taskkill  /f /im mydesktopservice.exe ", lpProcessInformation=0x19f6fc*(hProcess=0x9c, hThread=0x98, dwProcessId=0x13e4, dwThreadId=0x398)) returned 1
	[0142.168] CloseHandle (hObject=0x98) returned 1
	[0142.168] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0142.168] GetProcessHeap () returned 0x570000
	[0142.168] RtlFreeHeap (HeapHandle=0x570000, Flags=0x0, BaseAddress=0x579d68) returned 1
	[0142.169] GetEnvironmentStringsW () returned 0x579d68*
	[0142.169] GetProcessHeap () returned 0x570000
	[0142.169] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xa76) returned 0x577cd8
	[0142.169] FreeEnvironmentStringsA (penv="=") returned 1
	[0142.169] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0
	[0143.271] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x19f694 | out: lpExitCode=0x19f694*=0x80) returned 1
	[0143.271] CloseHandle (hObject=0x9c) returned 1
	[0143.272] _vsnwprintf (in: _Buffer=0x19f77c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f69c | out: _Buffer="00000080") returned 8
	[0143.272] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1
	[0143.272] GetProcessHeap () returned 0x570000
	[0143.273] RtlFreeHeap (HeapHandle=0x570000, Flags=0x0, BaseAddress=0x577cd8) returned 1
	[0143.273] GetEnvironmentStringsW () returned 0x577cd8*
	[0143.273] GetProcessHeap () returned 0x570000
	[0143.273] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xa9c) returned 0x57c710
	[0143.273] FreeEnvironmentStringsA (penv="=") returned 1
	[0143.273] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0143.273] GetProcessHeap () returned 0x570000
	[0143.273] RtlFreeHeap (HeapHandle=0x570000, Flags=0x0, BaseAddress=0x57c710) returned 1
	[0143.274] GetEnvironmentStringsW () returned 0x577cd8*
	[0143.274] GetProcessHeap () returned 0x570000
	[0143.274] RtlAllocateHeap (HeapHandle=0x570000, Flags=0x8, Size=0xa9c) returned 0x57c710
	[0143.275] FreeEnvironmentStringsA (penv="=") returned 1
	[0143.275] GetProcessHeap () returned 0x570000
	[0143.275] RtlFreeHeap (HeapHandle=0x570000, Flags=0x0, BaseAddress=0x57b1b8) returned 1
	[0143.275] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f728 | out: lpAttributeList=0x19f728) 
	[0143.275] _get_osfhandle (_FileHandle=1) returned 0x140
	[0143.275] SetConsoleMode (hConsoleHandle=0x140, dwMode=0x0) returned 0
	[0143.275] _get_osfhandle (_FileHandle=1) returned 0x140
	[0143.275] GetConsoleMode (in: hConsoleHandle=0x140, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0143.275] _get_osfhandle (_FileHandle=0) returned 0x13c
	[0143.275] GetConsoleMode (in: hConsoleHandle=0x13c, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0143.275] GetConsoleOutputCP () returned 0x1b5
	[0143.329] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0143.329] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0143.336] exit (_Code=128) 

Thread:
	id = 207
	os_tid = 0x8e8


Process:
	id = "30"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\syswow64\\taskkill.exe"
	page_root = "0x34702000"
	os_pid = "0x13e4"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "29"
	os_parent_pid = "0x2e4"
	cmd_line = "taskkill  /f /im mydesktopservice.exe "
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 2484
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 2485
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 2486
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 2487
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 2488
	        start_va = 0xa0000
	          end_va = 0xdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 2489
	        start_va = 0xe0000
	          end_va = 0xe3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 2490
	        start_va = 0xf0000
	          end_va = 0xf0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 2491
	        start_va = 0x100000
	          end_va = 0x101fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 2492
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 2493
	        start_va = 0x13b0000
	          end_va = 0x13c5fff
	       monitored = 0
	     entry_point = 0x13bde80
	     region_type = mapped_file
	            name = "taskkill.exe"
	        filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe")

Region:
	              id = 2494
	        start_va = 0x13d0000
	          end_va = 0x53cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000013d0000"
	        filename = ""

Region:
	              id = 2495
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 2496
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 2497
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 2498
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 2499
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 2500
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 2501
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 2502
	        start_va = 0x530000
	          end_va = 0x53ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000530000"
	        filename = ""

Region:
	              id = 2503
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 2504
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 2505
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 2506
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 2507
	        start_va = 0x540000
	          end_va = 0x69ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000540000"
	        filename = ""

Region:
	              id = 2508
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 2509
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 2510
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 2511
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 2512
	        start_va = 0x110000
	          end_va = 0x1cdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 2513
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 2514
	        start_va = 0x74650000
	          end_va = 0x746cafff
	       monitored = 0
	     entry_point = 0x7466e970
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 2515
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 2516
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 2517
	        start_va = 0x440000
	          end_va = 0x47ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000440000"
	        filename = ""

Region:
	              id = 2518
	        start_va = 0x76ae0000
	          end_va = 0x76b23fff
	       monitored = 0
	     entry_point = 0x76af9d80
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 2519
	        start_va = 0x75260000
	          end_va = 0x7530cfff
	       monitored = 0
	     entry_point = 0x75274f00
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 2520
	        start_va = 0x74450000
	          end_va = 0x7446dfff
	       monitored = 0
	     entry_point = 0x7445b640
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 2521
	        start_va = 0x74440000
	          end_va = 0x74449fff
	       monitored = 0
	     entry_point = 0x74442a00
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 2522
	        start_va = 0x74590000
	          end_va = 0x745e7fff
	       monitored = 0
	     entry_point = 0x745d25c0
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 2523
	        start_va = 0x77450000
	          end_va = 0x77596fff
	       monitored = 0
	     entry_point = 0x77461cf0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 2524
	        start_va = 0x76b30000
	          end_va = 0x76c7efff
	       monitored = 0
	     entry_point = 0x76be6820
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 2525
	        start_va = 0x753c0000
	          end_va = 0x75451fff
	       monitored = 0
	     entry_point = 0x753f8cf0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 2526
	        start_va = 0x77290000
	          end_va = 0x7744cfff
	       monitored = 0
	     entry_point = 0x77372a10
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")

Region:
	              id = 2527
	        start_va = 0x75310000
	          end_va = 0x7536efff
	       monitored = 0
	     entry_point = 0x75314af0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 2528
	        start_va = 0x77240000
	          end_va = 0x77284fff
	       monitored = 0
	     entry_point = 0x7725de90
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 2529
	        start_va = 0x6cc90000
	          end_va = 0x6cc97fff
	       monitored = 0
	     entry_point = 0x6cc917b0
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 2530
	        start_va = 0x6cc70000
	          end_va = 0x6cc85fff
	       monitored = 0
	     entry_point = 0x6cc721d0
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")

Region:
	              id = 2531
	        start_va = 0x6cc30000
	          end_va = 0x6cc6efff
	       monitored = 0
	     entry_point = 0x6cc446c0
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll")

Region:
	              id = 2532
	        start_va = 0x6caf0000
	          end_va = 0x6cc2efff
	       monitored = 0
	     entry_point = 0x6cb1d880
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll")

Region:
	              id = 2533
	        start_va = 0x6cad0000
	          end_va = 0x6caebfff
	       monitored = 0
	     entry_point = 0x6cad4720
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")

Region:
	              id = 2534
	        start_va = 0x6cac0000
	          end_va = 0x6cac9fff
	       monitored = 0
	     entry_point = 0x6cac28d0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")

Region:
	              id = 2535
	        start_va = 0x480000
	          end_va = 0x4fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 2536
	        start_va = 0x1d0000
	          end_va = 0x1f9fff
	       monitored = 0
	     entry_point = 0x1d5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 2537
	        start_va = 0x6a0000
	          end_va = 0x827fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000006a0000"
	        filename = ""

Region:
	              id = 2538
	        start_va = 0x74ea0000
	          end_va = 0x74ecafff
	       monitored = 0
	     entry_point = 0x74ea5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 2539
	        start_va = 0x830000
	          end_va = 0x9b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000830000"
	        filename = ""

Region:
	              id = 2540
	        start_va = 0x53d0000
	          end_va = 0x67cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000053d0000"
	        filename = ""

Region:
	              id = 2541
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 2542
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001d0000"
	        filename = ""

Region:
	              id = 2543
	        start_va = 0x1e0000
	          end_va = 0x1e4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taskkill.exe.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui")

Region:
	              id = 2544
	        start_va = 0x1f0000
	          end_va = 0x1f0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001f0000"
	        filename = ""

Region:
	              id = 2545
	        start_va = 0x480000
	          end_va = 0x480fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 2546
	        start_va = 0x4f0000
	          end_va = 0x4fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004f0000"
	        filename = ""

Region:
	              id = 2547
	        start_va = 0x9c0000
	          end_va = 0xcf6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 2548
	        start_va = 0xd00000
	          end_va = 0xde9fff
	       monitored = 0
	     entry_point = 0xd3d650
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 2549
	        start_va = 0x490000
	          end_va = 0x493fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000490000"
	        filename = ""

Region:
	              id = 2550
	        start_va = 0xd00000
	          end_va = 0xddffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 2551
	        start_va = 0x76e20000
	          end_va = 0x76e2bfff
	       monitored = 0
	     entry_point = 0x76e23930
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")

Region:
	              id = 2552
	        start_va = 0x4a0000
	          end_va = 0x4a0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004a0000"
	        filename = ""

Region:
	              id = 2553
	        start_va = 0x76c80000
	          end_va = 0x76d03fff
	       monitored = 0
	     entry_point = 0x76ca6220
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 2554
	        start_va = 0x4b0000
	          end_va = 0x4b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004b0000"
	        filename = ""

Region:
	              id = 2555
	        start_va = 0x6cab0000
	          end_va = 0x6cabcfff
	       monitored = 0
	     entry_point = 0x6cab3520
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 2556
	        start_va = 0x6ca40000
	          end_va = 0x6caa6fff
	       monitored = 0
	     entry_point = 0x6ca5b610
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 2557
	        start_va = 0x740f0000
	          end_va = 0x7410afff
	       monitored = 0
	     entry_point = 0x740f9050
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 2558
	        start_va = 0x6c9f0000
	          end_va = 0x6ca33fff
	       monitored = 0
	     entry_point = 0x6ca0aaf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")

Region:
	              id = 2559
	        start_va = 0x540000
	          end_va = 0x57ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000540000"
	        filename = ""

Region:
	              id = 2560
	        start_va = 0x5a0000
	          end_va = 0x69ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005a0000"
	        filename = ""

Region:
	              id = 2561
	        start_va = 0xde0000
	          end_va = 0xe1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000de0000"
	        filename = ""

Region:
	              id = 2562
	        start_va = 0xe20000
	          end_va = 0xe5ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e20000"
	        filename = ""

Region:
	              id = 2563
	        start_va = 0xe60000
	          end_va = 0xe9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e60000"
	        filename = ""

Region:
	              id = 2564
	        start_va = 0xea0000
	          end_va = 0xedffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ea0000"
	        filename = ""

Region:
	              id = 2565
	        start_va = 0xee0000
	          end_va = 0xf1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ee0000"
	        filename = ""

Region:
	              id = 2566
	        start_va = 0x6c9d0000
	          end_va = 0x6c9e0fff
	       monitored = 0
	     entry_point = 0x6c9d8fa0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 2567
	        start_va = 0x6c910000
	          end_va = 0x6c9cefff
	       monitored = 0
	     entry_point = 0x6c941e80
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 2569
	        start_va = 0x4c0000
	          end_va = 0x4c5fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004c0000"
	        filename = ""


Thread:
	id = 208
	os_tid = 0x398


Thread:
	id = 209
	os_tid = 0x13a4


Thread:
	id = 210
	os_tid = 0x970


Thread:
	id = 211
	os_tid = 0x2e8


Thread:
	id = 212
	os_tid = 0x560


Process:
	id = "31"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x34240000"
	os_pid = "0xff8"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x614"
	cmd_line = "cmd.exe /c \"taskkill /f /im ocautoupds.exe \""
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 2572
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 2573
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 2574
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 2575
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 2576
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 2577
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 2578
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 2579
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 2580
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 2581
	        start_va = 0x13a0000
	          end_va = 0x13f1fff
	       monitored = 1
	     entry_point = 0x13b4fd0
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")

Region:
	              id = 2582
	        start_va = 0x1400000
	          end_va = 0x53fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001400000"
	        filename = ""

Region:
	              id = 2583
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 2584
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 2585
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 2586
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 2587
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 2588
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 2589
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 2590
	        start_va = 0x4e0000
	          end_va = 0x4effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004e0000"
	        filename = ""

Region:
	              id = 2591
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 2592
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 2593
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 2594
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 2595
	        start_va = 0x4f0000
	          end_va = 0x73ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004f0000"
	        filename = ""

Region:
	              id = 2596
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 2597
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 2598
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 2599
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 2600
	        start_va = 0x400000
	          end_va = 0x4bdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 2601
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 2602
	        start_va = 0x4f0000
	          end_va = 0x52ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004f0000"
	        filename = ""

Region:
	              id = 2603
	        start_va = 0x530000
	          end_va = 0x62ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000530000"
	        filename = ""

Region:
	              id = 2604
	        start_va = 0x640000
	          end_va = 0x73ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000640000"
	        filename = ""

Region:
	              id = 2605
	        start_va = 0x1d0000
	          end_va = 0x1fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001d0000"
	        filename = ""

Region:
	              id = 2606
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 2607
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 2608
	        start_va = 0x740000
	          end_va = 0xa76fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 213
	os_tid = 0x5e0

	[0143.513] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000
	[0143.513] __set_app_type (_Type=0x1) 
	[0143.513] __p__fmode () returned 0x74974d6c
	[0143.513] __p__commode () returned 0x74975b1c
	[0143.513] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13b5200) returned 0x0
	[0143.513] __getmainargs (in: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0, _DoWildCard=0, _StartInfo=0x13c60fc | out: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0) returned 0
	[0143.514] GetCurrentThreadId () returned 0x5e0
	[0143.514] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x5e0) returned 0x78
	[0143.514] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0143.514] GetProcAddress (hModule=0x75600000, lpProcName="SetThreadUILanguage") returned 0x75642510
	[0143.514] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0143.523] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0143.523] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2
	[0143.523] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0143.523] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0143.523] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0143.523] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0143.523] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0143.525] GetConsoleOutputCP () returned 0x1b5
	[0143.526] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0143.526] SetConsoleCtrlHandler (HandlerRoutine=0x13c0e40, Add=1) returned 1
	[0143.526] _get_osfhandle (_FileHandle=1) returned 0x13c
	[0143.526] SetConsoleMode (hConsoleHandle=0x13c, dwMode=0x0) returned 0
	[0143.526] _get_osfhandle (_FileHandle=1) returned 0x13c
	[0143.526] GetConsoleMode (in: hConsoleHandle=0x13c, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0143.526] _get_osfhandle (_FileHandle=0) returned 0x130
	[0143.526] GetConsoleMode (in: hConsoleHandle=0x130, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0143.526] GetEnvironmentStringsW () returned 0x647cc8*
	[0143.526] GetProcessHeap () returned 0x640000
	[0143.526] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0xa1a) returned 0x6486f0
	[0143.527] FreeEnvironmentStringsA (penv="A") returned 1
	[0143.527] GetProcessHeap () returned 0x640000
	[0143.527] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x4) returned 0x640550
	[0143.527] GetEnvironmentStringsW () returned 0x647cc8*
	[0143.527] GetProcessHeap () returned 0x640000
	[0143.527] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0xa1a) returned 0x649118
	[0143.527] FreeEnvironmentStringsA (penv="A") returned 1
	[0143.527] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0143.527] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0143.527] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0143.527] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0143.527] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0143.527] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0143.527] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0143.527] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0143.527] RegCloseKey (hKey=0x88) returned 0x0
	[0143.528] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0143.528] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0143.528] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0143.528] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0143.528] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0143.528] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0143.528] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0143.528] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0143.528] RegCloseKey (hKey=0x88) returned 0x0
	[0143.528] time (in: timer=0x0 | out: timer=0x0) returned 0x62344219
	[0143.528] srand (_Seed=0x62344219) 
	[0143.528] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im ocautoupds.exe \""
	[0143.528] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im ocautoupds.exe \""
	[0143.528] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0143.529] GetProcessHeap () returned 0x640000
	[0143.529] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x210) returned 0x649b40
	[0143.529] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x649b48, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0143.529] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0143.529] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0143.529] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0143.529] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0143.529] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0143.529] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0143.529] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0143.529] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0143.529] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0143.529] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0143.529] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0143.529] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0143.530] GetProcessHeap () returned 0x640000
	[0143.530] RtlFreeHeap (HeapHandle=0x640000, Flags=0x0, BaseAddress=0x6486f0) returned 1
	[0143.530] GetEnvironmentStringsW () returned 0x647cc8*
	[0143.530] GetProcessHeap () returned 0x640000
	[0143.530] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0xa32) returned 0x64a798
	[0143.530] FreeEnvironmentStringsA (penv="A") returned 1
	[0143.531] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b
	[0143.531] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0143.531] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0143.531] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0143.531] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0143.531] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0143.531] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0143.531] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0143.531] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0143.531] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0143.531] GetProcessHeap () returned 0x640000
	[0143.531] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x44) returned 0x6405c8
	[0143.531] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0143.531] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19fc4c*="Desktop") returned 0x1d
	[0143.531] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0143.531] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x640618
	[0143.532] FindClose (in: hFindFile=0x640618 | out: hFindFile=0x640618) returned 1
	[0143.532] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x640618
	[0143.532] FindClose (in: hFindFile=0x640618 | out: hFindFile=0x640618) returned 1
	[0143.532] _wcsnicmp (_String1="RDHJ0C~1", _String2="RDhJ0CNFevzX", _MaxCount=0xc) returned 16
	[0143.532] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x640618
	[0143.532] FindClose (in: hFindFile=0x640618 | out: hFindFile=0x640618) returned 1
	[0143.532] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0143.532] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1
	[0143.532] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 1
	[0143.532] GetProcessHeap () returned 0x640000
	[0143.533] RtlFreeHeap (HeapHandle=0x640000, Flags=0x0, BaseAddress=0x64a798) returned 1
	[0143.533] GetEnvironmentStringsW () returned 0x647cc8*
	[0143.533] GetProcessHeap () returned 0x640000
	[0143.533] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0xa76) returned 0x649d58
	[0143.533] FreeEnvironmentStringsA (penv="=") returned 1
	[0143.533] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0143.533] GetProcessHeap () returned 0x640000
	[0143.533] RtlFreeHeap (HeapHandle=0x640000, Flags=0x0, BaseAddress=0x6405c8) returned 1
	[0143.533] GetProcessHeap () returned 0x640000
	[0143.533] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x400e) returned 0x64bc58
	[0143.534] GetProcessHeap () returned 0x640000
	[0143.534] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x50) returned 0x64a7d8
	[0143.534] GetProcessHeap () returned 0x640000
	[0143.534] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x4008) returned 0x64fc70
	[0143.534] GetProcessHeap () returned 0x640000
	[0143.534] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x4008) returned 0x653c80
	[0143.536] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0143.536] GetProcessHeap () returned 0x640000
	[0143.536] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x418) returned 0x64a830
	[0143.536] SetErrorMode (uMode=0x0) returned 0x8003
	[0143.536] SetErrorMode (uMode=0x1) returned 0x0
	[0143.537] GetFullPathNameW (in: lpFileName="taskkill \\f \\.", nBufferLength=0x208, lpBuffer=0x64a838, lpFilePart=0x19fbac | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f", lpFilePart=0x19fbac*="f") returned 0x29
	[0143.537] SetErrorMode (uMode=0x8003) returned 0x1
	[0143.537] GetProcessHeap () returned 0x640000
	[0143.537] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x64a830, Size=0x82) returned 0x64a830
	[0143.537] GetProcessHeap () returned 0x640000
	[0143.537] RtlSizeHeap (HeapHandle=0x640000, Flags=0x0, MemoryPointer=0x64a830) returned 0x82
	[0143.537] NeedCurrentDirectoryForExePathW (ExeName="taskkill \\f \\.") returned 1
	[0143.537] GetProcessHeap () returned 0x640000
	[0143.537] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x62) returned 0x64a8c0
	[0143.537] GetProcessHeap () returned 0x640000
	[0143.537] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0xb8) returned 0x64a930
	[0143.537] GetProcessHeap () returned 0x640000
	[0143.537] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x64a930, Size=0x62) returned 0x64a930
	[0143.537] GetProcessHeap () returned 0x640000
	[0143.537] RtlSizeHeap (HeapHandle=0x640000, Flags=0x0, MemoryPointer=0x64a930) returned 0x62
	[0143.537] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0143.537] GetProcessHeap () returned 0x640000
	[0143.537] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0xe0) returned 0x64a9a0
	[0143.542] GetProcessHeap () returned 0x640000
	[0143.542] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x64a9a0, Size=0x76) returned 0x64a9a0
	[0143.542] GetProcessHeap () returned 0x640000
	[0143.542] RtlSizeHeap (HeapHandle=0x640000, Flags=0x0, MemoryPointer=0x64a9a0) returned 0x76
	[0143.542] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0143.542] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f\\im ocautoupds.exe ", fInfoLevelId=0x1, lpFindFileData=0x19f958, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f958) returned 0xffffffff
	[0143.543] GetLastError () returned 0x3
	[0143.543] GetProcessHeap () returned 0x640000
	[0143.543] RtlFreeHeap (HeapHandle=0x640000, Flags=0x0, BaseAddress=0x64fc70) returned 1
	[0143.543] GetProcessHeap () returned 0x640000
	[0143.544] RtlFreeHeap (HeapHandle=0x640000, Flags=0x0, BaseAddress=0x653c80) returned 1
	[0143.544] GetProcessHeap () returned 0x640000
	[0143.544] RtlFreeHeap (HeapHandle=0x640000, Flags=0x0, BaseAddress=0x64bc58) returned 1
	[0143.544] GetConsoleOutputCP () returned 0x1b5
	[0143.545] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0143.545] GetUserDefaultLCID () returned 0x409
	[0143.546] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x13d34a0, cchData=8 | out: lpLCData=":") returned 2
	[0143.546] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0143.546] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0143.546] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2
	[0143.546] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x13d34b0, cchData=8 | out: lpLCData="/") returned 2
	[0143.546] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x13d3500, cchData=32 | out: lpLCData="Mon") returned 4
	[0143.546] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x13d3540, cchData=32 | out: lpLCData="Tue") returned 4
	[0143.546] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x13d3580, cchData=32 | out: lpLCData="Wed") returned 4
	[0143.546] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x13d35c0, cchData=32 | out: lpLCData="Thu") returned 4
	[0143.546] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x13d3600, cchData=32 | out: lpLCData="Fri") returned 4
	[0143.546] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x13d3640, cchData=32 | out: lpLCData="Sat") returned 4
	[0143.546] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x13d3680, cchData=32 | out: lpLCData="Sun") returned 4
	[0143.546] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x13d34c0, cchData=8 | out: lpLCData=".") returned 2
	[0143.546] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x13d34e0, cchData=8 | out: lpLCData=",") returned 2
	[0143.546] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0143.548] GetProcessHeap () returned 0x640000
	[0143.548] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x20c) returned 0x64aa68
	[0143.548] GetConsoleTitleW (in: lpConsoleTitle=0x64aa68, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0143.550] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0143.550] GetProcAddress (hModule=0x75600000, lpProcName="CopyFileExW") returned 0x7561ffc0
	[0143.550] GetProcAddress (hModule=0x75600000, lpProcName="IsDebuggerPresent") returned 0x7561b0b0
	[0143.551] GetProcAddress (hModule=0x75600000, lpProcName="SetConsoleInputExeNameW") returned 0x7559b440
	[0143.551] GetProcessHeap () returned 0x640000
	[0143.551] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x400a) returned 0x64bc58
	[0143.551] GetProcessHeap () returned 0x640000
	[0143.551] RtlFreeHeap (HeapHandle=0x640000, Flags=0x0, BaseAddress=0x64bc58) returned 1
	[0143.552] _wcsicmp (_String1="taskkill", _String2=")") returned 75
	[0143.552] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14
	[0143.552] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14
	[0143.552] _wcsicmp (_String1="IF", _String2="taskkill") returned -11
	[0143.552] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11
	[0143.552] _wcsicmp (_String1="REM", _String2="taskkill") returned -2
	[0143.552] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2
	[0143.552] GetProcessHeap () returned 0x640000
	[0143.552] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x58) returned 0x64ac80
	[0143.552] GetProcessHeap () returned 0x640000
	[0143.553] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x1a) returned 0x640578
	[0143.553] GetProcessHeap () returned 0x640000
	[0143.553] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x38) returned 0x64ace0
	[0143.554] GetConsoleTitleW (in: lpConsoleTitle=0x19fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0143.560] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0143.560] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0143.560] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0143.560] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0143.560] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0143.560] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0143.560] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0143.560] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0143.560] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0143.560] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0143.560] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0143.560] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0143.560] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0143.560] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0143.560] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0143.560] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0143.560] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0143.560] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0143.560] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0143.560] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0143.560] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0143.560] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0143.560] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0143.560] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0143.560] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0143.560] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0143.561] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0143.561] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0143.561] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0143.561] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0143.561] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0143.561] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0143.561] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0143.561] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0143.561] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0143.561] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0143.561] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0143.561] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0143.561] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0143.561] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0143.561] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0143.561] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0143.561] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0143.561] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0143.561] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0143.561] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0143.561] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0143.561] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0143.561] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0143.561] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0143.561] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0143.561] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0143.561] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0143.561] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0143.561] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0143.562] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0143.562] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0143.562] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0143.562] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0143.562] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0143.562] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0143.562] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0143.562] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0143.562] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0143.562] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0143.562] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0143.562] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0143.562] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0143.562] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0143.562] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0143.562] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0143.562] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0143.562] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0143.562] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0143.562] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0143.562] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0143.562] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0143.562] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0143.562] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0143.562] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0143.562] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0143.562] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0143.562] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0143.562] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0143.562] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14
	[0143.562] _wcsicmp (_String1="taskkill", _String2="IF") returned 11
	[0143.563] _wcsicmp (_String1="taskkill", _String2="REM") returned 2
	[0143.563] GetProcessHeap () returned 0x640000
	[0143.563] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x210) returned 0x64ad20
	[0143.563] GetProcessHeap () returned 0x640000
	[0143.563] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x4a) returned 0x64af38
	[0143.563] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0143.564] GetProcessHeap () returned 0x640000
	[0143.564] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x418) returned 0x6405c8
	[0143.564] SetErrorMode (uMode=0x0) returned 0x8003
	[0143.564] SetErrorMode (uMode=0x1) returned 0x0
	[0143.564] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x6405d0, lpFilePart=0x19f57c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19f57c*="Desktop") returned 0x1d
	[0143.564] SetErrorMode (uMode=0x8003) returned 0x1
	[0143.564] GetProcessHeap () returned 0x640000
	[0143.564] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x6405c8, Size=0x56) returned 0x6405c8
	[0143.564] GetProcessHeap () returned 0x640000
	[0143.564] RtlSizeHeap (HeapHandle=0x640000, Flags=0x0, MemoryPointer=0x6405c8) returned 0x56
	[0143.564] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0143.564] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0143.564] GetProcessHeap () returned 0x640000
	[0143.564] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x110) returned 0x64af90
	[0143.564] GetProcessHeap () returned 0x640000
	[0143.564] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x218) returned 0x640628
	[0143.570] GetProcessHeap () returned 0x640000
	[0143.570] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x640628, Size=0x112) returned 0x640628
	[0143.570] GetProcessHeap () returned 0x640000
	[0143.570] RtlSizeHeap (HeapHandle=0x640000, Flags=0x0, MemoryPointer=0x640628) returned 0x112
	[0143.570] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0143.570] GetProcessHeap () returned 0x640000
	[0143.570] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0xe0) returned 0x64b0a8
	[0143.572] GetProcessHeap () returned 0x640000
	[0143.572] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x64b0a8, Size=0x76) returned 0x64b0a8
	[0143.572] GetProcessHeap () returned 0x640000
	[0143.572] RtlSizeHeap (HeapHandle=0x640000, Flags=0x0, MemoryPointer=0x64b0a8) returned 0x76
	[0143.572] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0143.572] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0143.572] GetLastError () returned 0x2
	[0143.572] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0143.573] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x64b128
	[0143.573] GetProcessHeap () returned 0x640000
	[0143.573] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x0, Size=0x14) returned 0x647630
	[0143.573] FindClose (in: hFindFile=0x64b128 | out: hFindFile=0x64b128) returned 1
	[0143.573] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0143.573] GetLastError () returned 0x2
	[0143.573] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x64b128
	[0143.573] GetProcessHeap () returned 0x640000
	[0143.573] RtlReAllocateHeap (Heap=0x640000, Flags=0x0, Ptr=0x647630, Size=0x4) returned 0x64b168
	[0143.574] FindClose (in: hFindFile=0x64b128 | out: hFindFile=0x64b128) returned 1
	[0143.574] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0143.574] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0143.574] GetConsoleTitleW (in: lpConsoleTitle=0x19f7fc, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0143.575] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f728, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f70c | out: lpAttributeList=0x19f728, lpSize=0x19f70c) returned 1
	[0143.575] UpdateProcThreadAttribute (in: lpAttributeList=0x19f728, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f714, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f728, lpPreviousValue=0x0) returned 1
	[0143.576] GetStartupInfoW (in: lpStartupInfo=0x19f760 | out: lpStartupInfo=0x19f760*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x130, hStdOutput=0x13c, hStdError=0x140)) 
	[0143.576] GetProcessHeap () returned 0x640000
	[0143.576] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0x18) returned 0x647410
	[0143.576] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0143.576] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0143.576] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0143.576] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0143.576] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0143.576] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0143.576] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0143.576] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0143.576] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0143.576] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0143.576] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0143.576] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0143.576] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0143.576] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0143.576] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0143.576] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0143.576] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0143.576] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0143.576] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0143.576] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0143.576] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0143.576] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0143.576] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0143.577] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0143.577] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0143.577] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0143.577] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0143.577] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0143.577] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0143.577] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0143.577] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0143.577] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0143.577] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0143.577] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0143.577] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0143.577] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0143.577] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0143.577] GetProcessHeap () returned 0x640000
	[0143.577] RtlFreeHeap (HeapHandle=0x640000, Flags=0x0, BaseAddress=0x647410) returned 1
	[0143.577] GetProcessHeap () returned 0x640000
	[0143.577] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0xa) returned 0x64b128
	[0143.577] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1
	[0143.580] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill  /f /im ocautoupds.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x19f6b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill  /f /im ocautoupds.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f6fc | out: lpCommandLine="taskkill  /f /im ocautoupds.exe ", lpProcessInformation=0x19f6fc*(hProcess=0x9c, hThread=0x98, dwProcessId=0xad0, dwThreadId=0xeac)) returned 1
	[0143.596] CloseHandle (hObject=0x98) returned 1
	[0143.596] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0143.596] GetProcessHeap () returned 0x640000
	[0143.596] RtlFreeHeap (HeapHandle=0x640000, Flags=0x0, BaseAddress=0x649d58) returned 1
	[0143.596] GetEnvironmentStringsW () returned 0x649d58*
	[0143.596] GetProcessHeap () returned 0x640000
	[0143.596] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0xa76) returned 0x647cc8
	[0143.596] FreeEnvironmentStringsA (penv="=") returned 1
	[0143.597] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0
	[0144.639] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x19f694 | out: lpExitCode=0x19f694*=0x80) returned 1
	[0144.639] CloseHandle (hObject=0x9c) returned 1
	[0144.639] _vsnwprintf (in: _Buffer=0x19f77c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f69c | out: _Buffer="00000080") returned 8
	[0144.640] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1
	[0144.640] GetProcessHeap () returned 0x640000
	[0144.641] RtlFreeHeap (HeapHandle=0x640000, Flags=0x0, BaseAddress=0x647cc8) returned 1
	[0144.641] GetEnvironmentStringsW () returned 0x64b178*
	[0144.641] GetProcessHeap () returned 0x640000
	[0144.641] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0xa9c) returned 0x647cc8
	[0144.641] FreeEnvironmentStringsA (penv="=") returned 1
	[0144.641] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0144.641] GetProcessHeap () returned 0x640000
	[0144.641] RtlFreeHeap (HeapHandle=0x640000, Flags=0x0, BaseAddress=0x647cc8) returned 1
	[0144.641] GetEnvironmentStringsW () returned 0x64b178*
	[0144.641] GetProcessHeap () returned 0x640000
	[0144.642] RtlAllocateHeap (HeapHandle=0x640000, Flags=0x8, Size=0xa9c) returned 0x647cc8
	[0144.642] FreeEnvironmentStringsA (penv="=") returned 1
	[0144.642] GetProcessHeap () returned 0x640000
	[0144.642] RtlFreeHeap (HeapHandle=0x640000, Flags=0x0, BaseAddress=0x64b128) returned 1
	[0144.642] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f728 | out: lpAttributeList=0x19f728) 
	[0144.642] _get_osfhandle (_FileHandle=1) returned 0x13c
	[0144.642] SetConsoleMode (hConsoleHandle=0x13c, dwMode=0x0) returned 0
	[0144.642] _get_osfhandle (_FileHandle=1) returned 0x13c
	[0144.642] GetConsoleMode (in: hConsoleHandle=0x13c, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0144.642] _get_osfhandle (_FileHandle=0) returned 0x130
	[0144.642] GetConsoleMode (in: hConsoleHandle=0x130, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0144.642] GetConsoleOutputCP () returned 0x1b5
	[0144.645] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0144.645] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0144.647] exit (_Code=128) 

Thread:
	id = 214
	os_tid = 0xf84


Process:
	id = "32"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\syswow64\\taskkill.exe"
	page_root = "0x342d8000"
	os_pid = "0xad0"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "31"
	os_parent_pid = "0xff8"
	cmd_line = "taskkill  /f /im ocautoupds.exe "
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 2609
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 2610
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 2611
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 2612
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 2613
	        start_va = 0xa0000
	          end_va = 0xdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 2614
	        start_va = 0xe0000
	          end_va = 0xe3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 2615
	        start_va = 0xf0000
	          end_va = 0xf0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 2616
	        start_va = 0x100000
	          end_va = 0x101fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 2617
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 2618
	        start_va = 0x13b0000
	          end_va = 0x13c5fff
	       monitored = 0
	     entry_point = 0x13bde80
	     region_type = mapped_file
	            name = "taskkill.exe"
	        filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe")

Region:
	              id = 2619
	        start_va = 0x13d0000
	          end_va = 0x53cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000013d0000"
	        filename = ""

Region:
	              id = 2620
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 2621
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 2622
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 2623
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 2624
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 2625
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 2626
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 2627
	        start_va = 0x5e0000
	          end_va = 0x5effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005e0000"
	        filename = ""

Region:
	              id = 2628
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 2629
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 2630
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 2631
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 2632
	        start_va = 0x400000
	          end_va = 0x4fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 2633
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 2634
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 2635
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 2636
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 2637
	        start_va = 0x110000
	          end_va = 0x1cdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 2638
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 2639
	        start_va = 0x74650000
	          end_va = 0x746cafff
	       monitored = 0
	     entry_point = 0x7466e970
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 2640
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 2641
	        start_va = 0x500000
	          end_va = 0x53ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000500000"
	        filename = ""

Region:
	              id = 2642
	        start_va = 0x540000
	          end_va = 0x57ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000540000"
	        filename = ""

Region:
	              id = 2643
	        start_va = 0x76ae0000
	          end_va = 0x76b23fff
	       monitored = 0
	     entry_point = 0x76af9d80
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 2644
	        start_va = 0x75260000
	          end_va = 0x7530cfff
	       monitored = 0
	     entry_point = 0x75274f00
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 2645
	        start_va = 0x74450000
	          end_va = 0x7446dfff
	       monitored = 0
	     entry_point = 0x7445b640
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 2646
	        start_va = 0x74440000
	          end_va = 0x74449fff
	       monitored = 0
	     entry_point = 0x74442a00
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 2647
	        start_va = 0x74590000
	          end_va = 0x745e7fff
	       monitored = 0
	     entry_point = 0x745d25c0
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 2648
	        start_va = 0x77450000
	          end_va = 0x77596fff
	       monitored = 0
	     entry_point = 0x77461cf0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 2649
	        start_va = 0x76b30000
	          end_va = 0x76c7efff
	       monitored = 0
	     entry_point = 0x76be6820
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 2650
	        start_va = 0x753c0000
	          end_va = 0x75451fff
	       monitored = 0
	     entry_point = 0x753f8cf0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 2651
	        start_va = 0x77290000
	          end_va = 0x7744cfff
	       monitored = 0
	     entry_point = 0x77372a10
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")

Region:
	              id = 2652
	        start_va = 0x75310000
	          end_va = 0x7536efff
	       monitored = 0
	     entry_point = 0x75314af0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 2653
	        start_va = 0x77240000
	          end_va = 0x77284fff
	       monitored = 0
	     entry_point = 0x7725de90
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 2654
	        start_va = 0x6cc90000
	          end_va = 0x6cc97fff
	       monitored = 0
	     entry_point = 0x6cc917b0
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 2655
	        start_va = 0x6cc70000
	          end_va = 0x6cc85fff
	       monitored = 0
	     entry_point = 0x6cc721d0
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")

Region:
	              id = 2656
	        start_va = 0x6cc30000
	          end_va = 0x6cc6efff
	       monitored = 0
	     entry_point = 0x6cc446c0
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll")

Region:
	              id = 2657
	        start_va = 0x6caf0000
	          end_va = 0x6cc2efff
	       monitored = 0
	     entry_point = 0x6cb1d880
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll")

Region:
	              id = 2658
	        start_va = 0x6cad0000
	          end_va = 0x6caebfff
	       monitored = 0
	     entry_point = 0x6cad4720
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")

Region:
	              id = 2659
	        start_va = 0x6cac0000
	          end_va = 0x6cac9fff
	       monitored = 0
	     entry_point = 0x6cac28d0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")

Region:
	              id = 2660
	        start_va = 0x5f0000
	          end_va = 0x76ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005f0000"
	        filename = ""

Region:
	              id = 2661
	        start_va = 0x1d0000
	          end_va = 0x1f9fff
	       monitored = 0
	     entry_point = 0x1d5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 2662
	        start_va = 0x770000
	          end_va = 0x8f7fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000770000"
	        filename = ""

Region:
	              id = 2663
	        start_va = 0x74ea0000
	          end_va = 0x74ecafff
	       monitored = 0
	     entry_point = 0x74ea5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 2664
	        start_va = 0x900000
	          end_va = 0xa80fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000900000"
	        filename = ""

Region:
	              id = 2665
	        start_va = 0x53d0000
	          end_va = 0x67cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000053d0000"
	        filename = ""

Region:
	              id = 2666
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 2667
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001d0000"
	        filename = ""

Region:
	              id = 2668
	        start_va = 0x1e0000
	          end_va = 0x1e4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taskkill.exe.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui")

Region:
	              id = 2669
	        start_va = 0x1f0000
	          end_va = 0x1f0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001f0000"
	        filename = ""

Region:
	              id = 2670
	        start_va = 0x580000
	          end_va = 0x580fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000580000"
	        filename = ""

Region:
	              id = 2671
	        start_va = 0xa90000
	          end_va = 0xdc6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 2672
	        start_va = 0x5f0000
	          end_va = 0x6d9fff
	       monitored = 0
	     entry_point = 0x62d650
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 2673
	        start_va = 0x760000
	          end_va = 0x76ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000760000"
	        filename = ""

Region:
	              id = 2674
	        start_va = 0x590000
	          end_va = 0x593fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000590000"
	        filename = ""

Region:
	              id = 2675
	        start_va = 0x5f0000
	          end_va = 0x6cffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 2676
	        start_va = 0x76e20000
	          end_va = 0x76e2bfff
	       monitored = 0
	     entry_point = 0x76e23930
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")

Region:
	              id = 2677
	        start_va = 0x5a0000
	          end_va = 0x5a0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000005a0000"
	        filename = ""

Region:
	              id = 2678
	        start_va = 0x76c80000
	          end_va = 0x76d03fff
	       monitored = 0
	     entry_point = 0x76ca6220
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 2679
	        start_va = 0x5b0000
	          end_va = 0x5b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000005b0000"
	        filename = ""

Region:
	              id = 2680
	        start_va = 0x6cab0000
	          end_va = 0x6cabcfff
	       monitored = 0
	     entry_point = 0x6cab3520
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 2681
	        start_va = 0x6ca40000
	          end_va = 0x6caa6fff
	       monitored = 0
	     entry_point = 0x6ca5b610
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 2682
	        start_va = 0x740f0000
	          end_va = 0x7410afff
	       monitored = 0
	     entry_point = 0x740f9050
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 2683
	        start_va = 0x6c9f0000
	          end_va = 0x6ca33fff
	       monitored = 0
	     entry_point = 0x6ca0aaf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")

Region:
	              id = 2684
	        start_va = 0x6d0000
	          end_va = 0x70ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006d0000"
	        filename = ""

Region:
	              id = 2685
	        start_va = 0x710000
	          end_va = 0x74ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000710000"
	        filename = ""

Region:
	              id = 2686
	        start_va = 0xdd0000
	          end_va = 0xe0ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000dd0000"
	        filename = ""

Region:
	              id = 2687
	        start_va = 0xe10000
	          end_va = 0xe4ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e10000"
	        filename = ""

Region:
	              id = 2688
	        start_va = 0xe50000
	          end_va = 0xe8ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e50000"
	        filename = ""

Region:
	              id = 2689
	        start_va = 0xe90000
	          end_va = 0xecffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e90000"
	        filename = ""

Region:
	              id = 2690
	        start_va = 0x6c9d0000
	          end_va = 0x6c9e0fff
	       monitored = 0
	     entry_point = 0x6c9d8fa0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 2691
	        start_va = 0x6c910000
	          end_va = 0x6c9cefff
	       monitored = 0
	     entry_point = 0x6c941e80
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 2693
	        start_va = 0x5c0000
	          end_va = 0x5c5fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000005c0000"
	        filename = ""


Thread:
	id = 215
	os_tid = 0xeac


Thread:
	id = 216
	os_tid = 0xbec


Thread:
	id = 217
	os_tid = 0x55c


Thread:
	id = 218
	os_tid = 0x13e0


Thread:
	id = 219
	os_tid = 0xd94


Process:
	id = "33"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x5024d000"
	os_pid = "0xc2c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x614"
	cmd_line = "cmd.exe /c \"taskkill /f /im agntsvc.exeagntsvc.exe \""
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 2696
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 2697
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 2698
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 2699
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 2700
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 2701
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 2702
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 2703
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 2704
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 2705
	        start_va = 0x13a0000
	          end_va = 0x13f1fff
	       monitored = 1
	     entry_point = 0x13b4fd0
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")

Region:
	              id = 2706
	        start_va = 0x1400000
	          end_va = 0x53fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001400000"
	        filename = ""

Region:
	              id = 2707
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 2708
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 2709
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 2710
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 2711
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 2712
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 2713
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 2714
	        start_va = 0x5b0000
	          end_va = 0x5bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005b0000"
	        filename = ""

Region:
	              id = 2715
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 2716
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 2717
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 2718
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 2719
	        start_va = 0x5c0000
	          end_va = 0x7dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005c0000"
	        filename = ""

Region:
	              id = 2720
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 2721
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 2722
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 2723
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 2724
	        start_va = 0x400000
	          end_va = 0x4bdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 2725
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 2726
	        start_va = 0x4c0000
	          end_va = 0x4fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004c0000"
	        filename = ""

Region:
	              id = 2727
	        start_va = 0x5c0000
	          end_va = 0x6bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005c0000"
	        filename = ""

Region:
	              id = 2728
	        start_va = 0x6e0000
	          end_va = 0x7dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006e0000"
	        filename = ""

Region:
	              id = 2729
	        start_va = 0x7e0000
	          end_va = 0x8dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000007e0000"
	        filename = ""

Region:
	              id = 2730
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 2731
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 2732
	        start_va = 0x8e0000
	          end_va = 0xc16fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 220
	os_tid = 0x1398

	[0144.865] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000
	[0144.865] __set_app_type (_Type=0x1) 
	[0144.865] __p__fmode () returned 0x74974d6c
	[0144.865] __p__commode () returned 0x74975b1c
	[0144.866] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13b5200) returned 0x0
	[0144.866] __getmainargs (in: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0, _DoWildCard=0, _StartInfo=0x13c60fc | out: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0) returned 0
	[0144.866] GetCurrentThreadId () returned 0x1398
	[0144.866] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x1398) returned 0x78
	[0144.866] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0144.866] GetProcAddress (hModule=0x75600000, lpProcName="SetThreadUILanguage") returned 0x75642510
	[0144.866] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0144.873] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0144.873] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2
	[0144.873] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0144.873] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0144.873] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0144.873] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0144.873] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0144.874] GetConsoleOutputCP () returned 0x1b5
	[0144.875] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0144.875] SetConsoleCtrlHandler (HandlerRoutine=0x13c0e40, Add=1) returned 1
	[0144.875] _get_osfhandle (_FileHandle=1) returned 0x130
	[0144.875] SetConsoleMode (hConsoleHandle=0x130, dwMode=0x0) returned 0
	[0144.876] _get_osfhandle (_FileHandle=1) returned 0x130
	[0144.876] GetConsoleMode (in: hConsoleHandle=0x130, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0144.876] _get_osfhandle (_FileHandle=0) returned 0x154
	[0144.876] GetConsoleMode (in: hConsoleHandle=0x154, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0144.876] GetEnvironmentStringsW () returned 0x6e7ce0*
	[0144.876] GetProcessHeap () returned 0x6e0000
	[0144.876] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0xa1a) returned 0x6e8708
	[0144.876] FreeEnvironmentStringsA (penv="A") returned 1
	[0144.876] GetProcessHeap () returned 0x6e0000
	[0144.876] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0x4) returned 0x6e0550
	[0144.876] GetEnvironmentStringsW () returned 0x6e7ce0*
	[0144.876] GetProcessHeap () returned 0x6e0000
	[0144.876] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0xa1a) returned 0x6e9130
	[0144.876] FreeEnvironmentStringsA (penv="A") returned 1
	[0144.876] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0144.876] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0144.876] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0144.877] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0144.877] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0144.877] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0144.877] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0144.877] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0144.877] RegCloseKey (hKey=0x88) returned 0x0
	[0144.877] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0144.877] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0144.877] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0144.877] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0144.877] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0144.877] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0144.877] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0144.877] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0144.877] RegCloseKey (hKey=0x88) returned 0x0
	[0144.877] time (in: timer=0x0 | out: timer=0x0) returned 0x6234421b
	[0144.877] srand (_Seed=0x6234421b) 
	[0144.877] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im agntsvc.exeagntsvc.exe \""
	[0144.877] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im agntsvc.exeagntsvc.exe \""
	[0144.877] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0144.878] GetProcessHeap () returned 0x6e0000
	[0144.878] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0x210) returned 0x6e9b58
	[0144.878] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6e9b60, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0144.878] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0144.878] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0144.878] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0144.878] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0144.878] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0144.878] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0144.878] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0144.878] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0144.878] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0144.878] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0144.878] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0144.879] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0144.879] GetProcessHeap () returned 0x6e0000
	[0144.880] RtlFreeHeap (HeapHandle=0x6e0000, Flags=0x0, BaseAddress=0x6e8708) returned 1
	[0144.880] GetEnvironmentStringsW () returned 0x6e7ce0*
	[0144.880] GetProcessHeap () returned 0x6e0000
	[0144.880] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0xa32) returned 0x6ea7b0
	[0144.880] FreeEnvironmentStringsA (penv="A") returned 1
	[0144.880] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b
	[0144.880] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0144.880] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0144.880] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0144.880] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0144.880] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0144.880] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0144.880] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0144.880] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0144.880] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0144.881] GetProcessHeap () returned 0x6e0000
	[0144.881] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0x44) returned 0x6e05c8
	[0144.881] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0144.881] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19fc4c*="Desktop") returned 0x1d
	[0144.881] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0144.881] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x6e0618
	[0144.881] FindClose (in: hFindFile=0x6e0618 | out: hFindFile=0x6e0618) returned 1
	[0144.881] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x6e0618
	[0144.882] FindClose (in: hFindFile=0x6e0618 | out: hFindFile=0x6e0618) returned 1
	[0144.882] _wcsnicmp (_String1="RDHJ0C~1", _String2="RDhJ0CNFevzX", _MaxCount=0xc) returned 16
	[0144.882] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x6e0618
	[0144.882] FindClose (in: hFindFile=0x6e0618 | out: hFindFile=0x6e0618) returned 1
	[0144.882] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0144.882] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1
	[0144.882] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 1
	[0144.882] GetProcessHeap () returned 0x6e0000
	[0144.882] RtlFreeHeap (HeapHandle=0x6e0000, Flags=0x0, BaseAddress=0x6ea7b0) returned 1
	[0144.882] GetEnvironmentStringsW () returned 0x6e7ce0*
	[0144.883] GetProcessHeap () returned 0x6e0000
	[0144.883] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0xa76) returned 0x6e9d70
	[0144.883] FreeEnvironmentStringsA (penv="=") returned 1
	[0144.883] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0144.883] GetProcessHeap () returned 0x6e0000
	[0144.883] RtlFreeHeap (HeapHandle=0x6e0000, Flags=0x0, BaseAddress=0x6e05c8) returned 1
	[0144.883] GetProcessHeap () returned 0x6e0000
	[0144.883] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0x400e) returned 0x6ebc70
	[0144.883] GetProcessHeap () returned 0x6e0000
	[0144.884] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0x60) returned 0x6ea7f0
	[0144.884] GetProcessHeap () returned 0x6e0000
	[0144.884] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0x4008) returned 0x6efc88
	[0144.885] GetProcessHeap () returned 0x6e0000
	[0144.885] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0x4008) returned 0x6f3c98
	[0144.886] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0144.887] GetProcessHeap () returned 0x6e0000
	[0144.887] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0x418) returned 0x6ea858
	[0144.887] SetErrorMode (uMode=0x0) returned 0x8003
	[0144.887] SetErrorMode (uMode=0x1) returned 0x0
	[0144.887] GetFullPathNameW (in: lpFileName="taskkill \\f \\.", nBufferLength=0x208, lpBuffer=0x6ea860, lpFilePart=0x19fbac | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f", lpFilePart=0x19fbac*="f") returned 0x29
	[0144.887] SetErrorMode (uMode=0x8003) returned 0x1
	[0144.887] GetProcessHeap () returned 0x6e0000
	[0144.887] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6ea858, Size=0x92) returned 0x6ea858
	[0144.887] GetProcessHeap () returned 0x6e0000
	[0144.887] RtlSizeHeap (HeapHandle=0x6e0000, Flags=0x0, MemoryPointer=0x6ea858) returned 0x92
	[0144.887] NeedCurrentDirectoryForExePathW (ExeName="taskkill \\f \\.") returned 1
	[0144.887] GetProcessHeap () returned 0x6e0000
	[0144.888] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0x62) returned 0x6ea8f8
	[0144.888] GetProcessHeap () returned 0x6e0000
	[0144.888] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0xb8) returned 0x6ea968
	[0144.888] GetProcessHeap () returned 0x6e0000
	[0144.888] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6ea968, Size=0x62) returned 0x6ea968
	[0144.888] GetProcessHeap () returned 0x6e0000
	[0144.888] RtlSizeHeap (HeapHandle=0x6e0000, Flags=0x0, MemoryPointer=0x6ea968) returned 0x62
	[0144.888] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0144.888] GetProcessHeap () returned 0x6e0000
	[0144.888] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0xe0) returned 0x6ea9d8
	[0144.892] GetProcessHeap () returned 0x6e0000
	[0144.892] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6ea9d8, Size=0x76) returned 0x6ea9d8
	[0144.892] GetProcessHeap () returned 0x6e0000
	[0144.892] RtlSizeHeap (HeapHandle=0x6e0000, Flags=0x0, MemoryPointer=0x6ea9d8) returned 0x76
	[0144.892] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0144.892] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f\\im agntsvc.exeagntsvc.exe ", fInfoLevelId=0x1, lpFindFileData=0x19f958, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f958) returned 0xffffffff
	[0144.893] GetLastError () returned 0x3
	[0144.893] GetProcessHeap () returned 0x6e0000
	[0144.893] RtlFreeHeap (HeapHandle=0x6e0000, Flags=0x0, BaseAddress=0x6efc88) returned 1
	[0144.894] GetProcessHeap () returned 0x6e0000
	[0144.895] RtlFreeHeap (HeapHandle=0x6e0000, Flags=0x0, BaseAddress=0x6f3c98) returned 1
	[0144.895] GetProcessHeap () returned 0x6e0000
	[0144.895] RtlFreeHeap (HeapHandle=0x6e0000, Flags=0x0, BaseAddress=0x6ebc70) returned 1
	[0144.895] GetConsoleOutputCP () returned 0x1b5
	[0144.898] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0144.898] GetUserDefaultLCID () returned 0x409
	[0144.898] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x13d34a0, cchData=8 | out: lpLCData=":") returned 2
	[0144.899] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0144.899] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0144.899] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2
	[0144.899] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x13d34b0, cchData=8 | out: lpLCData="/") returned 2
	[0144.899] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x13d3500, cchData=32 | out: lpLCData="Mon") returned 4
	[0144.899] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x13d3540, cchData=32 | out: lpLCData="Tue") returned 4
	[0144.899] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x13d3580, cchData=32 | out: lpLCData="Wed") returned 4
	[0144.899] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x13d35c0, cchData=32 | out: lpLCData="Thu") returned 4
	[0144.899] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x13d3600, cchData=32 | out: lpLCData="Fri") returned 4
	[0144.899] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x13d3640, cchData=32 | out: lpLCData="Sat") returned 4
	[0144.899] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x13d3680, cchData=32 | out: lpLCData="Sun") returned 4
	[0144.899] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x13d34c0, cchData=8 | out: lpLCData=".") returned 2
	[0144.899] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x13d34e0, cchData=8 | out: lpLCData=",") returned 2
	[0144.899] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0144.901] GetProcessHeap () returned 0x6e0000
	[0144.901] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x20c) returned 0x6eaaa0
	[0144.901] GetConsoleTitleW (in: lpConsoleTitle=0x6eaaa0, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0144.905] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0144.905] GetProcAddress (hModule=0x75600000, lpProcName="CopyFileExW") returned 0x7561ffc0
	[0144.905] GetProcAddress (hModule=0x75600000, lpProcName="IsDebuggerPresent") returned 0x7561b0b0
	[0144.905] GetProcAddress (hModule=0x75600000, lpProcName="SetConsoleInputExeNameW") returned 0x7559b440
	[0144.906] GetProcessHeap () returned 0x6e0000
	[0144.906] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0x400a) returned 0x6ebc70
	[0144.906] GetProcessHeap () returned 0x6e0000
	[0144.906] RtlFreeHeap (HeapHandle=0x6e0000, Flags=0x0, BaseAddress=0x6ebc70) returned 1
	[0144.907] _wcsicmp (_String1="taskkill", _String2=")") returned 75
	[0144.907] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14
	[0144.907] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14
	[0144.907] _wcsicmp (_String1="IF", _String2="taskkill") returned -11
	[0144.907] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11
	[0144.907] _wcsicmp (_String1="REM", _String2="taskkill") returned -2
	[0144.907] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2
	[0144.907] GetProcessHeap () returned 0x6e0000
	[0144.907] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0x58) returned 0x6eacb8
	[0144.907] GetProcessHeap () returned 0x6e0000
	[0144.907] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0x1a) returned 0x6e0578
	[0144.908] GetProcessHeap () returned 0x6e0000
	[0144.908] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0x48) returned 0x6ead18
	[0144.910] GetConsoleTitleW (in: lpConsoleTitle=0x19fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0144.912] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0144.912] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0144.912] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0144.912] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0144.912] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0144.912] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0144.912] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0144.912] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0144.912] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0144.912] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0144.912] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0144.912] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0144.912] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0144.913] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0144.913] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0144.913] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0144.913] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0144.913] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0144.913] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0144.913] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0144.913] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0144.913] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0144.913] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0144.913] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0144.913] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0144.913] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0144.913] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0144.913] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0144.913] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0144.913] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0144.913] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0144.913] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0144.913] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0144.913] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0144.913] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0144.913] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0144.913] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0144.913] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0144.913] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0144.913] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0144.913] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0144.913] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0144.913] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0144.913] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0144.914] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0144.914] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0144.914] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0144.914] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0144.914] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0144.914] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0144.914] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0144.914] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0144.914] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0144.914] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0144.914] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0144.914] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0144.914] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0144.914] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0144.914] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0144.914] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0144.914] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0144.914] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0144.914] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0144.914] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0144.914] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0144.914] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0144.914] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0144.914] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0144.914] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0144.914] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0144.914] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0144.914] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0144.914] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0144.914] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0144.914] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0144.915] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0144.915] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0144.915] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0144.915] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0144.915] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0144.915] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0144.915] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0144.915] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0144.915] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0144.915] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14
	[0144.915] _wcsicmp (_String1="taskkill", _String2="IF") returned 11
	[0144.915] _wcsicmp (_String1="taskkill", _String2="REM") returned 2
	[0144.915] GetProcessHeap () returned 0x6e0000
	[0144.915] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0x210) returned 0x6ead68
	[0144.915] GetProcessHeap () returned 0x6e0000
	[0144.915] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0x5a) returned 0x6eaf80
	[0144.915] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0144.916] GetProcessHeap () returned 0x6e0000
	[0144.916] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0x418) returned 0x6e05c8
	[0144.916] SetErrorMode (uMode=0x0) returned 0x8003
	[0144.916] SetErrorMode (uMode=0x1) returned 0x0
	[0144.916] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x6e05d0, lpFilePart=0x19f57c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19f57c*="Desktop") returned 0x1d
	[0144.916] SetErrorMode (uMode=0x8003) returned 0x1
	[0144.916] GetProcessHeap () returned 0x6e0000
	[0144.916] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6e05c8, Size=0x56) returned 0x6e05c8
	[0144.916] GetProcessHeap () returned 0x6e0000
	[0144.916] RtlSizeHeap (HeapHandle=0x6e0000, Flags=0x0, MemoryPointer=0x6e05c8) returned 0x56
	[0144.916] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0144.916] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0144.916] GetProcessHeap () returned 0x6e0000
	[0144.916] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0x110) returned 0x6eafe8
	[0144.916] GetProcessHeap () returned 0x6e0000
	[0144.916] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0x218) returned 0x6e0628
	[0144.921] GetProcessHeap () returned 0x6e0000
	[0144.921] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6e0628, Size=0x112) returned 0x6e0628
	[0144.921] GetProcessHeap () returned 0x6e0000
	[0144.921] RtlSizeHeap (HeapHandle=0x6e0000, Flags=0x0, MemoryPointer=0x6e0628) returned 0x112
	[0144.922] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0144.922] GetProcessHeap () returned 0x6e0000
	[0144.922] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0xe0) returned 0x6eb100
	[0144.923] GetProcessHeap () returned 0x6e0000
	[0144.923] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6eb100, Size=0x76) returned 0x6eb100
	[0144.923] GetProcessHeap () returned 0x6e0000
	[0144.923] RtlSizeHeap (HeapHandle=0x6e0000, Flags=0x0, MemoryPointer=0x6eb100) returned 0x76
	[0144.924] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0144.924] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0144.924] GetLastError () returned 0x2
	[0144.924] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0144.924] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x6eb180
	[0144.924] GetProcessHeap () returned 0x6e0000
	[0144.924] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x14) returned 0x6e7548
	[0144.924] FindClose (in: hFindFile=0x6eb180 | out: hFindFile=0x6eb180) returned 1
	[0144.924] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0144.945] GetLastError () returned 0x2
	[0144.945] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x6eb180
	[0144.945] GetProcessHeap () returned 0x6e0000
	[0144.945] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6e7548, Size=0x4) returned 0x6eb1c0
	[0144.945] FindClose (in: hFindFile=0x6eb180 | out: hFindFile=0x6eb180) returned 1
	[0144.945] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0144.945] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0144.945] GetConsoleTitleW (in: lpConsoleTitle=0x19f7fc, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0144.946] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f728, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f70c | out: lpAttributeList=0x19f728, lpSize=0x19f70c) returned 1
	[0144.946] UpdateProcThreadAttribute (in: lpAttributeList=0x19f728, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f714, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f728, lpPreviousValue=0x0) returned 1
	[0144.946] GetStartupInfoW (in: lpStartupInfo=0x19f760 | out: lpStartupInfo=0x19f760*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x154, hStdOutput=0x130, hStdError=0x13c)) 
	[0144.946] GetProcessHeap () returned 0x6e0000
	[0144.946] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0x18) returned 0x6e7468
	[0144.946] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0144.946] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0144.946] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0144.946] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0144.946] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0144.947] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0144.947] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0144.947] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0144.947] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0144.947] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0144.947] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0144.947] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0144.947] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0144.947] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0144.947] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0144.947] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0144.947] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0144.947] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0144.947] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0144.947] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0144.947] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0144.947] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0144.947] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0144.947] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0144.947] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0144.947] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0144.947] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0144.947] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0144.947] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0144.947] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0144.947] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0144.947] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0144.947] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0144.947] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0144.947] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0144.947] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0144.947] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0144.948] GetProcessHeap () returned 0x6e0000
	[0144.948] RtlFreeHeap (HeapHandle=0x6e0000, Flags=0x0, BaseAddress=0x6e7468) returned 1
	[0144.948] GetProcessHeap () returned 0x6e0000
	[0144.948] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0xa) returned 0x6eb1d0
	[0144.948] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1
	[0144.958] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill  /f /im agntsvc.exeagntsvc.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x19f6b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill  /f /im agntsvc.exeagntsvc.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f6fc | out: lpCommandLine="taskkill  /f /im agntsvc.exeagntsvc.exe ", lpProcessInformation=0x19f6fc*(hProcess=0x9c, hThread=0x98, dwProcessId=0xc1c, dwThreadId=0xf18)) returned 1
	[0144.974] CloseHandle (hObject=0x98) returned 1
	[0144.974] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0144.974] GetProcessHeap () returned 0x6e0000
	[0144.975] RtlFreeHeap (HeapHandle=0x6e0000, Flags=0x0, BaseAddress=0x6e9d70) returned 1
	[0144.975] GetEnvironmentStringsW () returned 0x6e9d70*
	[0144.975] GetProcessHeap () returned 0x6e0000
	[0144.975] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0xa76) returned 0x6e7ce0
	[0144.975] FreeEnvironmentStringsA (penv="=") returned 1
	[0144.975] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0
	[0145.913] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x19f694 | out: lpExitCode=0x19f694*=0x80) returned 1
	[0145.914] CloseHandle (hObject=0x9c) returned 1
	[0145.914] _vsnwprintf (in: _Buffer=0x19f77c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f69c | out: _Buffer="00000080") returned 8
	[0145.914] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1
	[0145.915] GetProcessHeap () returned 0x6e0000
	[0145.915] RtlFreeHeap (HeapHandle=0x6e0000, Flags=0x0, BaseAddress=0x6e7ce0) returned 1
	[0145.915] GetEnvironmentStringsW () returned 0x6e7ce0*
	[0145.915] GetProcessHeap () returned 0x6e0000
	[0145.915] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0xa9c) returned 0x6ec718
	[0145.915] FreeEnvironmentStringsA (penv="=") returned 1
	[0145.915] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0145.915] GetProcessHeap () returned 0x6e0000
	[0145.915] RtlFreeHeap (HeapHandle=0x6e0000, Flags=0x0, BaseAddress=0x6ec718) returned 1
	[0145.916] GetEnvironmentStringsW () returned 0x6e7ce0*
	[0145.916] GetProcessHeap () returned 0x6e0000
	[0145.916] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0xa9c) returned 0x6ec718
	[0145.917] FreeEnvironmentStringsA (penv="=") returned 1
	[0145.917] GetProcessHeap () returned 0x6e0000
	[0145.917] RtlFreeHeap (HeapHandle=0x6e0000, Flags=0x0, BaseAddress=0x6eb1d0) returned 1
	[0145.917] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f728 | out: lpAttributeList=0x19f728) 
	[0145.917] _get_osfhandle (_FileHandle=1) returned 0x130
	[0145.917] SetConsoleMode (hConsoleHandle=0x130, dwMode=0x0) returned 0
	[0145.917] _get_osfhandle (_FileHandle=1) returned 0x130
	[0145.917] GetConsoleMode (in: hConsoleHandle=0x130, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0145.917] _get_osfhandle (_FileHandle=0) returned 0x154
	[0145.917] GetConsoleMode (in: hConsoleHandle=0x154, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0145.917] GetConsoleOutputCP () returned 0x1b5
	[0145.919] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0145.919] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0145.920] exit (_Code=128) 

Thread:
	id = 221
	os_tid = 0x860


Process:
	id = "34"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\syswow64\\taskkill.exe"
	page_root = "0x3416e000"
	os_pid = "0xc1c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "33"
	os_parent_pid = "0xc2c"
	cmd_line = "taskkill  /f /im agntsvc.exeagntsvc.exe "
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 2733
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 2734
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 2735
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 2736
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 2737
	        start_va = 0xa0000
	          end_va = 0xdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 2738
	        start_va = 0xe0000
	          end_va = 0xe3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 2739
	        start_va = 0xf0000
	          end_va = 0xf0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 2740
	        start_va = 0x100000
	          end_va = 0x101fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 2741
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 2742
	        start_va = 0x13b0000
	          end_va = 0x13c5fff
	       monitored = 0
	     entry_point = 0x13bde80
	     region_type = mapped_file
	            name = "taskkill.exe"
	        filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe")

Region:
	              id = 2743
	        start_va = 0x13d0000
	          end_va = 0x53cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000013d0000"
	        filename = ""

Region:
	              id = 2744
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 2745
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 2746
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 2747
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 2748
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 2749
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 2750
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 2751
	        start_va = 0x540000
	          end_va = 0x54ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000540000"
	        filename = ""

Region:
	              id = 2752
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 2753
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 2754
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 2755
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 2756
	        start_va = 0x550000
	          end_va = 0x7cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000550000"
	        filename = ""

Region:
	              id = 2757
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 2758
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 2759
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 2760
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 2761
	        start_va = 0x110000
	          end_va = 0x1cdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 2762
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 2763
	        start_va = 0x74650000
	          end_va = 0x746cafff
	       monitored = 0
	     entry_point = 0x7466e970
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 2764
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 2765
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 2766
	        start_va = 0x440000
	          end_va = 0x47ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000440000"
	        filename = ""

Region:
	              id = 2767
	        start_va = 0x76ae0000
	          end_va = 0x76b23fff
	       monitored = 0
	     entry_point = 0x76af9d80
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 2768
	        start_va = 0x75260000
	          end_va = 0x7530cfff
	       monitored = 0
	     entry_point = 0x75274f00
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 2769
	        start_va = 0x74450000
	          end_va = 0x7446dfff
	       monitored = 0
	     entry_point = 0x7445b640
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 2770
	        start_va = 0x74440000
	          end_va = 0x74449fff
	       monitored = 0
	     entry_point = 0x74442a00
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 2771
	        start_va = 0x74590000
	          end_va = 0x745e7fff
	       monitored = 0
	     entry_point = 0x745d25c0
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 2772
	        start_va = 0x77450000
	          end_va = 0x77596fff
	       monitored = 0
	     entry_point = 0x77461cf0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 2773
	        start_va = 0x6cc90000
	          end_va = 0x6cc97fff
	       monitored = 0
	     entry_point = 0x6cc917b0
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 2774
	        start_va = 0x76b30000
	          end_va = 0x76c7efff
	       monitored = 0
	     entry_point = 0x76be6820
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 2775
	        start_va = 0x753c0000
	          end_va = 0x75451fff
	       monitored = 0
	     entry_point = 0x753f8cf0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 2776
	        start_va = 0x77290000
	          end_va = 0x7744cfff
	       monitored = 0
	     entry_point = 0x77372a10
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")

Region:
	              id = 2777
	        start_va = 0x75310000
	          end_va = 0x7536efff
	       monitored = 0
	     entry_point = 0x75314af0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 2778
	        start_va = 0x77240000
	          end_va = 0x77284fff
	       monitored = 0
	     entry_point = 0x7725de90
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 2779
	        start_va = 0x6cc70000
	          end_va = 0x6cc85fff
	       monitored = 0
	     entry_point = 0x6cc721d0
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")

Region:
	              id = 2780
	        start_va = 0x6cc30000
	          end_va = 0x6cc6efff
	       monitored = 0
	     entry_point = 0x6cc446c0
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll")

Region:
	              id = 2781
	        start_va = 0x6caf0000
	          end_va = 0x6cc2efff
	       monitored = 0
	     entry_point = 0x6cb1d880
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll")

Region:
	              id = 2782
	        start_va = 0x6cad0000
	          end_va = 0x6caebfff
	       monitored = 0
	     entry_point = 0x6cad4720
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")

Region:
	              id = 2783
	        start_va = 0x6cac0000
	          end_va = 0x6cac9fff
	       monitored = 0
	     entry_point = 0x6cac28d0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")

Region:
	              id = 2784
	        start_va = 0x7d0000
	          end_va = 0x9cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000007d0000"
	        filename = ""

Region:
	              id = 2785
	        start_va = 0x1d0000
	          end_va = 0x1f9fff
	       monitored = 0
	     entry_point = 0x1d5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 2786
	        start_va = 0x7d0000
	          end_va = 0x957fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000007d0000"
	        filename = ""

Region:
	              id = 2787
	        start_va = 0x9c0000
	          end_va = 0x9cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000009c0000"
	        filename = ""

Region:
	              id = 2788
	        start_va = 0x74ea0000
	          end_va = 0x74ecafff
	       monitored = 0
	     entry_point = 0x74ea5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 2789
	        start_va = 0x9d0000
	          end_va = 0xb50fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000009d0000"
	        filename = ""

Region:
	              id = 2790
	        start_va = 0x53d0000
	          end_va = 0x67cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000053d0000"
	        filename = ""

Region:
	              id = 2791
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 2792
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001d0000"
	        filename = ""

Region:
	              id = 2793
	        start_va = 0x1e0000
	          end_va = 0x1e4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taskkill.exe.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui")

Region:
	              id = 2794
	        start_va = 0x1f0000
	          end_va = 0x1f0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001f0000"
	        filename = ""

Region:
	              id = 2795
	        start_va = 0x480000
	          end_va = 0x480fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 2796
	        start_va = 0xb60000
	          end_va = 0xe96fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 2797
	        start_va = 0x550000
	          end_va = 0x639fff
	       monitored = 0
	     entry_point = 0x58d650
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 2798
	        start_va = 0x6d0000
	          end_va = 0x7cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006d0000"
	        filename = ""

Region:
	              id = 2799
	        start_va = 0x490000
	          end_va = 0x493fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000490000"
	        filename = ""

Region:
	              id = 2800
	        start_va = 0x550000
	          end_va = 0x62ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 2801
	        start_va = 0x76e20000
	          end_va = 0x76e2bfff
	       monitored = 0
	     entry_point = 0x76e23930
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")

Region:
	              id = 2802
	        start_va = 0x4a0000
	          end_va = 0x4a0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004a0000"
	        filename = ""

Region:
	              id = 2803
	        start_va = 0x76c80000
	          end_va = 0x76d03fff
	       monitored = 0
	     entry_point = 0x76ca6220
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 2804
	        start_va = 0x4b0000
	          end_va = 0x4b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004b0000"
	        filename = ""

Region:
	              id = 2805
	        start_va = 0x6cab0000
	          end_va = 0x6cabcfff
	       monitored = 0
	     entry_point = 0x6cab3520
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 2806
	        start_va = 0x6ca40000
	          end_va = 0x6caa6fff
	       monitored = 0
	     entry_point = 0x6ca5b610
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 2807
	        start_va = 0x740f0000
	          end_va = 0x7410afff
	       monitored = 0
	     entry_point = 0x740f9050
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 2808
	        start_va = 0x6c9f0000
	          end_va = 0x6ca33fff
	       monitored = 0
	     entry_point = 0x6ca0aaf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")

Region:
	              id = 2809
	        start_va = 0x4c0000
	          end_va = 0x4fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004c0000"
	        filename = ""

Region:
	              id = 2810
	        start_va = 0x500000
	          end_va = 0x53ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000500000"
	        filename = ""

Region:
	              id = 2811
	        start_va = 0x630000
	          end_va = 0x66ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000630000"
	        filename = ""

Region:
	              id = 2812
	        start_va = 0x670000
	          end_va = 0x6affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000670000"
	        filename = ""

Region:
	              id = 2813
	        start_va = 0x960000
	          end_va = 0x99ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000960000"
	        filename = ""

Region:
	              id = 2814
	        start_va = 0xea0000
	          end_va = 0xedffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ea0000"
	        filename = ""

Region:
	              id = 2815
	        start_va = 0x6c9d0000
	          end_va = 0x6c9e0fff
	       monitored = 0
	     entry_point = 0x6c9d8fa0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 2816
	        start_va = 0x6c910000
	          end_va = 0x6c9cefff
	       monitored = 0
	     entry_point = 0x6c941e80
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 2818
	        start_va = 0x6b0000
	          end_va = 0x6b5fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000006b0000"
	        filename = ""


Thread:
	id = 222
	os_tid = 0xf18


Thread:
	id = 223
	os_tid = 0x4b4


Thread:
	id = 224
	os_tid = 0x1c4


Thread:
	id = 225
	os_tid = 0x918


Thread:
	id = 226
	os_tid = 0x7f0


Process:
	id = "35"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x34056000"
	os_pid = "0x514"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x614"
	cmd_line = "cmd.exe /c \"taskkill /f /im agntsvc.exeencsvc.exe \""
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 2821
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 2822
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 2823
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 2824
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 2825
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 2826
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 2827
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 2828
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 2829
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 2830
	        start_va = 0x13a0000
	          end_va = 0x13f1fff
	       monitored = 1
	     entry_point = 0x13b4fd0
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")

Region:
	              id = 2831
	        start_va = 0x1400000
	          end_va = 0x53fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001400000"
	        filename = ""

Region:
	              id = 2832
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 2833
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 2834
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 2835
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 2836
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 2837
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 2838
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 2839
	        start_va = 0x5d0000
	          end_va = 0x5dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005d0000"
	        filename = ""

Region:
	              id = 2840
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 2841
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 2842
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 2843
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 2844
	        start_va = 0x400000
	          end_va = 0x5bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 2845
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 2846
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 2847
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 2848
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 2849
	        start_va = 0x400000
	          end_va = 0x4bdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 2850
	        start_va = 0x4c0000
	          end_va = 0x5bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004c0000"
	        filename = ""

Region:
	              id = 2851
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 2852
	        start_va = 0x5e0000
	          end_va = 0x61ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005e0000"
	        filename = ""

Region:
	              id = 2853
	        start_va = 0x620000
	          end_va = 0x71ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000620000"
	        filename = ""

Region:
	              id = 2854
	        start_va = 0x720000
	          end_va = 0x89ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000720000"
	        filename = ""

Region:
	              id = 2855
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 2856
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 2857
	        start_va = 0x8a0000
	          end_va = 0xbd6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 227
	os_tid = 0xf00

	[0146.196] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000
	[0146.196] __set_app_type (_Type=0x1) 
	[0146.196] __p__fmode () returned 0x74974d6c
	[0146.196] __p__commode () returned 0x74975b1c
	[0146.196] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13b5200) returned 0x0
	[0146.196] __getmainargs (in: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0, _DoWildCard=0, _StartInfo=0x13c60fc | out: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0) returned 0
	[0146.197] GetCurrentThreadId () returned 0xf00
	[0146.197] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xf00) returned 0x78
	[0146.197] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0146.197] GetProcAddress (hModule=0x75600000, lpProcName="SetThreadUILanguage") returned 0x75642510
	[0146.197] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0146.203] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0146.203] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2
	[0146.203] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0146.203] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0146.203] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0146.203] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0146.203] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0146.203] GetConsoleOutputCP () returned 0x1b5
	[0146.205] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0146.206] SetConsoleCtrlHandler (HandlerRoutine=0x13c0e40, Add=1) returned 1
	[0146.206] _get_osfhandle (_FileHandle=1) returned 0x154
	[0146.206] SetConsoleMode (hConsoleHandle=0x154, dwMode=0x0) returned 0
	[0146.206] _get_osfhandle (_FileHandle=1) returned 0x154
	[0146.206] GetConsoleMode (in: hConsoleHandle=0x154, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0146.206] _get_osfhandle (_FileHandle=0) returned 0x150
	[0146.206] GetConsoleMode (in: hConsoleHandle=0x150, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0146.206] GetEnvironmentStringsW () returned 0x4c7f20*
	[0146.206] GetProcessHeap () returned 0x4c0000
	[0146.206] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xa1a) returned 0x4c8948
	[0146.206] FreeEnvironmentStringsA (penv="A") returned 1
	[0146.206] GetProcessHeap () returned 0x4c0000
	[0146.206] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x4) returned 0x4c7e80
	[0146.206] GetEnvironmentStringsW () returned 0x4c7f20*
	[0146.206] GetProcessHeap () returned 0x4c0000
	[0146.206] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xa1a) returned 0x4c9370
	[0146.207] FreeEnvironmentStringsA (penv="A") returned 1
	[0146.207] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0146.207] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0146.207] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0146.207] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0146.207] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0146.207] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0146.207] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0146.207] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0146.207] RegCloseKey (hKey=0x88) returned 0x0
	[0146.207] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0146.208] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0146.208] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0146.208] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0146.208] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0146.208] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0146.208] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0146.208] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0146.208] RegCloseKey (hKey=0x88) returned 0x0
	[0146.208] time (in: timer=0x0 | out: timer=0x0) returned 0x6234421c
	[0146.208] srand (_Seed=0x6234421c) 
	[0146.208] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im agntsvc.exeencsvc.exe \""
	[0146.208] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im agntsvc.exeencsvc.exe \""
	[0146.208] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0146.208] GetProcessHeap () returned 0x4c0000
	[0146.208] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x210) returned 0x4c7088
	[0146.208] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4c7090, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0146.208] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0146.209] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0146.209] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0146.209] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0146.209] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0146.209] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0146.209] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0146.209] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0146.209] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0146.209] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0146.209] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0146.209] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0146.209] GetProcessHeap () returned 0x4c0000
	[0146.210] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4c8948) returned 1
	[0146.210] GetEnvironmentStringsW () returned 0x4c7f20*
	[0146.210] GetProcessHeap () returned 0x4c0000
	[0146.210] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xa32) returned 0x4ca7d8
	[0146.210] FreeEnvironmentStringsA (penv="A") returned 1
	[0146.210] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b
	[0146.210] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0146.210] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0146.210] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0146.210] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0146.210] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0146.210] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0146.210] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0146.210] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0146.210] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0146.210] GetProcessHeap () returned 0x4c0000
	[0146.210] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x44) returned 0x4c05c8
	[0146.210] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0146.211] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19fc4c*="Desktop") returned 0x1d
	[0146.211] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0146.211] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x4c0618
	[0146.211] FindClose (in: hFindFile=0x4c0618 | out: hFindFile=0x4c0618) returned 1
	[0146.211] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x4c0618
	[0146.211] FindClose (in: hFindFile=0x4c0618 | out: hFindFile=0x4c0618) returned 1
	[0146.211] _wcsnicmp (_String1="RDHJ0C~1", _String2="RDhJ0CNFevzX", _MaxCount=0xc) returned 16
	[0146.211] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x4c0618
	[0146.212] FindClose (in: hFindFile=0x4c0618 | out: hFindFile=0x4c0618) returned 1
	[0146.212] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0146.212] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1
	[0146.212] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 1
	[0146.212] GetProcessHeap () returned 0x4c0000
	[0146.212] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4ca7d8) returned 1
	[0146.212] GetEnvironmentStringsW () returned 0x4c7f20*
	[0146.212] GetProcessHeap () returned 0x4c0000
	[0146.212] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xa76) returned 0x4c9d98
	[0146.212] FreeEnvironmentStringsA (penv="=") returned 1
	[0146.212] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0146.212] GetProcessHeap () returned 0x4c0000
	[0146.213] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4c05c8) returned 1
	[0146.213] GetProcessHeap () returned 0x4c0000
	[0146.213] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x400e) returned 0x4cbc98
	[0146.213] GetProcessHeap () returned 0x4c0000
	[0146.214] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x5e) returned 0x4ca818
	[0146.214] GetProcessHeap () returned 0x4c0000
	[0146.214] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x4008) returned 0x4cfcb0
	[0146.214] GetProcessHeap () returned 0x4c0000
	[0146.214] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x4008) returned 0x4d3cc0
	[0146.215] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0146.216] GetProcessHeap () returned 0x4c0000
	[0146.216] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x418) returned 0x4ca880
	[0146.216] SetErrorMode (uMode=0x0) returned 0x8003
	[0146.216] SetErrorMode (uMode=0x1) returned 0x0
	[0146.216] GetFullPathNameW (in: lpFileName="taskkill \\f \\.", nBufferLength=0x208, lpBuffer=0x4ca888, lpFilePart=0x19fbac | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f", lpFilePart=0x19fbac*="f") returned 0x29
	[0146.216] SetErrorMode (uMode=0x8003) returned 0x1
	[0146.216] GetProcessHeap () returned 0x4c0000
	[0146.216] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ca880, Size=0x90) returned 0x4ca880
	[0146.216] GetProcessHeap () returned 0x4c0000
	[0146.216] RtlSizeHeap (HeapHandle=0x4c0000, Flags=0x0, MemoryPointer=0x4ca880) returned 0x90
	[0146.216] NeedCurrentDirectoryForExePathW (ExeName="taskkill \\f \\.") returned 1
	[0146.216] GetProcessHeap () returned 0x4c0000
	[0146.216] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x62) returned 0x4ca918
	[0146.216] GetProcessHeap () returned 0x4c0000
	[0146.216] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xb8) returned 0x4ca988
	[0146.217] GetProcessHeap () returned 0x4c0000
	[0146.217] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ca988, Size=0x62) returned 0x4ca988
	[0146.217] GetProcessHeap () returned 0x4c0000
	[0146.217] RtlSizeHeap (HeapHandle=0x4c0000, Flags=0x0, MemoryPointer=0x4ca988) returned 0x62
	[0146.217] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0146.217] GetProcessHeap () returned 0x4c0000
	[0146.217] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xe0) returned 0x4ca9f8
	[0146.221] GetProcessHeap () returned 0x4c0000
	[0146.221] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4ca9f8, Size=0x76) returned 0x4ca9f8
	[0146.221] GetProcessHeap () returned 0x4c0000
	[0146.221] RtlSizeHeap (HeapHandle=0x4c0000, Flags=0x0, MemoryPointer=0x4ca9f8) returned 0x76
	[0146.221] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0146.221] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f\\im agntsvc.exeencsvc.exe ", fInfoLevelId=0x1, lpFindFileData=0x19f958, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f958) returned 0xffffffff
	[0146.222] GetLastError () returned 0x3
	[0146.222] GetProcessHeap () returned 0x4c0000
	[0146.223] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4cfcb0) returned 1
	[0146.223] GetProcessHeap () returned 0x4c0000
	[0146.223] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d3cc0) returned 1
	[0146.223] GetProcessHeap () returned 0x4c0000
	[0146.223] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4cbc98) returned 1
	[0146.223] GetConsoleOutputCP () returned 0x1b5
	[0146.226] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0146.226] GetUserDefaultLCID () returned 0x409
	[0146.227] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x13d34a0, cchData=8 | out: lpLCData=":") returned 2
	[0146.227] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0146.227] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0146.227] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2
	[0146.227] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x13d34b0, cchData=8 | out: lpLCData="/") returned 2
	[0146.227] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x13d3500, cchData=32 | out: lpLCData="Mon") returned 4
	[0146.227] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x13d3540, cchData=32 | out: lpLCData="Tue") returned 4
	[0146.227] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x13d3580, cchData=32 | out: lpLCData="Wed") returned 4
	[0146.227] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x13d35c0, cchData=32 | out: lpLCData="Thu") returned 4
	[0146.227] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x13d3600, cchData=32 | out: lpLCData="Fri") returned 4
	[0146.227] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x13d3640, cchData=32 | out: lpLCData="Sat") returned 4
	[0146.227] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x13d3680, cchData=32 | out: lpLCData="Sun") returned 4
	[0146.227] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x13d34c0, cchData=8 | out: lpLCData=".") returned 2
	[0146.227] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x13d34e0, cchData=8 | out: lpLCData=",") returned 2
	[0146.227] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0146.229] GetProcessHeap () returned 0x4c0000
	[0146.229] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x20c) returned 0x4caac0
	[0146.229] GetConsoleTitleW (in: lpConsoleTitle=0x4caac0, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0146.232] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0146.232] GetProcAddress (hModule=0x75600000, lpProcName="CopyFileExW") returned 0x7561ffc0
	[0146.232] GetProcAddress (hModule=0x75600000, lpProcName="IsDebuggerPresent") returned 0x7561b0b0
	[0146.232] GetProcAddress (hModule=0x75600000, lpProcName="SetConsoleInputExeNameW") returned 0x7559b440
	[0146.232] GetProcessHeap () returned 0x4c0000
	[0146.232] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x400a) returned 0x4cbc98
	[0146.232] GetProcessHeap () returned 0x4c0000
	[0146.233] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4cbc98) returned 1
	[0146.233] _wcsicmp (_String1="taskkill", _String2=")") returned 75
	[0146.233] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14
	[0146.234] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14
	[0146.234] _wcsicmp (_String1="IF", _String2="taskkill") returned -11
	[0146.234] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11
	[0146.234] _wcsicmp (_String1="REM", _String2="taskkill") returned -2
	[0146.234] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2
	[0146.234] GetProcessHeap () returned 0x4c0000
	[0146.234] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x58) returned 0x4cacd8
	[0146.234] GetProcessHeap () returned 0x4c0000
	[0146.234] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4c7ea8
	[0146.234] GetProcessHeap () returned 0x4c0000
	[0146.235] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x46) returned 0x4cad38
	[0146.235] GetConsoleTitleW (in: lpConsoleTitle=0x19fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0146.239] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0146.239] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0146.239] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0146.239] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0146.239] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0146.239] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0146.239] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0146.239] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0146.239] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0146.239] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0146.240] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0146.240] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0146.240] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0146.240] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0146.240] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0146.240] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0146.240] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0146.240] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0146.240] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0146.240] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0146.240] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0146.240] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0146.240] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0146.240] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0146.240] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0146.240] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0146.240] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0146.240] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0146.240] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0146.240] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0146.240] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0146.240] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0146.240] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0146.240] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0146.240] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0146.240] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0146.240] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0146.240] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0146.240] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0146.240] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0146.240] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0146.240] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0146.240] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0146.241] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0146.241] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0146.241] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0146.241] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0146.241] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0146.241] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0146.241] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0146.241] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0146.241] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0146.241] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0146.241] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0146.241] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0146.241] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0146.241] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0146.241] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0146.241] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0146.241] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0146.241] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0146.241] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0146.241] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0146.241] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0146.241] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0146.241] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0146.241] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0146.241] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0146.241] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0146.241] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0146.241] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0146.241] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0146.241] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0146.241] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0146.241] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0146.241] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0146.242] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0146.242] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0146.242] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0146.242] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0146.242] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0146.242] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0146.242] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0146.242] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0146.242] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14
	[0146.242] _wcsicmp (_String1="taskkill", _String2="IF") returned 11
	[0146.242] _wcsicmp (_String1="taskkill", _String2="REM") returned 2
	[0146.242] GetProcessHeap () returned 0x4c0000
	[0146.242] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x210) returned 0x4cad88
	[0146.242] GetProcessHeap () returned 0x4c0000
	[0146.242] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x58) returned 0x4cafa0
	[0146.242] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0146.243] GetProcessHeap () returned 0x4c0000
	[0146.243] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x418) returned 0x4c05c8
	[0146.243] SetErrorMode (uMode=0x0) returned 0x8003
	[0146.243] SetErrorMode (uMode=0x1) returned 0x0
	[0146.243] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4c05d0, lpFilePart=0x19f57c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19f57c*="Desktop") returned 0x1d
	[0146.243] SetErrorMode (uMode=0x8003) returned 0x1
	[0146.243] GetProcessHeap () returned 0x4c0000
	[0146.243] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4c05c8, Size=0x56) returned 0x4c05c8
	[0146.243] GetProcessHeap () returned 0x4c0000
	[0146.243] RtlSizeHeap (HeapHandle=0x4c0000, Flags=0x0, MemoryPointer=0x4c05c8) returned 0x56
	[0146.243] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0146.243] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0146.243] GetProcessHeap () returned 0x4c0000
	[0146.243] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x110) returned 0x4cb000
	[0146.243] GetProcessHeap () returned 0x4c0000
	[0146.243] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x218) returned 0x4c0628
	[0146.248] GetProcessHeap () returned 0x4c0000
	[0146.248] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4c0628, Size=0x112) returned 0x4c0628
	[0146.248] GetProcessHeap () returned 0x4c0000
	[0146.248] RtlSizeHeap (HeapHandle=0x4c0000, Flags=0x0, MemoryPointer=0x4c0628) returned 0x112
	[0146.248] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0146.248] GetProcessHeap () returned 0x4c0000
	[0146.249] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xe0) returned 0x4cb118
	[0146.250] GetProcessHeap () returned 0x4c0000
	[0146.250] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4cb118, Size=0x76) returned 0x4cb118
	[0146.250] GetProcessHeap () returned 0x4c0000
	[0146.250] RtlSizeHeap (HeapHandle=0x4c0000, Flags=0x0, MemoryPointer=0x4cb118) returned 0x76
	[0146.250] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0146.251] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0146.251] GetLastError () returned 0x2
	[0146.251] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0146.251] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x4cb198
	[0146.251] GetProcessHeap () returned 0x4c0000
	[0146.251] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x14) returned 0x4c7978
	[0146.251] FindClose (in: hFindFile=0x4cb198 | out: hFindFile=0x4cb198) returned 1
	[0146.251] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0146.251] GetLastError () returned 0x2
	[0146.251] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x4cb198
	[0146.252] GetProcessHeap () returned 0x4c0000
	[0146.252] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4c7978, Size=0x4) returned 0x4c72a0
	[0146.252] FindClose (in: hFindFile=0x4cb198 | out: hFindFile=0x4cb198) returned 1
	[0146.252] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0146.252] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0146.252] GetConsoleTitleW (in: lpConsoleTitle=0x19f7fc, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0146.253] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f728, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f70c | out: lpAttributeList=0x19f728, lpSize=0x19f70c) returned 1
	[0146.253] UpdateProcThreadAttribute (in: lpAttributeList=0x19f728, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f714, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f728, lpPreviousValue=0x0) returned 1
	[0146.253] GetStartupInfoW (in: lpStartupInfo=0x19f760 | out: lpStartupInfo=0x19f760*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x150, hStdOutput=0x154, hStdError=0x130)) 
	[0146.253] GetProcessHeap () returned 0x4c0000
	[0146.253] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4c7778
	[0146.253] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0146.253] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0146.253] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0146.253] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0146.253] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0146.253] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0146.253] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0146.253] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0146.253] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0146.253] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0146.253] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0146.253] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0146.253] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0146.253] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0146.253] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0146.253] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0146.254] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0146.254] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0146.254] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0146.254] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0146.254] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0146.254] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0146.254] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0146.254] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0146.254] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0146.254] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0146.254] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0146.254] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0146.254] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0146.254] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0146.254] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0146.254] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0146.254] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0146.254] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0146.254] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0146.254] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0146.254] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0146.254] GetProcessHeap () returned 0x4c0000
	[0146.254] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4c7778) returned 1
	[0146.254] GetProcessHeap () returned 0x4c0000
	[0146.254] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xa) returned 0x4cb198
	[0146.254] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1
	[0146.257] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill  /f /im agntsvc.exeencsvc.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x19f6b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill  /f /im agntsvc.exeencsvc.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f6fc | out: lpCommandLine="taskkill  /f /im agntsvc.exeencsvc.exe ", lpProcessInformation=0x19f6fc*(hProcess=0x9c, hThread=0x98, dwProcessId=0x510, dwThreadId=0x22c)) returned 1
	[0146.276] CloseHandle (hObject=0x98) returned 1
	[0146.276] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0146.276] GetProcessHeap () returned 0x4c0000
	[0146.277] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4c9d98) returned 1
	[0146.277] GetEnvironmentStringsW () returned 0x4c9d98*
	[0146.277] GetProcessHeap () returned 0x4c0000
	[0146.277] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xa76) returned 0x4c7f20
	[0146.277] FreeEnvironmentStringsA (penv="=") returned 1
	[0146.277] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0
	[0147.449] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x19f694 | out: lpExitCode=0x19f694*=0x80) returned 1
	[0147.450] CloseHandle (hObject=0x9c) returned 1
	[0147.450] _vsnwprintf (in: _Buffer=0x19f77c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f69c | out: _Buffer="00000080") returned 8
	[0147.451] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1
	[0147.451] GetProcessHeap () returned 0x4c0000
	[0147.452] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4c7f20) returned 1
	[0147.452] GetEnvironmentStringsW () returned 0x4cb1c8*
	[0147.452] GetProcessHeap () returned 0x4c0000
	[0147.452] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xa9c) returned 0x4c7f20
	[0147.453] FreeEnvironmentStringsA (penv="=") returned 1
	[0147.453] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0147.453] GetProcessHeap () returned 0x4c0000
	[0147.453] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4c7f20) returned 1
	[0147.453] GetEnvironmentStringsW () returned 0x4cb1c8*
	[0147.453] GetProcessHeap () returned 0x4c0000
	[0147.453] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xa9c) returned 0x4c7f20
	[0147.453] FreeEnvironmentStringsA (penv="=") returned 1
	[0147.453] GetProcessHeap () returned 0x4c0000
	[0147.453] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4cb198) returned 1
	[0147.454] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f728 | out: lpAttributeList=0x19f728) 
	[0147.454] _get_osfhandle (_FileHandle=1) returned 0x154
	[0147.454] SetConsoleMode (hConsoleHandle=0x154, dwMode=0x0) returned 0
	[0147.454] _get_osfhandle (_FileHandle=1) returned 0x154
	[0147.454] GetConsoleMode (in: hConsoleHandle=0x154, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0147.454] _get_osfhandle (_FileHandle=0) returned 0x150
	[0147.454] GetConsoleMode (in: hConsoleHandle=0x150, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0147.454] GetConsoleOutputCP () returned 0x1b5
	[0147.457] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0147.458] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0147.459] exit (_Code=128) 

Thread:
	id = 228
	os_tid = 0x500


Process:
	id = "36"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\syswow64\\taskkill.exe"
	page_root = "0x3506f000"
	os_pid = "0x510"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "35"
	os_parent_pid = "0x514"
	cmd_line = "taskkill  /f /im agntsvc.exeencsvc.exe "
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 2858
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 2859
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 2860
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 2861
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 2862
	        start_va = 0xa0000
	          end_va = 0xdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 2863
	        start_va = 0xe0000
	          end_va = 0xe3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 2864
	        start_va = 0xf0000
	          end_va = 0xf0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 2865
	        start_va = 0x100000
	          end_va = 0x101fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 2866
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 2867
	        start_va = 0x13b0000
	          end_va = 0x13c5fff
	       monitored = 0
	     entry_point = 0x13bde80
	     region_type = mapped_file
	            name = "taskkill.exe"
	        filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe")

Region:
	              id = 2868
	        start_va = 0x13d0000
	          end_va = 0x53cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000013d0000"
	        filename = ""

Region:
	              id = 2869
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 2870
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 2871
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 2872
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 2873
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 2874
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 2875
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 2876
	        start_va = 0x590000
	          end_va = 0x59ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000590000"
	        filename = ""

Region:
	              id = 2877
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 2878
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 2879
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 2880
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 2881
	        start_va = 0x5a0000
	          end_va = 0x87ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005a0000"
	        filename = ""

Region:
	              id = 2882
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 2883
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 2884
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 2885
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 2886
	        start_va = 0x110000
	          end_va = 0x1cdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 2887
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 2888
	        start_va = 0x74650000
	          end_va = 0x746cafff
	       monitored = 0
	     entry_point = 0x7466e970
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 2889
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 2890
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 2891
	        start_va = 0x440000
	          end_va = 0x47ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000440000"
	        filename = ""

Region:
	              id = 2892
	        start_va = 0x76ae0000
	          end_va = 0x76b23fff
	       monitored = 0
	     entry_point = 0x76af9d80
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 2893
	        start_va = 0x75260000
	          end_va = 0x7530cfff
	       monitored = 0
	     entry_point = 0x75274f00
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 2894
	        start_va = 0x74450000
	          end_va = 0x7446dfff
	       monitored = 0
	     entry_point = 0x7445b640
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 2895
	        start_va = 0x74440000
	          end_va = 0x74449fff
	       monitored = 0
	     entry_point = 0x74442a00
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 2896
	        start_va = 0x74590000
	          end_va = 0x745e7fff
	       monitored = 0
	     entry_point = 0x745d25c0
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 2897
	        start_va = 0x77450000
	          end_va = 0x77596fff
	       monitored = 0
	     entry_point = 0x77461cf0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 2898
	        start_va = 0x76b30000
	          end_va = 0x76c7efff
	       monitored = 0
	     entry_point = 0x76be6820
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 2899
	        start_va = 0x753c0000
	          end_va = 0x75451fff
	       monitored = 0
	     entry_point = 0x753f8cf0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 2900
	        start_va = 0x77290000
	          end_va = 0x7744cfff
	       monitored = 0
	     entry_point = 0x77372a10
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")

Region:
	              id = 2901
	        start_va = 0x75310000
	          end_va = 0x7536efff
	       monitored = 0
	     entry_point = 0x75314af0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 2902
	        start_va = 0x77240000
	          end_va = 0x77284fff
	       monitored = 0
	     entry_point = 0x7725de90
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 2903
	        start_va = 0x6cc90000
	          end_va = 0x6cc97fff
	       monitored = 0
	     entry_point = 0x6cc917b0
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 2904
	        start_va = 0x6cc70000
	          end_va = 0x6cc85fff
	       monitored = 0
	     entry_point = 0x6cc721d0
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")

Region:
	              id = 2905
	        start_va = 0x6cc30000
	          end_va = 0x6cc6efff
	       monitored = 0
	     entry_point = 0x6cc446c0
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll")

Region:
	              id = 2906
	        start_va = 0x6caf0000
	          end_va = 0x6cc2efff
	       monitored = 0
	     entry_point = 0x6cb1d880
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll")

Region:
	              id = 2907
	        start_va = 0x6cad0000
	          end_va = 0x6caebfff
	       monitored = 0
	     entry_point = 0x6cad4720
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")

Region:
	              id = 2908
	        start_va = 0x6cac0000
	          end_va = 0x6cac9fff
	       monitored = 0
	     entry_point = 0x6cac28d0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")

Region:
	              id = 2909
	        start_va = 0x30000
	          end_va = 0x3ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 2910
	        start_va = 0x1d0000
	          end_va = 0x1f9fff
	       monitored = 0
	     entry_point = 0x1d5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 2911
	        start_va = 0x5a0000
	          end_va = 0x727fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000005a0000"
	        filename = ""

Region:
	              id = 2912
	        start_va = 0x780000
	          end_va = 0x87ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000780000"
	        filename = ""

Region:
	              id = 2913
	        start_va = 0x74ea0000
	          end_va = 0x74ecafff
	       monitored = 0
	     entry_point = 0x74ea5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 2914
	        start_va = 0x880000
	          end_va = 0xa00fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000880000"
	        filename = ""

Region:
	              id = 2915
	        start_va = 0x53d0000
	          end_va = 0x67cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000053d0000"
	        filename = ""

Region:
	              id = 2916
	        start_va = 0x1d0000
	          end_va = 0x1d1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001d0000"
	        filename = ""

Region:
	              id = 2917
	        start_va = 0x1e0000
	          end_va = 0x1e0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001e0000"
	        filename = ""

Region:
	              id = 2918
	        start_va = 0x1f0000
	          end_va = 0x1f4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taskkill.exe.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui")

Region:
	              id = 2919
	        start_va = 0x480000
	          end_va = 0x480fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 2920
	        start_va = 0x490000
	          end_va = 0x490fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000490000"
	        filename = ""

Region:
	              id = 2921
	        start_va = 0xa10000
	          end_va = 0xd46fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 2922
	        start_va = 0x4a0000
	          end_va = 0x589fff
	       monitored = 0
	     entry_point = 0x4dd650
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 2923
	        start_va = 0x4a0000
	          end_va = 0x4a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004a0000"
	        filename = ""

Region:
	              id = 2924
	        start_va = 0x4b0000
	          end_va = 0x58ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 2925
	        start_va = 0x76e20000
	          end_va = 0x76e2bfff
	       monitored = 0
	     entry_point = 0x76e23930
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")

Region:
	              id = 2926
	        start_va = 0x730000
	          end_va = 0x730fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000730000"
	        filename = ""

Region:
	              id = 2927
	        start_va = 0x76c80000
	          end_va = 0x76d03fff
	       monitored = 0
	     entry_point = 0x76ca6220
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 2928
	        start_va = 0x740000
	          end_va = 0x740fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000740000"
	        filename = ""

Region:
	              id = 2929
	        start_va = 0x6cab0000
	          end_va = 0x6cabcfff
	       monitored = 0
	     entry_point = 0x6cab3520
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 2930
	        start_va = 0x6ca40000
	          end_va = 0x6caa6fff
	       monitored = 0
	     entry_point = 0x6ca5b610
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 2931
	        start_va = 0x740f0000
	          end_va = 0x7410afff
	       monitored = 0
	     entry_point = 0x740f9050
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 2932
	        start_va = 0x6c9f0000
	          end_va = 0x6ca33fff
	       monitored = 0
	     entry_point = 0x6ca0aaf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")

Region:
	              id = 2933
	        start_va = 0xd50000
	          end_va = 0xd8ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d50000"
	        filename = ""

Region:
	              id = 2934
	        start_va = 0xd90000
	          end_va = 0xdcffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d90000"
	        filename = ""

Region:
	              id = 2935
	        start_va = 0xdd0000
	          end_va = 0xe0ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000dd0000"
	        filename = ""

Region:
	              id = 2936
	        start_va = 0xe10000
	          end_va = 0xe4ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e10000"
	        filename = ""

Region:
	              id = 2937
	        start_va = 0xe50000
	          end_va = 0xe8ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e50000"
	        filename = ""

Region:
	              id = 2938
	        start_va = 0xe90000
	          end_va = 0xecffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e90000"
	        filename = ""

Region:
	              id = 2939
	        start_va = 0x6c9d0000
	          end_va = 0x6c9e0fff
	       monitored = 0
	     entry_point = 0x6c9d8fa0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 2940
	        start_va = 0x6c910000
	          end_va = 0x6c9cefff
	       monitored = 0
	     entry_point = 0x6c941e80
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 2942
	        start_va = 0x750000
	          end_va = 0x755fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000750000"
	        filename = ""


Thread:
	id = 229
	os_tid = 0x22c


Thread:
	id = 230
	os_tid = 0xcd4


Thread:
	id = 231
	os_tid = 0x3d4


Thread:
	id = 232
	os_tid = 0x230


Thread:
	id = 233
	os_tid = 0x394


Process:
	id = "37"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x50365000"
	os_pid = "0xd88"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x614"
	cmd_line = "cmd.exe /c \"taskkill /f /im firefoxconfig.exe \""
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 2945
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 2946
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 2947
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 2948
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 2949
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 2950
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 2951
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 2952
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 2953
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 2954
	        start_va = 0x13a0000
	          end_va = 0x13f1fff
	       monitored = 1
	     entry_point = 0x13b4fd0
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")

Region:
	              id = 2955
	        start_va = 0x1400000
	          end_va = 0x53fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001400000"
	        filename = ""

Region:
	              id = 2956
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 2957
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 2958
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 2959
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 2960
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 2961
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 2962
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 2963
	        start_va = 0x540000
	          end_va = 0x54ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000540000"
	        filename = ""

Region:
	              id = 2964
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 2965
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 2966
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 2967
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 2968
	        start_va = 0x550000
	          end_va = 0x78ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000550000"
	        filename = ""

Region:
	              id = 2969
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 2970
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 2971
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 2972
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 2973
	        start_va = 0x400000
	          end_va = 0x4bdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 2974
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 2975
	        start_va = 0x4c0000
	          end_va = 0x4fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004c0000"
	        filename = ""

Region:
	              id = 2976
	        start_va = 0x550000
	          end_va = 0x64ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000550000"
	        filename = ""

Region:
	              id = 2977
	        start_va = 0x690000
	          end_va = 0x78ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000690000"
	        filename = ""

Region:
	              id = 2978
	        start_va = 0x1d0000
	          end_va = 0x1fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001d0000"
	        filename = ""

Region:
	              id = 2979
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 2980
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 2981
	        start_va = 0x790000
	          end_va = 0xac6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 234
	os_tid = 0xe5c

	[0147.718] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000
	[0147.718] __set_app_type (_Type=0x1) 
	[0147.718] __p__fmode () returned 0x74974d6c
	[0147.718] __p__commode () returned 0x74975b1c
	[0147.718] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13b5200) returned 0x0
	[0147.719] __getmainargs (in: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0, _DoWildCard=0, _StartInfo=0x13c60fc | out: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0) returned 0
	[0147.719] GetCurrentThreadId () returned 0xe5c
	[0147.719] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xe5c) returned 0x78
	[0147.719] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0147.719] GetProcAddress (hModule=0x75600000, lpProcName="SetThreadUILanguage") returned 0x75642510
	[0147.719] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0147.726] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0147.726] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2
	[0147.726] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0147.726] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0147.727] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0147.727] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0147.727] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0147.727] GetConsoleOutputCP () returned 0x1b5
	[0147.728] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0147.728] SetConsoleCtrlHandler (HandlerRoutine=0x13c0e40, Add=1) returned 1
	[0147.728] _get_osfhandle (_FileHandle=1) returned 0x150
	[0147.728] SetConsoleMode (hConsoleHandle=0x150, dwMode=0x0) returned 0
	[0147.728] _get_osfhandle (_FileHandle=1) returned 0x150
	[0147.728] GetConsoleMode (in: hConsoleHandle=0x150, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0147.728] _get_osfhandle (_FileHandle=0) returned 0x144
	[0147.728] GetConsoleMode (in: hConsoleHandle=0x144, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0147.729] GetEnvironmentStringsW () returned 0x697cc8*
	[0147.729] GetProcessHeap () returned 0x690000
	[0147.729] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x8, Size=0xa1a) returned 0x6986f0
	[0147.729] FreeEnvironmentStringsA (penv="A") returned 1
	[0147.729] GetProcessHeap () returned 0x690000
	[0147.729] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x8, Size=0x4) returned 0x690550
	[0147.729] GetEnvironmentStringsW () returned 0x697cc8*
	[0147.729] GetProcessHeap () returned 0x690000
	[0147.729] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x8, Size=0xa1a) returned 0x699118
	[0147.729] FreeEnvironmentStringsA (penv="A") returned 1
	[0147.729] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0147.729] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0147.729] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0147.729] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0147.729] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0147.730] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0147.730] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0147.730] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0147.730] RegCloseKey (hKey=0x88) returned 0x0
	[0147.730] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0147.730] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0147.730] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0147.730] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0147.730] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0147.730] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0147.730] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0147.730] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0147.730] RegCloseKey (hKey=0x88) returned 0x0
	[0147.730] time (in: timer=0x0 | out: timer=0x0) returned 0x6234421d
	[0147.731] srand (_Seed=0x6234421d) 
	[0147.731] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im firefoxconfig.exe \""
	[0147.731] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im firefoxconfig.exe \""
	[0147.731] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0147.731] GetProcessHeap () returned 0x690000
	[0147.731] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x8, Size=0x210) returned 0x699b40
	[0147.731] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x699b48, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0147.731] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0147.731] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0147.731] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0147.731] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0147.731] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0147.731] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0147.731] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0147.731] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0147.731] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0147.731] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0147.731] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0147.732] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0147.732] GetProcessHeap () returned 0x690000
	[0147.732] RtlFreeHeap (HeapHandle=0x690000, Flags=0x0, BaseAddress=0x6986f0) returned 1
	[0147.732] GetEnvironmentStringsW () returned 0x697cc8*
	[0147.732] GetProcessHeap () returned 0x690000
	[0147.732] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x8, Size=0xa32) returned 0x69a798
	[0147.733] FreeEnvironmentStringsA (penv="A") returned 1
	[0147.733] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b
	[0147.733] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0147.733] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0147.733] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0147.733] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0147.733] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0147.733] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0147.733] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0147.733] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0147.733] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0147.733] GetProcessHeap () returned 0x690000
	[0147.733] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x8, Size=0x44) returned 0x6905c8
	[0147.733] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0147.734] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19fc4c*="Desktop") returned 0x1d
	[0147.734] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0147.734] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x690618
	[0147.734] FindClose (in: hFindFile=0x690618 | out: hFindFile=0x690618) returned 1
	[0147.734] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x690618
	[0147.734] FindClose (in: hFindFile=0x690618 | out: hFindFile=0x690618) returned 1
	[0147.735] _wcsnicmp (_String1="RDHJ0C~1", _String2="RDhJ0CNFevzX", _MaxCount=0xc) returned 16
	[0147.735] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x690618
	[0147.735] FindClose (in: hFindFile=0x690618 | out: hFindFile=0x690618) returned 1
	[0147.735] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0147.735] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1
	[0147.735] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 1
	[0147.735] GetProcessHeap () returned 0x690000
	[0147.736] RtlFreeHeap (HeapHandle=0x690000, Flags=0x0, BaseAddress=0x69a798) returned 1
	[0147.736] GetEnvironmentStringsW () returned 0x697cc8*
	[0147.736] GetProcessHeap () returned 0x690000
	[0147.736] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x8, Size=0xa76) returned 0x699d58
	[0147.736] FreeEnvironmentStringsA (penv="=") returned 1
	[0147.736] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0147.736] GetProcessHeap () returned 0x690000
	[0147.736] RtlFreeHeap (HeapHandle=0x690000, Flags=0x0, BaseAddress=0x6905c8) returned 1
	[0147.737] GetProcessHeap () returned 0x690000
	[0147.737] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x8, Size=0x400e) returned 0x69bc58
	[0147.737] GetProcessHeap () returned 0x690000
	[0147.737] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x8, Size=0x56) returned 0x69a7d8
	[0147.737] GetProcessHeap () returned 0x690000
	[0147.737] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x8, Size=0x4008) returned 0x69fc70
	[0147.738] GetProcessHeap () returned 0x690000
	[0147.738] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x8, Size=0x4008) returned 0x6a3c80
	[0147.739] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0147.740] GetProcessHeap () returned 0x690000
	[0147.740] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x8, Size=0x418) returned 0x69a838
	[0147.740] SetErrorMode (uMode=0x0) returned 0x8003
	[0147.740] SetErrorMode (uMode=0x1) returned 0x0
	[0147.740] GetFullPathNameW (in: lpFileName="taskkill \\f \\.", nBufferLength=0x208, lpBuffer=0x69a840, lpFilePart=0x19fbac | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f", lpFilePart=0x19fbac*="f") returned 0x29
	[0147.740] SetErrorMode (uMode=0x8003) returned 0x1
	[0147.740] GetProcessHeap () returned 0x690000
	[0147.740] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x69a838, Size=0x88) returned 0x69a838
	[0147.740] GetProcessHeap () returned 0x690000
	[0147.740] RtlSizeHeap (HeapHandle=0x690000, Flags=0x0, MemoryPointer=0x69a838) returned 0x88
	[0147.740] NeedCurrentDirectoryForExePathW (ExeName="taskkill \\f \\.") returned 1
	[0147.740] GetProcessHeap () returned 0x690000
	[0147.740] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x8, Size=0x62) returned 0x69a8c8
	[0147.740] GetProcessHeap () returned 0x690000
	[0147.740] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x8, Size=0xb8) returned 0x69a938
	[0147.741] GetProcessHeap () returned 0x690000
	[0147.741] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x69a938, Size=0x62) returned 0x69a938
	[0147.741] GetProcessHeap () returned 0x690000
	[0147.741] RtlSizeHeap (HeapHandle=0x690000, Flags=0x0, MemoryPointer=0x69a938) returned 0x62
	[0147.741] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0147.741] GetProcessHeap () returned 0x690000
	[0147.741] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x8, Size=0xe0) returned 0x69a9a8
	[0147.747] GetProcessHeap () returned 0x690000
	[0147.747] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x69a9a8, Size=0x76) returned 0x69a9a8
	[0147.747] GetProcessHeap () returned 0x690000
	[0147.747] RtlSizeHeap (HeapHandle=0x690000, Flags=0x0, MemoryPointer=0x69a9a8) returned 0x76
	[0147.747] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0147.747] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f\\im firefoxconfig.exe ", fInfoLevelId=0x1, lpFindFileData=0x19f958, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f958) returned 0xffffffff
	[0147.748] GetLastError () returned 0x3
	[0147.748] GetProcessHeap () returned 0x690000
	[0147.748] RtlFreeHeap (HeapHandle=0x690000, Flags=0x0, BaseAddress=0x69fc70) returned 1
	[0147.748] GetProcessHeap () returned 0x690000
	[0147.749] RtlFreeHeap (HeapHandle=0x690000, Flags=0x0, BaseAddress=0x6a3c80) returned 1
	[0147.749] GetProcessHeap () returned 0x690000
	[0147.749] RtlFreeHeap (HeapHandle=0x690000, Flags=0x0, BaseAddress=0x69bc58) returned 1
	[0147.750] GetConsoleOutputCP () returned 0x1b5
	[0147.752] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0147.752] GetUserDefaultLCID () returned 0x409
	[0147.754] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x13d34a0, cchData=8 | out: lpLCData=":") returned 2
	[0147.754] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0147.754] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0147.755] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2
	[0147.755] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x13d34b0, cchData=8 | out: lpLCData="/") returned 2
	[0147.755] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x13d3500, cchData=32 | out: lpLCData="Mon") returned 4
	[0147.755] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x13d3540, cchData=32 | out: lpLCData="Tue") returned 4
	[0147.755] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x13d3580, cchData=32 | out: lpLCData="Wed") returned 4
	[0147.755] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x13d35c0, cchData=32 | out: lpLCData="Thu") returned 4
	[0147.755] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x13d3600, cchData=32 | out: lpLCData="Fri") returned 4
	[0147.755] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x13d3640, cchData=32 | out: lpLCData="Sat") returned 4
	[0147.755] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x13d3680, cchData=32 | out: lpLCData="Sun") returned 4
	[0147.755] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x13d34c0, cchData=8 | out: lpLCData=".") returned 2
	[0147.755] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x13d34e0, cchData=8 | out: lpLCData=",") returned 2
	[0147.755] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0147.757] GetProcessHeap () returned 0x690000
	[0147.757] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x20c) returned 0x69aa70
	[0147.757] GetConsoleTitleW (in: lpConsoleTitle=0x69aa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0147.758] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0147.758] GetProcAddress (hModule=0x75600000, lpProcName="CopyFileExW") returned 0x7561ffc0
	[0147.759] GetProcAddress (hModule=0x75600000, lpProcName="IsDebuggerPresent") returned 0x7561b0b0
	[0147.759] GetProcAddress (hModule=0x75600000, lpProcName="SetConsoleInputExeNameW") returned 0x7559b440
	[0147.759] GetProcessHeap () returned 0x690000
	[0147.759] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x8, Size=0x400a) returned 0x69bc58
	[0147.759] GetProcessHeap () returned 0x690000
	[0147.759] RtlFreeHeap (HeapHandle=0x690000, Flags=0x0, BaseAddress=0x69bc58) returned 1
	[0147.760] _wcsicmp (_String1="taskkill", _String2=")") returned 75
	[0147.760] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14
	[0147.760] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14
	[0147.760] _wcsicmp (_String1="IF", _String2="taskkill") returned -11
	[0147.760] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11
	[0147.760] _wcsicmp (_String1="REM", _String2="taskkill") returned -2
	[0147.760] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2
	[0147.761] GetProcessHeap () returned 0x690000
	[0147.761] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x8, Size=0x58) returned 0x69ac88
	[0147.761] GetProcessHeap () returned 0x690000
	[0147.761] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x8, Size=0x1a) returned 0x690578
	[0147.761] GetProcessHeap () returned 0x690000
	[0147.761] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x8, Size=0x3e) returned 0x69ace8
	[0147.763] GetConsoleTitleW (in: lpConsoleTitle=0x19fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0147.766] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0147.766] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0147.766] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0147.766] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0147.766] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0147.766] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0147.766] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0147.766] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0147.766] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0147.766] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0147.766] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0147.766] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0147.766] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0147.767] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0147.767] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0147.767] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0147.767] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0147.767] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0147.767] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0147.767] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0147.767] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0147.767] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0147.767] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0147.767] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0147.767] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0147.767] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0147.767] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0147.767] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0147.767] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0147.767] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0147.767] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0147.767] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0147.767] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0147.767] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0147.767] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0147.767] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0147.767] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0147.767] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0147.767] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0147.767] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0147.767] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0147.767] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0147.767] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0147.767] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0147.768] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0147.768] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0147.768] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0147.768] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0147.768] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0147.768] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0147.768] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0147.768] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0147.768] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0147.768] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0147.768] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0147.768] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0147.768] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0147.768] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0147.768] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0147.768] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0147.768] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0147.768] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0147.768] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0147.768] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0147.768] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0147.768] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0147.768] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0147.768] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0147.768] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0147.768] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0147.768] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0147.768] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0147.769] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0147.769] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0147.769] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0147.769] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0147.769] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0147.770] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0147.770] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0147.770] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0147.770] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0147.770] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0147.770] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0147.770] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0147.770] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14
	[0147.770] _wcsicmp (_String1="taskkill", _String2="IF") returned 11
	[0147.771] _wcsicmp (_String1="taskkill", _String2="REM") returned 2
	[0147.771] GetProcessHeap () returned 0x690000
	[0147.771] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x8, Size=0x210) returned 0x69ad30
	[0147.771] GetProcessHeap () returned 0x690000
	[0147.771] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x8, Size=0x50) returned 0x69af48
	[0147.771] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0147.771] GetProcessHeap () returned 0x690000
	[0147.771] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x8, Size=0x418) returned 0x6905c8
	[0147.771] SetErrorMode (uMode=0x0) returned 0x8003
	[0147.772] SetErrorMode (uMode=0x1) returned 0x0
	[0147.772] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x6905d0, lpFilePart=0x19f57c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19f57c*="Desktop") returned 0x1d
	[0147.772] SetErrorMode (uMode=0x8003) returned 0x1
	[0147.772] GetProcessHeap () returned 0x690000
	[0147.772] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6905c8, Size=0x56) returned 0x6905c8
	[0147.772] GetProcessHeap () returned 0x690000
	[0147.772] RtlSizeHeap (HeapHandle=0x690000, Flags=0x0, MemoryPointer=0x6905c8) returned 0x56
	[0147.772] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0147.772] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0147.772] GetProcessHeap () returned 0x690000
	[0147.772] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x8, Size=0x110) returned 0x69afa0
	[0147.772] GetProcessHeap () returned 0x690000
	[0147.772] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x8, Size=0x218) returned 0x690628
	[0147.777] GetProcessHeap () returned 0x690000
	[0147.777] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x690628, Size=0x112) returned 0x690628
	[0147.777] GetProcessHeap () returned 0x690000
	[0147.777] RtlSizeHeap (HeapHandle=0x690000, Flags=0x0, MemoryPointer=0x690628) returned 0x112
	[0147.777] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0147.777] GetProcessHeap () returned 0x690000
	[0147.777] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x8, Size=0xe0) returned 0x69b0b8
	[0147.779] GetProcessHeap () returned 0x690000
	[0147.779] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x69b0b8, Size=0x76) returned 0x69b0b8
	[0147.779] GetProcessHeap () returned 0x690000
	[0147.779] RtlSizeHeap (HeapHandle=0x690000, Flags=0x0, MemoryPointer=0x69b0b8) returned 0x76
	[0147.779] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0147.779] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0147.781] GetLastError () returned 0x2
	[0147.781] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0147.781] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x69b138
	[0147.781] GetProcessHeap () returned 0x690000
	[0147.781] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x14) returned 0x6974f0
	[0147.781] FindClose (in: hFindFile=0x69b138 | out: hFindFile=0x69b138) returned 1
	[0147.781] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0147.782] GetLastError () returned 0x2
	[0147.782] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x69b138
	[0147.782] GetProcessHeap () returned 0x690000
	[0147.782] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6974f0, Size=0x4) returned 0x69b178
	[0147.782] FindClose (in: hFindFile=0x69b138 | out: hFindFile=0x69b138) returned 1
	[0147.782] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0147.782] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0147.782] GetConsoleTitleW (in: lpConsoleTitle=0x19f7fc, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0147.785] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f728, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f70c | out: lpAttributeList=0x19f728, lpSize=0x19f70c) returned 1
	[0147.785] UpdateProcThreadAttribute (in: lpAttributeList=0x19f728, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f714, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f728, lpPreviousValue=0x0) returned 1
	[0147.785] GetStartupInfoW (in: lpStartupInfo=0x19f760 | out: lpStartupInfo=0x19f760*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x144, hStdOutput=0x150, hStdError=0x154)) 
	[0147.789] GetProcessHeap () returned 0x690000
	[0147.789] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x8, Size=0x18) returned 0x697510
	[0147.790] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0147.790] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0147.790] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0147.790] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0147.790] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0147.790] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0147.790] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0147.790] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0147.790] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0147.790] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0147.790] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0147.790] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0147.790] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0147.790] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0147.790] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0147.790] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0147.790] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0147.790] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0147.791] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0147.791] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0147.791] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0147.791] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0147.791] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0147.791] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0147.791] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0147.791] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0147.791] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0147.791] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0147.791] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0147.791] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0147.791] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0147.791] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0147.791] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0147.791] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0147.791] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0147.791] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0147.791] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0147.791] GetProcessHeap () returned 0x690000
	[0147.791] RtlFreeHeap (HeapHandle=0x690000, Flags=0x0, BaseAddress=0x697510) returned 1
	[0147.791] GetProcessHeap () returned 0x690000
	[0147.791] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x8, Size=0xa) returned 0x69b138
	[0147.791] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1
	[0147.877] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill  /f /im firefoxconfig.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x19f6b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill  /f /im firefoxconfig.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f6fc | out: lpCommandLine="taskkill  /f /im firefoxconfig.exe ", lpProcessInformation=0x19f6fc*(hProcess=0x9c, hThread=0x98, dwProcessId=0x11e8, dwThreadId=0xb68)) returned 1
	[0147.896] CloseHandle (hObject=0x98) returned 1
	[0147.896] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0147.896] GetProcessHeap () returned 0x690000
	[0147.896] RtlFreeHeap (HeapHandle=0x690000, Flags=0x0, BaseAddress=0x699d58) returned 1
	[0147.896] GetEnvironmentStringsW () returned 0x699d58*
	[0147.897] GetProcessHeap () returned 0x690000
	[0147.897] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x8, Size=0xa76) returned 0x697cc8
	[0147.897] FreeEnvironmentStringsA (penv="=") returned 1
	[0147.897] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0
	[0148.940] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x19f694 | out: lpExitCode=0x19f694*=0x80) returned 1
	[0148.941] CloseHandle (hObject=0x9c) returned 1
	[0148.941] _vsnwprintf (in: _Buffer=0x19f77c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f69c | out: _Buffer="00000080") returned 8
	[0148.941] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1
	[0148.942] GetProcessHeap () returned 0x690000
	[0148.942] RtlFreeHeap (HeapHandle=0x690000, Flags=0x0, BaseAddress=0x697cc8) returned 1
	[0148.943] GetEnvironmentStringsW () returned 0x69b188*
	[0148.943] GetProcessHeap () returned 0x690000
	[0148.943] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x8, Size=0xa9c) returned 0x697cc8
	[0148.943] FreeEnvironmentStringsA (penv="=") returned 1
	[0148.943] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0148.943] GetProcessHeap () returned 0x690000
	[0148.943] RtlFreeHeap (HeapHandle=0x690000, Flags=0x0, BaseAddress=0x697cc8) returned 1
	[0148.943] GetEnvironmentStringsW () returned 0x69b188*
	[0148.943] GetProcessHeap () returned 0x690000
	[0148.943] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x8, Size=0xa9c) returned 0x697cc8
	[0148.943] FreeEnvironmentStringsA (penv="=") returned 1
	[0148.943] GetProcessHeap () returned 0x690000
	[0148.943] RtlFreeHeap (HeapHandle=0x690000, Flags=0x0, BaseAddress=0x69b138) returned 1
	[0148.943] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f728 | out: lpAttributeList=0x19f728) 
	[0148.944] _get_osfhandle (_FileHandle=1) returned 0x150
	[0148.944] SetConsoleMode (hConsoleHandle=0x150, dwMode=0x0) returned 0
	[0148.944] _get_osfhandle (_FileHandle=1) returned 0x150
	[0148.944] GetConsoleMode (in: hConsoleHandle=0x150, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0148.944] _get_osfhandle (_FileHandle=0) returned 0x144
	[0148.944] GetConsoleMode (in: hConsoleHandle=0x144, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0148.944] GetConsoleOutputCP () returned 0x1b5
	[0148.945] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0148.946] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0148.947] exit (_Code=128) 

Thread:
	id = 235
	os_tid = 0xe50


Process:
	id = "38"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\syswow64\\taskkill.exe"
	page_root = "0x4b2e6000"
	os_pid = "0x11e8"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "37"
	os_parent_pid = "0xd88"
	cmd_line = "taskkill  /f /im firefoxconfig.exe "
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 2982
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 2983
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 2984
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 2985
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 2986
	        start_va = 0xa0000
	          end_va = 0xdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 2987
	        start_va = 0xe0000
	          end_va = 0xe3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 2988
	        start_va = 0xf0000
	          end_va = 0xf0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 2989
	        start_va = 0x100000
	          end_va = 0x101fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 2990
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 2991
	        start_va = 0x13b0000
	          end_va = 0x13c5fff
	       monitored = 0
	     entry_point = 0x13bde80
	     region_type = mapped_file
	            name = "taskkill.exe"
	        filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe")

Region:
	              id = 2992
	        start_va = 0x13d0000
	          end_va = 0x53cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000013d0000"
	        filename = ""

Region:
	              id = 2993
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 2994
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 2995
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 2996
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 2997
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 2998
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 2999
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 3000
	        start_va = 0x5d0000
	          end_va = 0x5dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005d0000"
	        filename = ""

Region:
	              id = 3001
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 3002
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 3003
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 3004
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 3005
	        start_va = 0x5e0000
	          end_va = 0x86ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005e0000"
	        filename = ""

Region:
	              id = 3006
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 3007
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 3008
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 3009
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 3010
	        start_va = 0x110000
	          end_va = 0x1cdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 3011
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 3012
	        start_va = 0x74650000
	          end_va = 0x746cafff
	       monitored = 0
	     entry_point = 0x7466e970
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 3013
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 3014
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 3015
	        start_va = 0x440000
	          end_va = 0x47ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000440000"
	        filename = ""

Region:
	              id = 3016
	        start_va = 0x76ae0000
	          end_va = 0x76b23fff
	       monitored = 0
	     entry_point = 0x76af9d80
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 3017
	        start_va = 0x75260000
	          end_va = 0x7530cfff
	       monitored = 0
	     entry_point = 0x75274f00
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 3018
	        start_va = 0x74450000
	          end_va = 0x7446dfff
	       monitored = 0
	     entry_point = 0x7445b640
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 3019
	        start_va = 0x74440000
	          end_va = 0x74449fff
	       monitored = 0
	     entry_point = 0x74442a00
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 3020
	        start_va = 0x74590000
	          end_va = 0x745e7fff
	       monitored = 0
	     entry_point = 0x745d25c0
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 3021
	        start_va = 0x77450000
	          end_va = 0x77596fff
	       monitored = 0
	     entry_point = 0x77461cf0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 3022
	        start_va = 0x76b30000
	          end_va = 0x76c7efff
	       monitored = 0
	     entry_point = 0x76be6820
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 3023
	        start_va = 0x753c0000
	          end_va = 0x75451fff
	       monitored = 0
	     entry_point = 0x753f8cf0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 3024
	        start_va = 0x77290000
	          end_va = 0x7744cfff
	       monitored = 0
	     entry_point = 0x77372a10
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")

Region:
	              id = 3025
	        start_va = 0x75310000
	          end_va = 0x7536efff
	       monitored = 0
	     entry_point = 0x75314af0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 3026
	        start_va = 0x77240000
	          end_va = 0x77284fff
	       monitored = 0
	     entry_point = 0x7725de90
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 3027
	        start_va = 0x6cc90000
	          end_va = 0x6cc97fff
	       monitored = 0
	     entry_point = 0x6cc917b0
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 3028
	        start_va = 0x6cc70000
	          end_va = 0x6cc85fff
	       monitored = 0
	     entry_point = 0x6cc721d0
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")

Region:
	              id = 3029
	        start_va = 0x6cc30000
	          end_va = 0x6cc6efff
	       monitored = 0
	     entry_point = 0x6cc446c0
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll")

Region:
	              id = 3030
	        start_va = 0x6caf0000
	          end_va = 0x6cc2efff
	       monitored = 0
	     entry_point = 0x6cb1d880
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll")

Region:
	              id = 3031
	        start_va = 0x6cad0000
	          end_va = 0x6caebfff
	       monitored = 0
	     entry_point = 0x6cad4720
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")

Region:
	              id = 3032
	        start_va = 0x6cac0000
	          end_va = 0x6cac9fff
	       monitored = 0
	     entry_point = 0x6cac28d0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")

Region:
	              id = 3033
	        start_va = 0x870000
	          end_va = 0xa4ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000870000"
	        filename = ""

Region:
	              id = 3034
	        start_va = 0x1d0000
	          end_va = 0x1f9fff
	       monitored = 0
	     entry_point = 0x1d5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 3035
	        start_va = 0x5e0000
	          end_va = 0x767fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000005e0000"
	        filename = ""

Region:
	              id = 3036
	        start_va = 0x770000
	          end_va = 0x86ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000770000"
	        filename = ""

Region:
	              id = 3037
	        start_va = 0x74ea0000
	          end_va = 0x74ecafff
	       monitored = 0
	     entry_point = 0x74ea5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 3038
	        start_va = 0x870000
	          end_va = 0x9f0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000870000"
	        filename = ""

Region:
	              id = 3039
	        start_va = 0xa40000
	          end_va = 0xa4ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000a40000"
	        filename = ""

Region:
	              id = 3040
	        start_va = 0x53d0000
	          end_va = 0x67cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000053d0000"
	        filename = ""

Region:
	              id = 3041
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 3042
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001d0000"
	        filename = ""

Region:
	              id = 3043
	        start_va = 0x1e0000
	          end_va = 0x1e4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taskkill.exe.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui")

Region:
	              id = 3044
	        start_va = 0x1f0000
	          end_va = 0x1f0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001f0000"
	        filename = ""

Region:
	              id = 3045
	        start_va = 0x480000
	          end_va = 0x480fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 3046
	        start_va = 0xa50000
	          end_va = 0xd86fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 3047
	        start_va = 0x490000
	          end_va = 0x579fff
	       monitored = 0
	     entry_point = 0x4cd650
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 3048
	        start_va = 0x490000
	          end_va = 0x493fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000490000"
	        filename = ""

Region:
	              id = 3049
	        start_va = 0x4a0000
	          end_va = 0x57ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 3050
	        start_va = 0x76e20000
	          end_va = 0x76e2bfff
	       monitored = 0
	     entry_point = 0x76e23930
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")

Region:
	              id = 3051
	        start_va = 0x580000
	          end_va = 0x580fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000580000"
	        filename = ""

Region:
	              id = 3052
	        start_va = 0x76c80000
	          end_va = 0x76d03fff
	       monitored = 0
	     entry_point = 0x76ca6220
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 3053
	        start_va = 0x590000
	          end_va = 0x590fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000590000"
	        filename = ""

Region:
	              id = 3054
	        start_va = 0x6cab0000
	          end_va = 0x6cabcfff
	       monitored = 0
	     entry_point = 0x6cab3520
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 3055
	        start_va = 0x6ca40000
	          end_va = 0x6caa6fff
	       monitored = 0
	     entry_point = 0x6ca5b610
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 3056
	        start_va = 0x740f0000
	          end_va = 0x7410afff
	       monitored = 0
	     entry_point = 0x740f9050
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 3057
	        start_va = 0x6c9f0000
	          end_va = 0x6ca33fff
	       monitored = 0
	     entry_point = 0x6ca0aaf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")

Region:
	              id = 3058
	        start_va = 0xa00000
	          end_va = 0xa3ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000a00000"
	        filename = ""

Region:
	              id = 3059
	        start_va = 0xd90000
	          end_va = 0xdcffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d90000"
	        filename = ""

Region:
	              id = 3060
	        start_va = 0xdd0000
	          end_va = 0xe0ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000dd0000"
	        filename = ""

Region:
	              id = 3061
	        start_va = 0xe10000
	          end_va = 0xe4ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e10000"
	        filename = ""

Region:
	              id = 3062
	        start_va = 0xe50000
	          end_va = 0xe8ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e50000"
	        filename = ""

Region:
	              id = 3063
	        start_va = 0xe90000
	          end_va = 0xecffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e90000"
	        filename = ""

Region:
	              id = 3064
	        start_va = 0x6c9d0000
	          end_va = 0x6c9e0fff
	       monitored = 0
	     entry_point = 0x6c9d8fa0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 3065
	        start_va = 0x6c910000
	          end_va = 0x6c9cefff
	       monitored = 0
	     entry_point = 0x6c941e80
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 3067
	        start_va = 0x5a0000
	          end_va = 0x5a5fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000005a0000"
	        filename = ""


Thread:
	id = 236
	os_tid = 0xb68


Thread:
	id = 237
	os_tid = 0x90c


Thread:
	id = 238
	os_tid = 0xe8


Thread:
	id = 239
	os_tid = 0x750


Thread:
	id = 240
	os_tid = 0xa48


Process:
	id = "39"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x33c76000"
	os_pid = "0xe58"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x614"
	cmd_line = "cmd.exe /c \"taskkill /f /im tbirdconfig.exe \""
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 3070
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 3071
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 3072
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 3073
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 3074
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 3075
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 3076
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 3077
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 3078
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 3079
	        start_va = 0x13a0000
	          end_va = 0x13f1fff
	       monitored = 1
	     entry_point = 0x13b4fd0
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")

Region:
	              id = 3080
	        start_va = 0x1400000
	          end_va = 0x53fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001400000"
	        filename = ""

Region:
	              id = 3081
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 3082
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 3083
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 3084
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 3085
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 3086
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 3087
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 3088
	        start_va = 0x4c0000
	          end_va = 0x4cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004c0000"
	        filename = ""

Region:
	              id = 3089
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 3090
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 3091
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 3092
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 3093
	        start_va = 0x4d0000
	          end_va = 0x76ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004d0000"
	        filename = ""

Region:
	              id = 3094
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 3095
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 3096
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 3097
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 3098
	        start_va = 0x400000
	          end_va = 0x4bdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 3099
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 3100
	        start_va = 0x4d0000
	          end_va = 0x50ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004d0000"
	        filename = ""

Region:
	              id = 3101
	        start_va = 0x510000
	          end_va = 0x60ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000510000"
	        filename = ""

Region:
	              id = 3102
	        start_va = 0x670000
	          end_va = 0x76ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000670000"
	        filename = ""

Region:
	              id = 3103
	        start_va = 0x770000
	          end_va = 0x86ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000770000"
	        filename = ""

Region:
	              id = 3104
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 3105
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 3106
	        start_va = 0x870000
	          end_va = 0xba6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 241
	os_tid = 0x2c8

	[0149.310] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000
	[0149.310] __set_app_type (_Type=0x1) 
	[0149.310] __p__fmode () returned 0x74974d6c
	[0149.310] __p__commode () returned 0x74975b1c
	[0149.310] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13b5200) returned 0x0
	[0149.310] __getmainargs (in: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0, _DoWildCard=0, _StartInfo=0x13c60fc | out: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0) returned 0
	[0149.310] GetCurrentThreadId () returned 0x2c8
	[0149.310] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x2c8) returned 0x78
	[0149.311] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0149.311] GetProcAddress (hModule=0x75600000, lpProcName="SetThreadUILanguage") returned 0x75642510
	[0149.311] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0149.319] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0149.319] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2
	[0149.319] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0149.319] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0149.319] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0149.319] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0149.319] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0149.319] GetConsoleOutputCP () returned 0x1b5
	[0149.320] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0149.320] SetConsoleCtrlHandler (HandlerRoutine=0x13c0e40, Add=1) returned 1
	[0149.320] _get_osfhandle (_FileHandle=1) returned 0x144
	[0149.320] SetConsoleMode (hConsoleHandle=0x144, dwMode=0x0) returned 0
	[0149.320] _get_osfhandle (_FileHandle=1) returned 0x144
	[0149.320] GetConsoleMode (in: hConsoleHandle=0x144, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0149.320] _get_osfhandle (_FileHandle=0) returned 0x140
	[0149.320] GetConsoleMode (in: hConsoleHandle=0x140, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0149.320] GetEnvironmentStringsW () returned 0x677d10*
	[0149.321] GetProcessHeap () returned 0x670000
	[0149.321] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xa1a) returned 0x678738
	[0149.321] FreeEnvironmentStringsA (penv="A") returned 1
	[0149.321] GetProcessHeap () returned 0x670000
	[0149.321] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4) returned 0x670588
	[0149.321] GetEnvironmentStringsW () returned 0x677d10*
	[0149.321] GetProcessHeap () returned 0x670000
	[0149.321] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xa1a) returned 0x679160
	[0149.321] FreeEnvironmentStringsA (penv="A") returned 1
	[0149.321] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0149.321] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0149.321] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0149.321] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0149.321] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0149.322] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0149.322] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0149.322] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0149.322] RegCloseKey (hKey=0x88) returned 0x0
	[0149.322] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0149.322] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0149.322] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0149.322] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0149.322] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0149.322] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0149.322] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0149.322] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0149.322] RegCloseKey (hKey=0x88) returned 0x0
	[0149.322] time (in: timer=0x0 | out: timer=0x0) returned 0x6234421f
	[0149.322] srand (_Seed=0x6234421f) 
	[0149.322] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im tbirdconfig.exe \""
	[0149.322] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im tbirdconfig.exe \""
	[0149.322] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0149.323] GetProcessHeap () returned 0x670000
	[0149.323] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x210) returned 0x679b88
	[0149.323] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x679b90, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0149.323] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0149.323] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0149.324] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0149.324] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0149.324] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0149.324] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0149.324] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0149.324] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0149.324] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0149.324] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0149.324] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0149.324] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0149.325] GetProcessHeap () returned 0x670000
	[0149.325] RtlFreeHeap (HeapHandle=0x670000, Flags=0x0, BaseAddress=0x678738) returned 1
	[0149.325] GetEnvironmentStringsW () returned 0x677d10*
	[0149.325] GetProcessHeap () returned 0x670000
	[0149.325] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xa32) returned 0x67a7e0
	[0149.325] FreeEnvironmentStringsA (penv="A") returned 1
	[0149.325] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b
	[0149.325] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0149.326] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0149.326] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0149.326] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0149.326] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0149.326] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0149.326] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0149.326] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0149.326] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0149.326] GetProcessHeap () returned 0x670000
	[0149.326] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x44) returned 0x674148
	[0149.326] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0149.326] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19fc4c*="Desktop") returned 0x1d
	[0149.326] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0149.326] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x6705c8
	[0149.326] FindClose (in: hFindFile=0x6705c8 | out: hFindFile=0x6705c8) returned 1
	[0149.326] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x6705c8
	[0149.327] FindClose (in: hFindFile=0x6705c8 | out: hFindFile=0x6705c8) returned 1
	[0149.327] _wcsnicmp (_String1="RDHJ0C~1", _String2="RDhJ0CNFevzX", _MaxCount=0xc) returned 16
	[0149.327] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x6705c8
	[0149.327] FindClose (in: hFindFile=0x6705c8 | out: hFindFile=0x6705c8) returned 1
	[0149.327] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0149.327] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1
	[0149.327] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 1
	[0149.327] GetProcessHeap () returned 0x670000
	[0149.327] RtlFreeHeap (HeapHandle=0x670000, Flags=0x0, BaseAddress=0x67a7e0) returned 1
	[0149.328] GetEnvironmentStringsW () returned 0x677d10*
	[0149.328] GetProcessHeap () returned 0x670000
	[0149.328] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xa76) returned 0x679da0
	[0149.328] FreeEnvironmentStringsA (penv="=") returned 1
	[0149.328] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0149.328] GetProcessHeap () returned 0x670000
	[0149.328] RtlFreeHeap (HeapHandle=0x670000, Flags=0x0, BaseAddress=0x674148) returned 1
	[0149.328] GetProcessHeap () returned 0x670000
	[0149.328] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x400e) returned 0x67bca0
	[0149.735] GetProcessHeap () returned 0x670000
	[0149.735] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x52) returned 0x674148
	[0149.736] GetProcessHeap () returned 0x670000
	[0149.736] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4008) returned 0x67fcb8
	[0149.736] GetProcessHeap () returned 0x670000
	[0149.736] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4008) returned 0x683cc8
	[0149.737] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0149.738] GetProcessHeap () returned 0x670000
	[0149.738] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x418) returned 0x67a820
	[0149.738] SetErrorMode (uMode=0x0) returned 0x8003
	[0149.738] SetErrorMode (uMode=0x1) returned 0x0
	[0149.738] GetFullPathNameW (in: lpFileName="taskkill \\f \\.", nBufferLength=0x208, lpBuffer=0x67a828, lpFilePart=0x19fbac | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f", lpFilePart=0x19fbac*="f") returned 0x29
	[0149.738] SetErrorMode (uMode=0x8003) returned 0x1
	[0149.738] GetProcessHeap () returned 0x670000
	[0149.738] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x67a820, Size=0x84) returned 0x67a820
	[0149.738] GetProcessHeap () returned 0x670000
	[0149.738] RtlSizeHeap (HeapHandle=0x670000, Flags=0x0, MemoryPointer=0x67a820) returned 0x84
	[0149.739] NeedCurrentDirectoryForExePathW (ExeName="taskkill \\f \\.") returned 1
	[0149.739] GetProcessHeap () returned 0x670000
	[0149.739] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x62) returned 0x67a8b0
	[0149.739] GetProcessHeap () returned 0x670000
	[0149.739] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xb8) returned 0x67a920
	[0149.739] GetProcessHeap () returned 0x670000
	[0149.740] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x67a920, Size=0x62) returned 0x67a920
	[0149.740] GetProcessHeap () returned 0x670000
	[0149.740] RtlSizeHeap (HeapHandle=0x670000, Flags=0x0, MemoryPointer=0x67a920) returned 0x62
	[0149.740] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0149.740] GetProcessHeap () returned 0x670000
	[0149.740] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xe0) returned 0x67a990
	[0149.757] GetProcessHeap () returned 0x670000
	[0149.757] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x67a990, Size=0x76) returned 0x67a990
	[0149.757] GetProcessHeap () returned 0x670000
	[0149.757] RtlSizeHeap (HeapHandle=0x670000, Flags=0x0, MemoryPointer=0x67a990) returned 0x76
	[0149.757] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0149.757] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f\\im tbirdconfig.exe ", fInfoLevelId=0x1, lpFindFileData=0x19f958, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f958) returned 0xffffffff
	[0149.758] GetLastError () returned 0x3
	[0149.758] GetProcessHeap () returned 0x670000
	[0149.758] RtlFreeHeap (HeapHandle=0x670000, Flags=0x0, BaseAddress=0x67fcb8) returned 1
	[0149.758] GetProcessHeap () returned 0x670000
	[0149.759] RtlFreeHeap (HeapHandle=0x670000, Flags=0x0, BaseAddress=0x683cc8) returned 1
	[0149.759] GetProcessHeap () returned 0x670000
	[0149.759] RtlFreeHeap (HeapHandle=0x670000, Flags=0x0, BaseAddress=0x67bca0) returned 1
	[0149.759] GetConsoleOutputCP () returned 0x1b5
	[0149.763] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0149.763] GetUserDefaultLCID () returned 0x409
	[0149.763] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x13d34a0, cchData=8 | out: lpLCData=":") returned 2
	[0149.763] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0149.763] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0149.763] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2
	[0149.764] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x13d34b0, cchData=8 | out: lpLCData="/") returned 2
	[0149.764] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x13d3500, cchData=32 | out: lpLCData="Mon") returned 4
	[0149.764] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x13d3540, cchData=32 | out: lpLCData="Tue") returned 4
	[0149.764] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x13d3580, cchData=32 | out: lpLCData="Wed") returned 4
	[0149.764] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x13d35c0, cchData=32 | out: lpLCData="Thu") returned 4
	[0149.764] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x13d3600, cchData=32 | out: lpLCData="Fri") returned 4
	[0149.764] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x13d3640, cchData=32 | out: lpLCData="Sat") returned 4
	[0149.764] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x13d3680, cchData=32 | out: lpLCData="Sun") returned 4
	[0149.764] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x13d34c0, cchData=8 | out: lpLCData=".") returned 2
	[0149.764] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x13d34e0, cchData=8 | out: lpLCData=",") returned 2
	[0149.764] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0149.766] GetProcessHeap () returned 0x670000
	[0149.766] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x20c) returned 0x67aa58
	[0149.766] GetConsoleTitleW (in: lpConsoleTitle=0x67aa58, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0149.768] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0149.769] GetProcAddress (hModule=0x75600000, lpProcName="CopyFileExW") returned 0x7561ffc0
	[0149.769] GetProcAddress (hModule=0x75600000, lpProcName="IsDebuggerPresent") returned 0x7561b0b0
	[0149.769] GetProcAddress (hModule=0x75600000, lpProcName="SetConsoleInputExeNameW") returned 0x7559b440
	[0149.769] GetProcessHeap () returned 0x670000
	[0149.769] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x400a) returned 0x67bca0
	[0149.769] GetProcessHeap () returned 0x670000
	[0149.770] RtlFreeHeap (HeapHandle=0x670000, Flags=0x0, BaseAddress=0x67bca0) returned 1
	[0149.771] _wcsicmp (_String1="taskkill", _String2=")") returned 75
	[0149.771] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14
	[0149.771] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14
	[0149.771] _wcsicmp (_String1="IF", _String2="taskkill") returned -11
	[0149.771] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11
	[0149.771] _wcsicmp (_String1="REM", _String2="taskkill") returned -2
	[0149.771] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2
	[0149.771] GetProcessHeap () returned 0x670000
	[0149.771] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x58) returned 0x67ac70
	[0149.771] GetProcessHeap () returned 0x670000
	[0149.771] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x1a) returned 0x67acd0
	[0149.772] GetProcessHeap () returned 0x670000
	[0149.772] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x3a) returned 0x67acf8
	[0149.773] GetConsoleTitleW (in: lpConsoleTitle=0x19fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0149.776] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0149.776] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0149.776] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0149.776] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0149.776] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0149.777] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0149.777] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0149.777] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0149.777] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0149.777] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0149.778] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0149.778] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0149.778] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0149.778] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0149.778] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0149.778] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0149.778] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0149.778] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0149.778] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0149.778] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0149.778] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0149.778] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0149.778] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0149.778] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0149.778] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0149.778] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0149.778] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0149.778] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0149.778] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0149.778] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0149.778] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0149.778] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0149.778] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0149.778] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0149.778] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0149.779] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0149.779] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0149.779] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0149.779] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0149.779] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0149.779] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0149.779] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0149.779] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0149.779] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0149.779] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0149.779] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0149.779] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0149.779] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0149.779] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0149.779] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0149.779] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0149.779] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0149.779] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0149.779] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0149.779] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0149.779] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0149.779] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0149.779] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0149.779] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0149.779] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0149.779] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0149.780] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0149.780] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0149.780] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0149.780] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0149.780] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0149.780] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0149.780] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0149.780] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0149.780] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0149.780] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0149.780] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0149.780] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0149.780] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0149.780] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0149.780] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0149.780] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0149.780] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0149.780] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0149.780] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0149.780] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0149.780] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0149.780] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0149.780] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0149.781] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14
	[0149.781] _wcsicmp (_String1="taskkill", _String2="IF") returned 11
	[0149.781] _wcsicmp (_String1="taskkill", _String2="REM") returned 2
	[0149.781] GetProcessHeap () returned 0x670000
	[0149.781] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x210) returned 0x67ad40
	[0149.781] GetProcessHeap () returned 0x670000
	[0149.782] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x4c) returned 0x67af58
	[0149.782] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0149.782] GetProcessHeap () returned 0x670000
	[0149.782] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x418) returned 0x6705c8
	[0149.782] SetErrorMode (uMode=0x0) returned 0x8003
	[0149.782] SetErrorMode (uMode=0x1) returned 0x0
	[0149.782] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x6705d0, lpFilePart=0x19f57c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19f57c*="Desktop") returned 0x1d
	[0149.782] SetErrorMode (uMode=0x8003) returned 0x1
	[0149.782] GetProcessHeap () returned 0x670000
	[0149.782] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x6705c8, Size=0x56) returned 0x6705c8
	[0149.783] GetProcessHeap () returned 0x670000
	[0149.783] RtlSizeHeap (HeapHandle=0x670000, Flags=0x0, MemoryPointer=0x6705c8) returned 0x56
	[0149.783] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0149.783] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0149.783] GetProcessHeap () returned 0x670000
	[0149.783] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x110) returned 0x67afb0
	[0149.783] GetProcessHeap () returned 0x670000
	[0149.783] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x218) returned 0x670628
	[0149.789] GetProcessHeap () returned 0x670000
	[0149.789] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x670628, Size=0x112) returned 0x670628
	[0149.789] GetProcessHeap () returned 0x670000
	[0149.789] RtlSizeHeap (HeapHandle=0x670000, Flags=0x0, MemoryPointer=0x670628) returned 0x112
	[0149.789] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0149.789] GetProcessHeap () returned 0x670000
	[0149.789] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xe0) returned 0x67b0c8
	[0149.791] GetProcessHeap () returned 0x670000
	[0149.791] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x67b0c8, Size=0x76) returned 0x67b0c8
	[0149.791] GetProcessHeap () returned 0x670000
	[0149.791] RtlSizeHeap (HeapHandle=0x670000, Flags=0x0, MemoryPointer=0x67b0c8) returned 0x76
	[0149.791] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0149.792] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0149.792] GetLastError () returned 0x2
	[0149.792] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0149.792] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x67b148
	[0149.792] GetProcessHeap () returned 0x670000
	[0149.792] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x0, Size=0x14) returned 0x677690
	[0149.792] FindClose (in: hFindFile=0x67b148 | out: hFindFile=0x67b148) returned 1
	[0149.793] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0149.793] GetLastError () returned 0x2
	[0149.793] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x67b148
	[0149.794] GetProcessHeap () returned 0x670000
	[0149.794] RtlReAllocateHeap (Heap=0x670000, Flags=0x0, Ptr=0x677690, Size=0x4) returned 0x670598
	[0149.794] FindClose (in: hFindFile=0x67b148 | out: hFindFile=0x67b148) returned 1
	[0149.794] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0149.794] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0149.794] GetConsoleTitleW (in: lpConsoleTitle=0x19f7fc, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0149.797] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f728, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f70c | out: lpAttributeList=0x19f728, lpSize=0x19f70c) returned 1
	[0149.797] UpdateProcThreadAttribute (in: lpAttributeList=0x19f728, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f714, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f728, lpPreviousValue=0x0) returned 1
	[0149.798] GetStartupInfoW (in: lpStartupInfo=0x19f760 | out: lpStartupInfo=0x19f760*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x140, hStdOutput=0x144, hStdError=0x150)) 
	[0149.798] GetProcessHeap () returned 0x670000
	[0149.798] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0x18) returned 0x6776d0
	[0149.798] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0149.798] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0149.798] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0149.798] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0149.798] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0149.798] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0149.798] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0149.798] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0149.798] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0149.798] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0149.798] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0149.798] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0149.798] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0149.798] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0149.798] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0149.798] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0149.798] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0149.799] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0149.799] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0149.799] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0149.799] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0149.799] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0149.799] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0149.799] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0149.799] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0149.799] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0149.799] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0149.799] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0149.799] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0149.799] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0149.799] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0149.799] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0149.799] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0149.799] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0149.799] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0149.799] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0149.799] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0149.799] GetProcessHeap () returned 0x670000
	[0149.799] RtlFreeHeap (HeapHandle=0x670000, Flags=0x0, BaseAddress=0x6776d0) returned 1
	[0149.799] GetProcessHeap () returned 0x670000
	[0149.800] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xa) returned 0x67b148
	[0149.800] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1
	[0149.803] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill  /f /im tbirdconfig.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x19f6b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill  /f /im tbirdconfig.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f6fc | out: lpCommandLine="taskkill  /f /im tbirdconfig.exe ", lpProcessInformation=0x19f6fc*(hProcess=0x9c, hThread=0x98, dwProcessId=0x8a4, dwThreadId=0x368)) returned 1
	[0149.920] CloseHandle (hObject=0x98) returned 1
	[0149.920] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0149.921] GetProcessHeap () returned 0x670000
	[0149.921] RtlFreeHeap (HeapHandle=0x670000, Flags=0x0, BaseAddress=0x679da0) returned 1
	[0149.921] GetEnvironmentStringsW () returned 0x679da0*
	[0149.921] GetProcessHeap () returned 0x670000
	[0149.921] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xa76) returned 0x677d10
	[0149.921] FreeEnvironmentStringsA (penv="=") returned 1
	[0149.921] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0
	[0150.611] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x19f694 | out: lpExitCode=0x19f694*=0x80) returned 1
	[0150.611] CloseHandle (hObject=0x9c) returned 1
	[0150.611] _vsnwprintf (in: _Buffer=0x19f77c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f69c | out: _Buffer="00000080") returned 8
	[0150.611] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1
	[0150.612] GetProcessHeap () returned 0x670000
	[0150.612] RtlFreeHeap (HeapHandle=0x670000, Flags=0x0, BaseAddress=0x677d10) returned 1
	[0150.612] GetEnvironmentStringsW () returned 0x67b178*
	[0150.612] GetProcessHeap () returned 0x670000
	[0150.612] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xa9c) returned 0x677d10
	[0150.612] FreeEnvironmentStringsA (penv="=") returned 1
	[0150.612] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0150.612] GetProcessHeap () returned 0x670000
	[0150.613] RtlFreeHeap (HeapHandle=0x670000, Flags=0x0, BaseAddress=0x677d10) returned 1
	[0150.614] GetEnvironmentStringsW () returned 0x67b178*
	[0150.614] GetProcessHeap () returned 0x670000
	[0150.614] RtlAllocateHeap (HeapHandle=0x670000, Flags=0x8, Size=0xa9c) returned 0x677d10
	[0150.614] FreeEnvironmentStringsA (penv="=") returned 1
	[0150.614] GetProcessHeap () returned 0x670000
	[0150.614] RtlFreeHeap (HeapHandle=0x670000, Flags=0x0, BaseAddress=0x67b148) returned 1
	[0150.614] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f728 | out: lpAttributeList=0x19f728) 
	[0150.614] _get_osfhandle (_FileHandle=1) returned 0x144
	[0150.614] SetConsoleMode (hConsoleHandle=0x144, dwMode=0x0) returned 0
	[0150.614] _get_osfhandle (_FileHandle=1) returned 0x144
	[0150.614] GetConsoleMode (in: hConsoleHandle=0x144, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0150.614] _get_osfhandle (_FileHandle=0) returned 0x140
	[0150.614] GetConsoleMode (in: hConsoleHandle=0x140, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0150.614] GetConsoleOutputCP () returned 0x1b5
	[0150.614] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0150.615] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0150.645] exit (_Code=128) 

Thread:
	id = 242
	os_tid = 0xb10


Process:
	id = "40"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\syswow64\\taskkill.exe"
	page_root = "0x33c00000"
	os_pid = "0x8a4"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "39"
	os_parent_pid = "0xe58"
	cmd_line = "taskkill  /f /im tbirdconfig.exe "
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 3107
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 3108
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 3109
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 3110
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 3111
	        start_va = 0xa0000
	          end_va = 0xdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 3112
	        start_va = 0xe0000
	          end_va = 0xe3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 3113
	        start_va = 0xf0000
	          end_va = 0xf0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 3114
	        start_va = 0x100000
	          end_va = 0x101fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 3115
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 3116
	        start_va = 0x13b0000
	          end_va = 0x13c5fff
	       monitored = 0
	     entry_point = 0x13bde80
	     region_type = mapped_file
	            name = "taskkill.exe"
	        filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe")

Region:
	              id = 3117
	        start_va = 0x13d0000
	          end_va = 0x53cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000013d0000"
	        filename = ""

Region:
	              id = 3118
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 3119
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 3120
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 3121
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 3122
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 3123
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 3124
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 3125
	        start_va = 0x190000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000190000"
	        filename = ""

Region:
	              id = 3126
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 3127
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 3128
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 3129
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 3130
	        start_va = 0x400000
	          end_va = 0x63ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 3131
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 3132
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 3133
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 3134
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 3135
	        start_va = 0x400000
	          end_va = 0x4bdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 3136
	        start_va = 0x540000
	          end_va = 0x63ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000540000"
	        filename = ""

Region:
	              id = 3137
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 3138
	        start_va = 0x74650000
	          end_va = 0x746cafff
	       monitored = 0
	     entry_point = 0x7466e970
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 3139
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 3140
	        start_va = 0x110000
	          end_va = 0x14ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000110000"
	        filename = ""

Region:
	              id = 3141
	        start_va = 0x150000
	          end_va = 0x18ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000150000"
	        filename = ""

Region:
	              id = 3142
	        start_va = 0x76ae0000
	          end_va = 0x76b23fff
	       monitored = 0
	     entry_point = 0x76af9d80
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 3143
	        start_va = 0x75260000
	          end_va = 0x7530cfff
	       monitored = 0
	     entry_point = 0x75274f00
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 3144
	        start_va = 0x74450000
	          end_va = 0x7446dfff
	       monitored = 0
	     entry_point = 0x7445b640
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 3145
	        start_va = 0x74440000
	          end_va = 0x74449fff
	       monitored = 0
	     entry_point = 0x74442a00
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 3146
	        start_va = 0x74590000
	          end_va = 0x745e7fff
	       monitored = 0
	     entry_point = 0x745d25c0
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 3147
	        start_va = 0x77450000
	          end_va = 0x77596fff
	       monitored = 0
	     entry_point = 0x77461cf0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 3148
	        start_va = 0x76b30000
	          end_va = 0x76c7efff
	       monitored = 0
	     entry_point = 0x76be6820
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 3149
	        start_va = 0x753c0000
	          end_va = 0x75451fff
	       monitored = 0
	     entry_point = 0x753f8cf0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 3150
	        start_va = 0x77290000
	          end_va = 0x7744cfff
	       monitored = 0
	     entry_point = 0x77372a10
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")

Region:
	              id = 3151
	        start_va = 0x75310000
	          end_va = 0x7536efff
	       monitored = 0
	     entry_point = 0x75314af0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 3152
	        start_va = 0x77240000
	          end_va = 0x77284fff
	       monitored = 0
	     entry_point = 0x7725de90
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 3153
	        start_va = 0x6cc90000
	          end_va = 0x6cc97fff
	       monitored = 0
	     entry_point = 0x6cc917b0
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 3154
	        start_va = 0x6cc70000
	          end_va = 0x6cc85fff
	       monitored = 0
	     entry_point = 0x6cc721d0
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")

Region:
	              id = 3155
	        start_va = 0x6cc30000
	          end_va = 0x6cc6efff
	       monitored = 0
	     entry_point = 0x6cc446c0
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll")

Region:
	              id = 3156
	        start_va = 0x6caf0000
	          end_va = 0x6cc2efff
	       monitored = 0
	     entry_point = 0x6cb1d880
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll")

Region:
	              id = 3157
	        start_va = 0x6cad0000
	          end_va = 0x6caebfff
	       monitored = 0
	     entry_point = 0x6cad4720
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")

Region:
	              id = 3158
	        start_va = 0x6cac0000
	          end_va = 0x6cac9fff
	       monitored = 0
	     entry_point = 0x6cac28d0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")

Region:
	              id = 3159
	        start_va = 0x640000
	          end_va = 0x79ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000640000"
	        filename = ""

Region:
	              id = 3160
	        start_va = 0x1a0000
	          end_va = 0x1c9fff
	       monitored = 0
	     entry_point = 0x1a5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 3161
	        start_va = 0x7a0000
	          end_va = 0x927fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000007a0000"
	        filename = ""

Region:
	              id = 3162
	        start_va = 0x74ea0000
	          end_va = 0x74ecafff
	       monitored = 0
	     entry_point = 0x74ea5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 3163
	        start_va = 0x930000
	          end_va = 0xab0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000930000"
	        filename = ""

Region:
	              id = 3164
	        start_va = 0x53d0000
	          end_va = 0x67cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000053d0000"
	        filename = ""

Region:
	              id = 3165
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 3166
	        start_va = 0x1a0000
	          end_va = 0x1a0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 3167
	        start_va = 0x1b0000
	          end_va = 0x1b4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taskkill.exe.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui")

Region:
	              id = 3168
	        start_va = 0x1c0000
	          end_va = 0x1c0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 3169
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001d0000"
	        filename = ""

Region:
	              id = 3170
	        start_va = 0xac0000
	          end_va = 0xdf6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 3171
	        start_va = 0x640000
	          end_va = 0x729fff
	       monitored = 0
	     entry_point = 0x67d650
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 3172
	        start_va = 0x790000
	          end_va = 0x79ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000790000"
	        filename = ""

Region:
	              id = 3173
	        start_va = 0x1e0000
	          end_va = 0x1e3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001e0000"
	        filename = ""

Region:
	              id = 3174
	        start_va = 0x640000
	          end_va = 0x71ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 3175
	        start_va = 0x76e20000
	          end_va = 0x76e2bfff
	       monitored = 0
	     entry_point = 0x76e23930
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")

Region:
	              id = 3176
	        start_va = 0x1f0000
	          end_va = 0x1f0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001f0000"
	        filename = ""

Region:
	              id = 3177
	        start_va = 0x76c80000
	          end_va = 0x76d03fff
	       monitored = 0
	     entry_point = 0x76ca6220
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 3178
	        start_va = 0x4c0000
	          end_va = 0x4c0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004c0000"
	        filename = ""

Region:
	              id = 3179
	        start_va = 0x6cab0000
	          end_va = 0x6cabcfff
	       monitored = 0
	     entry_point = 0x6cab3520
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 3180
	        start_va = 0x6ca40000
	          end_va = 0x6caa6fff
	       monitored = 0
	     entry_point = 0x6ca5b610
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 3181
	        start_va = 0x740f0000
	          end_va = 0x7410afff
	       monitored = 0
	     entry_point = 0x740f9050
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 3182
	        start_va = 0x6c9f0000
	          end_va = 0x6ca33fff
	       monitored = 0
	     entry_point = 0x6ca0aaf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")

Region:
	              id = 3183
	        start_va = 0x4d0000
	          end_va = 0x50ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004d0000"
	        filename = ""

Region:
	              id = 3184
	        start_va = 0x720000
	          end_va = 0x75ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000720000"
	        filename = ""

Region:
	              id = 3185
	        start_va = 0xe00000
	          end_va = 0xe3ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e00000"
	        filename = ""

Region:
	              id = 3186
	        start_va = 0xe40000
	          end_va = 0xe7ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e40000"
	        filename = ""

Region:
	              id = 3187
	        start_va = 0xe80000
	          end_va = 0xebffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e80000"
	        filename = ""

Region:
	              id = 3188
	        start_va = 0xec0000
	          end_va = 0xefffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ec0000"
	        filename = ""

Region:
	              id = 3189
	        start_va = 0x6c9d0000
	          end_va = 0x6c9e0fff
	       monitored = 0
	     entry_point = 0x6c9d8fa0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 3190
	        start_va = 0x6c910000
	          end_va = 0x6c9cefff
	       monitored = 0
	     entry_point = 0x6c941e80
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 3192
	        start_va = 0x510000
	          end_va = 0x515fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000510000"
	        filename = ""


Thread:
	id = 243
	os_tid = 0x368


Thread:
	id = 244
	os_tid = 0xe54


Thread:
	id = 245
	os_tid = 0xac8


Thread:
	id = 246
	os_tid = 0x700


Thread:
	id = 247
	os_tid = 0xbfc


Process:
	id = "41"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x3377d000"
	os_pid = "0xec"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x614"
	cmd_line = "cmd.exe /c \"taskkill /f /im ocomm.exe \""
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 3195
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 3196
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 3197
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 3198
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 3199
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 3200
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 3201
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 3202
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 3203
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 3204
	        start_va = 0x13a0000
	          end_va = 0x13f1fff
	       monitored = 1
	     entry_point = 0x13b4fd0
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")

Region:
	              id = 3205
	        start_va = 0x1400000
	          end_va = 0x53fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001400000"
	        filename = ""

Region:
	              id = 3206
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 3207
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 3208
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 3209
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 3210
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 3211
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 3212
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 3213
	        start_va = 0x500000
	          end_va = 0x50ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000500000"
	        filename = ""

Region:
	              id = 3214
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 3215
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 3216
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 3217
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 3218
	        start_va = 0x510000
	          end_va = 0x7affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000510000"
	        filename = ""

Region:
	              id = 3219
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 3220
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 3221
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 3222
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 3223
	        start_va = 0x400000
	          end_va = 0x4bdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 3224
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 3225
	        start_va = 0x4c0000
	          end_va = 0x4fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004c0000"
	        filename = ""

Region:
	              id = 3226
	        start_va = 0x510000
	          end_va = 0x60ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000510000"
	        filename = ""

Region:
	              id = 3227
	        start_va = 0x6b0000
	          end_va = 0x7affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006b0000"
	        filename = ""

Region:
	              id = 3228
	        start_va = 0x7b0000
	          end_va = 0x93ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000007b0000"
	        filename = ""

Region:
	              id = 3229
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 3230
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 3231
	        start_va = 0x940000
	          end_va = 0xc76fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 248
	os_tid = 0x1230

	[0150.932] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000
	[0150.932] __set_app_type (_Type=0x1) 
	[0150.932] __p__fmode () returned 0x74974d6c
	[0150.932] __p__commode () returned 0x74975b1c
	[0150.932] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13b5200) returned 0x0
	[0150.932] __getmainargs (in: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0, _DoWildCard=0, _StartInfo=0x13c60fc | out: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0) returned 0
	[0150.932] GetCurrentThreadId () returned 0x1230
	[0150.932] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x1230) returned 0x78
	[0150.933] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0150.933] GetProcAddress (hModule=0x75600000, lpProcName="SetThreadUILanguage") returned 0x75642510
	[0150.933] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0150.939] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0150.939] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2
	[0150.939] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0150.939] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0150.939] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0150.939] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0150.939] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0150.939] GetConsoleOutputCP () returned 0x1b5
	[0150.943] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0150.944] SetConsoleCtrlHandler (HandlerRoutine=0x13c0e40, Add=1) returned 1
	[0150.944] _get_osfhandle (_FileHandle=1) returned 0x140
	[0150.944] SetConsoleMode (hConsoleHandle=0x140, dwMode=0x0) returned 0
	[0150.944] _get_osfhandle (_FileHandle=1) returned 0x140
	[0150.944] GetConsoleMode (in: hConsoleHandle=0x140, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0150.944] _get_osfhandle (_FileHandle=0) returned 0x13c
	[0150.944] GetConsoleMode (in: hConsoleHandle=0x13c, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0150.944] GetEnvironmentStringsW () returned 0x6b7cb0*
	[0150.944] GetProcessHeap () returned 0x6b0000
	[0150.944] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xa1a) returned 0x6b86d8
	[0150.944] FreeEnvironmentStringsA (penv="A") returned 1
	[0150.944] GetProcessHeap () returned 0x6b0000
	[0150.945] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x4) returned 0x6b0550
	[0150.945] GetEnvironmentStringsW () returned 0x6b7cb0*
	[0150.945] GetProcessHeap () returned 0x6b0000
	[0150.945] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xa1a) returned 0x6b9100
	[0150.945] FreeEnvironmentStringsA (penv="A") returned 1
	[0150.945] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0150.945] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0150.946] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0150.946] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0150.946] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0150.946] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0150.946] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0150.946] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0150.946] RegCloseKey (hKey=0x88) returned 0x0
	[0150.946] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0150.946] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0150.946] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0150.946] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0150.946] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0150.946] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0150.946] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0150.946] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0150.946] RegCloseKey (hKey=0x88) returned 0x0
	[0150.947] time (in: timer=0x0 | out: timer=0x0) returned 0x62344221
	[0150.947] srand (_Seed=0x62344221) 
	[0150.947] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im ocomm.exe \""
	[0150.947] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im ocomm.exe \""
	[0150.947] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0150.947] GetProcessHeap () returned 0x6b0000
	[0150.947] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x210) returned 0x6b9b28
	[0150.947] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6b9b30, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0150.947] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0150.947] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0150.947] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0150.947] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0150.947] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0150.947] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0150.947] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0150.947] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0150.947] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0150.947] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0150.947] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0150.948] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0150.948] GetProcessHeap () returned 0x6b0000
	[0150.948] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6b86d8) returned 1
	[0150.948] GetEnvironmentStringsW () returned 0x6b7cb0*
	[0150.948] GetProcessHeap () returned 0x6b0000
	[0150.948] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xa32) returned 0x6ba780
	[0150.948] FreeEnvironmentStringsA (penv="A") returned 1
	[0150.948] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b
	[0150.948] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0150.948] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0150.949] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0150.949] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0150.949] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0150.949] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0150.949] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0150.949] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0150.949] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0150.949] GetProcessHeap () returned 0x6b0000
	[0150.949] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x44) returned 0x6b05c8
	[0150.949] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0150.949] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19fc4c*="Desktop") returned 0x1d
	[0150.949] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0150.949] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x6b0618
	[0150.950] FindClose (in: hFindFile=0x6b0618 | out: hFindFile=0x6b0618) returned 1
	[0150.950] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x6b0618
	[0150.950] FindClose (in: hFindFile=0x6b0618 | out: hFindFile=0x6b0618) returned 1
	[0150.950] _wcsnicmp (_String1="RDHJ0C~1", _String2="RDhJ0CNFevzX", _MaxCount=0xc) returned 16
	[0150.950] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x6b0618
	[0150.950] FindClose (in: hFindFile=0x6b0618 | out: hFindFile=0x6b0618) returned 1
	[0150.950] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0150.950] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1
	[0150.950] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 1
	[0150.950] GetProcessHeap () returned 0x6b0000
	[0150.951] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6ba780) returned 1
	[0150.951] GetEnvironmentStringsW () returned 0x6b7cb0*
	[0150.951] GetProcessHeap () returned 0x6b0000
	[0150.951] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xa76) returned 0x6b9d40
	[0150.951] FreeEnvironmentStringsA (penv="=") returned 1
	[0150.951] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0150.951] GetProcessHeap () returned 0x6b0000
	[0150.951] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6b05c8) returned 1
	[0150.952] GetProcessHeap () returned 0x6b0000
	[0150.952] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x400e) returned 0x6bbc40
	[0150.952] GetProcessHeap () returned 0x6b0000
	[0150.952] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x46) returned 0x6ba7c0
	[0150.952] GetProcessHeap () returned 0x6b0000
	[0150.952] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x4008) returned 0x6bfc58
	[0150.952] GetProcessHeap () returned 0x6b0000
	[0150.952] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x4008) returned 0x6c3c68
	[0150.954] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0150.954] GetProcessHeap () returned 0x6b0000
	[0150.954] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x418) returned 0x6ba810
	[0150.954] SetErrorMode (uMode=0x0) returned 0x8003
	[0150.954] SetErrorMode (uMode=0x1) returned 0x0
	[0150.954] GetFullPathNameW (in: lpFileName="taskkill \\f \\.", nBufferLength=0x208, lpBuffer=0x6ba818, lpFilePart=0x19fbac | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f", lpFilePart=0x19fbac*="f") returned 0x29
	[0150.955] SetErrorMode (uMode=0x8003) returned 0x1
	[0150.964] GetProcessHeap () returned 0x6b0000
	[0150.964] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6ba810, Size=0x78) returned 0x6ba810
	[0150.964] GetProcessHeap () returned 0x6b0000
	[0150.964] RtlSizeHeap (HeapHandle=0x6b0000, Flags=0x0, MemoryPointer=0x6ba810) returned 0x78
	[0150.965] NeedCurrentDirectoryForExePathW (ExeName="taskkill \\f \\.") returned 1
	[0150.965] GetProcessHeap () returned 0x6b0000
	[0150.965] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x62) returned 0x6ba890
	[0150.965] GetProcessHeap () returned 0x6b0000
	[0150.965] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xb8) returned 0x6ba900
	[0150.965] GetProcessHeap () returned 0x6b0000
	[0150.965] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6ba900, Size=0x62) returned 0x6ba900
	[0150.965] GetProcessHeap () returned 0x6b0000
	[0150.965] RtlSizeHeap (HeapHandle=0x6b0000, Flags=0x0, MemoryPointer=0x6ba900) returned 0x62
	[0150.965] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0150.965] GetProcessHeap () returned 0x6b0000
	[0150.965] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xe0) returned 0x6ba970
	[0150.969] GetProcessHeap () returned 0x6b0000
	[0150.969] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6ba970, Size=0x76) returned 0x6ba970
	[0150.969] GetProcessHeap () returned 0x6b0000
	[0150.969] RtlSizeHeap (HeapHandle=0x6b0000, Flags=0x0, MemoryPointer=0x6ba970) returned 0x76
	[0150.969] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0150.970] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f\\im ocomm.exe ", fInfoLevelId=0x1, lpFindFileData=0x19f958, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f958) returned 0xffffffff
	[0150.970] GetLastError () returned 0x3
	[0150.970] GetProcessHeap () returned 0x6b0000
	[0150.970] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6bfc58) returned 1
	[0150.970] GetProcessHeap () returned 0x6b0000
	[0150.971] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c3c68) returned 1
	[0150.971] GetProcessHeap () returned 0x6b0000
	[0150.971] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6bbc40) returned 1
	[0150.971] GetConsoleOutputCP () returned 0x1b5
	[0150.973] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0150.973] GetUserDefaultLCID () returned 0x409
	[0150.974] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x13d34a0, cchData=8 | out: lpLCData=":") returned 2
	[0150.974] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0150.974] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0150.974] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2
	[0150.974] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x13d34b0, cchData=8 | out: lpLCData="/") returned 2
	[0150.974] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x13d3500, cchData=32 | out: lpLCData="Mon") returned 4
	[0150.974] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x13d3540, cchData=32 | out: lpLCData="Tue") returned 4
	[0150.974] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x13d3580, cchData=32 | out: lpLCData="Wed") returned 4
	[0150.974] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x13d35c0, cchData=32 | out: lpLCData="Thu") returned 4
	[0150.974] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x13d3600, cchData=32 | out: lpLCData="Fri") returned 4
	[0150.974] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x13d3640, cchData=32 | out: lpLCData="Sat") returned 4
	[0150.974] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x13d3680, cchData=32 | out: lpLCData="Sun") returned 4
	[0150.974] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x13d34c0, cchData=8 | out: lpLCData=".") returned 2
	[0150.974] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x13d34e0, cchData=8 | out: lpLCData=",") returned 2
	[0150.974] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0150.976] GetProcessHeap () returned 0x6b0000
	[0150.976] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x20c) returned 0x6baa38
	[0150.976] GetConsoleTitleW (in: lpConsoleTitle=0x6baa38, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0150.977] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0150.978] GetProcAddress (hModule=0x75600000, lpProcName="CopyFileExW") returned 0x7561ffc0
	[0150.978] GetProcAddress (hModule=0x75600000, lpProcName="IsDebuggerPresent") returned 0x7561b0b0
	[0150.978] GetProcAddress (hModule=0x75600000, lpProcName="SetConsoleInputExeNameW") returned 0x7559b440
	[0150.978] GetProcessHeap () returned 0x6b0000
	[0150.978] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x400a) returned 0x6bbc40
	[0150.978] GetProcessHeap () returned 0x6b0000
	[0150.978] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6bbc40) returned 1
	[0150.979] _wcsicmp (_String1="taskkill", _String2=")") returned 75
	[0150.979] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14
	[0150.979] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14
	[0150.979] _wcsicmp (_String1="IF", _String2="taskkill") returned -11
	[0150.979] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11
	[0150.979] _wcsicmp (_String1="REM", _String2="taskkill") returned -2
	[0150.980] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2
	[0150.980] GetProcessHeap () returned 0x6b0000
	[0150.980] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x58) returned 0x6bac50
	[0150.980] GetProcessHeap () returned 0x6b0000
	[0150.980] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6b0578
	[0150.980] GetProcessHeap () returned 0x6b0000
	[0150.980] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2e) returned 0x6bacb0
	[0150.981] GetConsoleTitleW (in: lpConsoleTitle=0x19fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0150.983] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0150.983] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0150.983] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0150.983] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0150.983] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0150.983] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0150.983] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0150.983] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0150.983] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0150.983] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0150.983] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0150.983] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0150.983] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0150.983] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0150.983] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0150.983] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0150.983] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0150.983] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0150.983] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0150.983] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0150.983] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0150.983] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0150.983] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0150.983] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0150.985] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0150.985] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0150.985] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0150.985] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0150.985] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0150.985] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0150.985] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0150.985] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0150.985] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0150.985] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0150.985] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0150.985] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0150.986] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0150.986] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0150.986] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0150.986] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0150.986] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0150.986] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0150.986] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0150.986] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0150.986] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0150.986] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0150.986] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0150.986] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0150.986] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0150.986] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0150.986] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0150.986] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0150.986] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0150.986] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0150.986] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0150.986] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0150.986] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0150.986] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0150.986] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0150.986] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0150.986] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0150.986] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0150.986] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0150.986] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0150.986] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0150.986] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0150.987] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0150.987] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0150.987] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0150.987] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0150.987] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0150.987] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0150.987] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0150.987] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0150.987] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0150.987] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0150.987] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0150.987] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0150.987] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0150.987] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0150.987] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0150.987] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0150.987] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0150.987] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0150.987] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14
	[0150.987] _wcsicmp (_String1="taskkill", _String2="IF") returned 11
	[0150.987] _wcsicmp (_String1="taskkill", _String2="REM") returned 2
	[0150.988] GetProcessHeap () returned 0x6b0000
	[0150.988] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x210) returned 0x6bace8
	[0150.988] GetProcessHeap () returned 0x6b0000
	[0150.988] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x40) returned 0x6baf00
	[0150.988] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0150.988] GetProcessHeap () returned 0x6b0000
	[0150.988] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x418) returned 0x6b05c8
	[0150.988] SetErrorMode (uMode=0x0) returned 0x8003
	[0150.988] SetErrorMode (uMode=0x1) returned 0x0
	[0150.988] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x6b05d0, lpFilePart=0x19f57c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19f57c*="Desktop") returned 0x1d
	[0150.988] SetErrorMode (uMode=0x8003) returned 0x1
	[0150.988] GetProcessHeap () returned 0x6b0000
	[0150.988] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6b05c8, Size=0x56) returned 0x6b05c8
	[0150.988] GetProcessHeap () returned 0x6b0000
	[0150.988] RtlSizeHeap (HeapHandle=0x6b0000, Flags=0x0, MemoryPointer=0x6b05c8) returned 0x56
	[0150.988] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0150.989] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0150.989] GetProcessHeap () returned 0x6b0000
	[0150.989] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x110) returned 0x6baf48
	[0150.989] GetProcessHeap () returned 0x6b0000
	[0150.989] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x218) returned 0x6b0628
	[0150.993] GetProcessHeap () returned 0x6b0000
	[0150.993] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6b0628, Size=0x112) returned 0x6b0628
	[0150.993] GetProcessHeap () returned 0x6b0000
	[0150.993] RtlSizeHeap (HeapHandle=0x6b0000, Flags=0x0, MemoryPointer=0x6b0628) returned 0x112
	[0150.993] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0150.993] GetProcessHeap () returned 0x6b0000
	[0150.993] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xe0) returned 0x6bb060
	[0150.995] GetProcessHeap () returned 0x6b0000
	[0150.995] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6bb060, Size=0x76) returned 0x6bb060
	[0150.995] GetProcessHeap () returned 0x6b0000
	[0150.995] RtlSizeHeap (HeapHandle=0x6b0000, Flags=0x0, MemoryPointer=0x6bb060) returned 0x76
	[0150.995] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0150.995] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0150.996] GetLastError () returned 0x2
	[0150.996] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0150.996] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x6bb0e0
	[0150.996] GetProcessHeap () returned 0x6b0000
	[0150.996] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x14) returned 0x6b7678
	[0150.996] FindClose (in: hFindFile=0x6bb0e0 | out: hFindFile=0x6bb0e0) returned 1
	[0150.996] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0150.996] GetLastError () returned 0x2
	[0150.997] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x6bb0e0
	[0150.997] GetProcessHeap () returned 0x6b0000
	[0150.997] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6b7678, Size=0x4) returned 0x6bb120
	[0150.997] FindClose (in: hFindFile=0x6bb0e0 | out: hFindFile=0x6bb0e0) returned 1
	[0150.997] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0150.997] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0150.997] GetConsoleTitleW (in: lpConsoleTitle=0x19f7fc, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0150.999] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f728, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f70c | out: lpAttributeList=0x19f728, lpSize=0x19f70c) returned 1
	[0150.999] UpdateProcThreadAttribute (in: lpAttributeList=0x19f728, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f714, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f728, lpPreviousValue=0x0) returned 1
	[0150.999] GetStartupInfoW (in: lpStartupInfo=0x19f760 | out: lpStartupInfo=0x19f760*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x13c, hStdOutput=0x140, hStdError=0x144)) 
	[0150.999] GetProcessHeap () returned 0x6b0000
	[0150.999] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6b7678
	[0150.999] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0150.999] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0150.999] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0150.999] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0150.999] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0150.999] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0150.999] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0150.999] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0150.999] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0150.999] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0150.999] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0150.999] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0150.999] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0150.999] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0150.999] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0150.999] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0150.999] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0150.999] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0150.999] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0151.000] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0151.000] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0151.000] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0151.000] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0151.000] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0151.000] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0151.000] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0151.000] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0151.000] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0151.000] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0151.000] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0151.000] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0151.000] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0151.000] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0151.000] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0151.000] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0151.000] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0151.000] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0151.000] GetProcessHeap () returned 0x6b0000
	[0151.000] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6b7678) returned 1
	[0151.000] GetProcessHeap () returned 0x6b0000
	[0151.000] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xa) returned 0x6bb0e0
	[0151.000] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1
	[0151.003] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill  /f /im ocomm.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x19f6b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill  /f /im ocomm.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f6fc | out: lpCommandLine="taskkill  /f /im ocomm.exe ", lpProcessInformation=0x19f6fc*(hProcess=0x9c, hThread=0x98, dwProcessId=0x17c, dwThreadId=0x1348)) returned 1
	[0151.022] CloseHandle (hObject=0x98) returned 1
	[0151.022] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0151.022] GetProcessHeap () returned 0x6b0000
	[0151.022] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6b9d40) returned 1
	[0151.022] GetEnvironmentStringsW () returned 0x6b9d40*
	[0151.023] GetProcessHeap () returned 0x6b0000
	[0151.023] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xa76) returned 0x6bbc40
	[0151.023] FreeEnvironmentStringsA (penv="=") returned 1
	[0151.023] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0
	[0152.419] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x19f694 | out: lpExitCode=0x19f694*=0x80) returned 1
	[0152.420] CloseHandle (hObject=0x9c) returned 1
	[0152.420] _vsnwprintf (in: _Buffer=0x19f77c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f69c | out: _Buffer="00000080") returned 8
	[0152.420] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1
	[0152.420] GetProcessHeap () returned 0x6b0000
	[0152.421] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6bbc40) returned 1
	[0152.421] GetEnvironmentStringsW () returned 0x6bb130*
	[0152.422] GetProcessHeap () returned 0x6b0000
	[0152.422] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xa9c) returned 0x6bbbd8
	[0152.422] FreeEnvironmentStringsA (penv="=") returned 1
	[0152.422] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0152.422] GetProcessHeap () returned 0x6b0000
	[0152.422] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6bbbd8) returned 1
	[0152.422] GetEnvironmentStringsW () returned 0x6bb130*
	[0152.422] GetProcessHeap () returned 0x6b0000
	[0152.422] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xa9c) returned 0x6bbbd8
	[0152.422] FreeEnvironmentStringsA (penv="=") returned 1
	[0152.422] GetProcessHeap () returned 0x6b0000
	[0152.422] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6bb0e0) returned 1
	[0152.422] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f728 | out: lpAttributeList=0x19f728) 
	[0152.422] _get_osfhandle (_FileHandle=1) returned 0x140
	[0152.422] SetConsoleMode (hConsoleHandle=0x140, dwMode=0x0) returned 0
	[0152.422] _get_osfhandle (_FileHandle=1) returned 0x140
	[0152.422] GetConsoleMode (in: hConsoleHandle=0x140, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0152.422] _get_osfhandle (_FileHandle=0) returned 0x13c
	[0152.423] GetConsoleMode (in: hConsoleHandle=0x13c, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0152.423] GetConsoleOutputCP () returned 0x1b5
	[0152.424] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0152.424] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0152.425] exit (_Code=128) 

Thread:
	id = 249
	os_tid = 0xf74


Process:
	id = "42"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\syswow64\\taskkill.exe"
	page_root = "0x56361000"
	os_pid = "0x17c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "41"
	os_parent_pid = "0xec"
	cmd_line = "taskkill  /f /im ocomm.exe "
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 3232
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 3233
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 3234
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 3235
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 3236
	        start_va = 0xa0000
	          end_va = 0xdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 3237
	        start_va = 0xe0000
	          end_va = 0xe3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 3238
	        start_va = 0xf0000
	          end_va = 0xf0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 3239
	        start_va = 0x100000
	          end_va = 0x101fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 3240
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 3241
	        start_va = 0x13b0000
	          end_va = 0x13c5fff
	       monitored = 0
	     entry_point = 0x13bde80
	     region_type = mapped_file
	            name = "taskkill.exe"
	        filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe")

Region:
	              id = 3242
	        start_va = 0x13d0000
	          end_va = 0x53cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000013d0000"
	        filename = ""

Region:
	              id = 3243
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 3244
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 3245
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 3246
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 3247
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 3248
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 3249
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 3250
	        start_va = 0x140000
	          end_va = 0x14ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000140000"
	        filename = ""

Region:
	              id = 3251
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 3252
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 3253
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 3254
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 3255
	        start_va = 0x400000
	          end_va = 0x68ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 3256
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 3257
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 3258
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 3259
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 3260
	        start_va = 0x400000
	          end_va = 0x4bdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 3261
	        start_va = 0x590000
	          end_va = 0x68ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000590000"
	        filename = ""

Region:
	              id = 3262
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 3263
	        start_va = 0x74650000
	          end_va = 0x746cafff
	       monitored = 0
	     entry_point = 0x7466e970
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 3264
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 3265
	        start_va = 0x150000
	          end_va = 0x18ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000150000"
	        filename = ""

Region:
	              id = 3266
	        start_va = 0x190000
	          end_va = 0x1cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000190000"
	        filename = ""

Region:
	              id = 3267
	        start_va = 0x76ae0000
	          end_va = 0x76b23fff
	       monitored = 0
	     entry_point = 0x76af9d80
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 3268
	        start_va = 0x75260000
	          end_va = 0x7530cfff
	       monitored = 0
	     entry_point = 0x75274f00
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 3269
	        start_va = 0x74450000
	          end_va = 0x7446dfff
	       monitored = 0
	     entry_point = 0x7445b640
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 3270
	        start_va = 0x74440000
	          end_va = 0x74449fff
	       monitored = 0
	     entry_point = 0x74442a00
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 3271
	        start_va = 0x74590000
	          end_va = 0x745e7fff
	       monitored = 0
	     entry_point = 0x745d25c0
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 3272
	        start_va = 0x77450000
	          end_va = 0x77596fff
	       monitored = 0
	     entry_point = 0x77461cf0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 3273
	        start_va = 0x76b30000
	          end_va = 0x76c7efff
	       monitored = 0
	     entry_point = 0x76be6820
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 3274
	        start_va = 0x753c0000
	          end_va = 0x75451fff
	       monitored = 0
	     entry_point = 0x753f8cf0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 3275
	        start_va = 0x77290000
	          end_va = 0x7744cfff
	       monitored = 0
	     entry_point = 0x77372a10
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")

Region:
	              id = 3276
	        start_va = 0x75310000
	          end_va = 0x7536efff
	       monitored = 0
	     entry_point = 0x75314af0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 3277
	        start_va = 0x77240000
	          end_va = 0x77284fff
	       monitored = 0
	     entry_point = 0x7725de90
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 3278
	        start_va = 0x6cc90000
	          end_va = 0x6cc97fff
	       monitored = 0
	     entry_point = 0x6cc917b0
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 3279
	        start_va = 0x6cc70000
	          end_va = 0x6cc85fff
	       monitored = 0
	     entry_point = 0x6cc721d0
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")

Region:
	              id = 3280
	        start_va = 0x6cc30000
	          end_va = 0x6cc6efff
	       monitored = 0
	     entry_point = 0x6cc446c0
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll")

Region:
	              id = 3281
	        start_va = 0x6caf0000
	          end_va = 0x6cc2efff
	       monitored = 0
	     entry_point = 0x6cb1d880
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll")

Region:
	              id = 3282
	        start_va = 0x6cad0000
	          end_va = 0x6caebfff
	       monitored = 0
	     entry_point = 0x6cad4720
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")

Region:
	              id = 3283
	        start_va = 0x6cac0000
	          end_va = 0x6cac9fff
	       monitored = 0
	     entry_point = 0x6cac28d0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")

Region:
	              id = 3284
	        start_va = 0x4c0000
	          end_va = 0x55ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004c0000"
	        filename = ""

Region:
	              id = 3285
	        start_va = 0x110000
	          end_va = 0x139fff
	       monitored = 0
	     entry_point = 0x115680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 3286
	        start_va = 0x690000
	          end_va = 0x817fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000690000"
	        filename = ""

Region:
	              id = 3287
	        start_va = 0x74ea0000
	          end_va = 0x74ecafff
	       monitored = 0
	     entry_point = 0x74ea5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 3288
	        start_va = 0x820000
	          end_va = 0x9a0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000820000"
	        filename = ""

Region:
	              id = 3289
	        start_va = 0x53d0000
	          end_va = 0x67cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000053d0000"
	        filename = ""

Region:
	              id = 3290
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 3291
	        start_va = 0x110000
	          end_va = 0x110fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000110000"
	        filename = ""

Region:
	              id = 3292
	        start_va = 0x120000
	          end_va = 0x124fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taskkill.exe.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui")

Region:
	              id = 3293
	        start_va = 0x130000
	          end_va = 0x130fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000130000"
	        filename = ""

Region:
	              id = 3294
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001d0000"
	        filename = ""

Region:
	              id = 3295
	        start_va = 0x9b0000
	          end_va = 0xce6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 3296
	        start_va = 0xcf0000
	          end_va = 0xdd9fff
	       monitored = 0
	     entry_point = 0xd2d650
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 3297
	        start_va = 0x1e0000
	          end_va = 0x1e3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001e0000"
	        filename = ""

Region:
	              id = 3298
	        start_va = 0xcf0000
	          end_va = 0xdcffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 3299
	        start_va = 0x76e20000
	          end_va = 0x76e2bfff
	       monitored = 0
	     entry_point = 0x76e23930
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")

Region:
	              id = 3300
	        start_va = 0x1f0000
	          end_va = 0x1f0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001f0000"
	        filename = ""

Region:
	              id = 3301
	        start_va = 0x76c80000
	          end_va = 0x76d03fff
	       monitored = 0
	     entry_point = 0x76ca6220
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 3302
	        start_va = 0x4c0000
	          end_va = 0x4c0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004c0000"
	        filename = ""

Region:
	              id = 3303
	        start_va = 0x550000
	          end_va = 0x55ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000550000"
	        filename = ""

Region:
	              id = 3304
	        start_va = 0x6cab0000
	          end_va = 0x6cabcfff
	       monitored = 0
	     entry_point = 0x6cab3520
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 3305
	        start_va = 0x6ca40000
	          end_va = 0x6caa6fff
	       monitored = 0
	     entry_point = 0x6ca5b610
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 3306
	        start_va = 0x740f0000
	          end_va = 0x7410afff
	       monitored = 0
	     entry_point = 0x740f9050
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 3307
	        start_va = 0x6c9f0000
	          end_va = 0x6ca33fff
	       monitored = 0
	     entry_point = 0x6ca0aaf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")

Region:
	              id = 3308
	        start_va = 0x4d0000
	          end_va = 0x50ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004d0000"
	        filename = ""

Region:
	              id = 3309
	        start_va = 0x510000
	          end_va = 0x54ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000510000"
	        filename = ""

Region:
	              id = 3310
	        start_va = 0xdd0000
	          end_va = 0xe0ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000dd0000"
	        filename = ""

Region:
	              id = 3311
	        start_va = 0xe10000
	          end_va = 0xe4ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e10000"
	        filename = ""

Region:
	              id = 3312
	        start_va = 0xe50000
	          end_va = 0xe8ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e50000"
	        filename = ""

Region:
	              id = 3313
	        start_va = 0xe90000
	          end_va = 0xecffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e90000"
	        filename = ""

Region:
	              id = 3314
	        start_va = 0x6c9d0000
	          end_va = 0x6c9e0fff
	       monitored = 0
	     entry_point = 0x6c9d8fa0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 3315
	        start_va = 0x6c910000
	          end_va = 0x6c9cefff
	       monitored = 0
	     entry_point = 0x6c941e80
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 3317
	        start_va = 0x560000
	          end_va = 0x565fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000560000"
	        filename = ""


Thread:
	id = 250
	os_tid = 0x1348


Thread:
	id = 251
	os_tid = 0x634


Thread:
	id = 252
	os_tid = 0x134c


Thread:
	id = 253
	os_tid = 0x139c


Thread:
	id = 254
	os_tid = 0x85c


Process:
	id = "43"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x33188000"
	os_pid = "0x120c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x614"
	cmd_line = "cmd.exe /c \"taskkill /f /im mysqld.exe \""
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 3320
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 3321
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 3322
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 3323
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 3324
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 3325
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 3326
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 3327
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 3328
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 3329
	        start_va = 0x13a0000
	          end_va = 0x13f1fff
	       monitored = 1
	     entry_point = 0x13b4fd0
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")

Region:
	              id = 3330
	        start_va = 0x1400000
	          end_va = 0x53fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001400000"
	        filename = ""

Region:
	              id = 3331
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 3332
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 3333
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 3334
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 3335
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 3336
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 3337
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 3338
	        start_va = 0x450000
	          end_va = 0x45ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000450000"
	        filename = ""

Region:
	              id = 3339
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 3340
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 3341
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 3342
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 3343
	        start_va = 0x460000
	          end_va = 0x5effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000460000"
	        filename = ""

Region:
	              id = 3344
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 3345
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 3346
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 3347
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 3348
	        start_va = 0x5f0000
	          end_va = 0x6adfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 3349
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 3350
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 3351
	        start_va = 0x6b0000
	          end_va = 0x7affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006b0000"
	        filename = ""

Region:
	              id = 3352
	        start_va = 0x7b0000
	          end_va = 0x92ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000007b0000"
	        filename = ""

Region:
	              id = 3353
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 3354
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 3355
	        start_va = 0x930000
	          end_va = 0xc66fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 255
	os_tid = 0x1274

	[0152.653] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000
	[0152.653] __set_app_type (_Type=0x1) 
	[0152.653] __p__fmode () returned 0x74974d6c
	[0152.653] __p__commode () returned 0x74975b1c
	[0152.653] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13b5200) returned 0x0
	[0152.653] __getmainargs (in: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0, _DoWildCard=0, _StartInfo=0x13c60fc | out: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0) returned 0
	[0152.654] GetCurrentThreadId () returned 0x1274
	[0152.654] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x1274) returned 0x78
	[0152.654] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0152.654] GetProcAddress (hModule=0x75600000, lpProcName="SetThreadUILanguage") returned 0x75642510
	[0152.654] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0152.739] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0152.739] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2
	[0152.740] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0152.740] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0152.740] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0152.740] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0152.740] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0152.740] GetConsoleOutputCP () returned 0x1b5
	[0152.743] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0152.744] SetConsoleCtrlHandler (HandlerRoutine=0x13c0e40, Add=1) returned 1
	[0152.744] _get_osfhandle (_FileHandle=1) returned 0x13c
	[0152.744] SetConsoleMode (hConsoleHandle=0x13c, dwMode=0x0) returned 0
	[0152.744] _get_osfhandle (_FileHandle=1) returned 0x13c
	[0152.744] GetConsoleMode (in: hConsoleHandle=0x13c, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0152.744] _get_osfhandle (_FileHandle=0) returned 0x130
	[0152.744] GetConsoleMode (in: hConsoleHandle=0x130, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0152.744] GetEnvironmentStringsW () returned 0x4f7cc0*
	[0152.744] GetProcessHeap () returned 0x4f0000
	[0152.744] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xa1a) returned 0x4f86e8
	[0152.744] FreeEnvironmentStringsA (penv="A") returned 1
	[0152.744] GetProcessHeap () returned 0x4f0000
	[0152.744] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x4) returned 0x4f0550
	[0152.744] GetEnvironmentStringsW () returned 0x4f7cc0*
	[0152.745] GetProcessHeap () returned 0x4f0000
	[0152.745] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xa1a) returned 0x4f9110
	[0152.745] FreeEnvironmentStringsA (penv="A") returned 1
	[0152.745] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0152.745] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0152.745] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0152.745] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0152.745] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0152.745] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0152.745] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0152.745] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0152.745] RegCloseKey (hKey=0x88) returned 0x0
	[0152.745] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0152.745] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0152.745] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0152.745] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0152.745] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0152.746] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0152.746] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0152.746] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0152.746] RegCloseKey (hKey=0x88) returned 0x0
	[0152.746] time (in: timer=0x0 | out: timer=0x0) returned 0x62344222
	[0152.746] srand (_Seed=0x62344222) 
	[0152.746] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im mysqld.exe \""
	[0152.746] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im mysqld.exe \""
	[0152.746] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0152.746] GetProcessHeap () returned 0x4f0000
	[0152.746] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x210) returned 0x4f9b38
	[0152.746] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4f9b40, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0152.747] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0152.747] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0152.747] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0152.747] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0152.747] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0152.747] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0152.747] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0152.747] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0152.747] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0152.747] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0152.747] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0152.747] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0152.747] GetProcessHeap () returned 0x4f0000
	[0152.748] RtlFreeHeap (HeapHandle=0x4f0000, Flags=0x0, BaseAddress=0x4f86e8) returned 1
	[0152.748] GetEnvironmentStringsW () returned 0x4f7cc0*
	[0152.748] GetProcessHeap () returned 0x4f0000
	[0152.748] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xa32) returned 0x4fa790
	[0152.749] FreeEnvironmentStringsA (penv="A") returned 1
	[0152.749] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b
	[0152.749] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0152.749] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0152.749] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0152.749] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0152.749] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0152.749] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0152.749] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0152.749] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0152.749] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0152.749] GetProcessHeap () returned 0x4f0000
	[0152.749] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x44) returned 0x4f05c8
	[0152.749] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0152.749] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19fc4c*="Desktop") returned 0x1d
	[0152.749] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0152.750] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x4f0618
	[0152.750] FindClose (in: hFindFile=0x4f0618 | out: hFindFile=0x4f0618) returned 1
	[0152.750] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x4f0618
	[0152.750] FindClose (in: hFindFile=0x4f0618 | out: hFindFile=0x4f0618) returned 1
	[0152.750] _wcsnicmp (_String1="RDHJ0C~1", _String2="RDhJ0CNFevzX", _MaxCount=0xc) returned 16
	[0152.750] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x4f0618
	[0152.751] FindClose (in: hFindFile=0x4f0618 | out: hFindFile=0x4f0618) returned 1
	[0152.751] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0152.751] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1
	[0152.751] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 1
	[0152.751] GetProcessHeap () returned 0x4f0000
	[0152.751] RtlFreeHeap (HeapHandle=0x4f0000, Flags=0x0, BaseAddress=0x4fa790) returned 1
	[0152.751] GetEnvironmentStringsW () returned 0x4f7cc0*
	[0152.751] GetProcessHeap () returned 0x4f0000
	[0152.751] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xa76) returned 0x4f9d50
	[0152.752] FreeEnvironmentStringsA (penv="=") returned 1
	[0152.752] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0152.752] GetProcessHeap () returned 0x4f0000
	[0152.752] RtlFreeHeap (HeapHandle=0x4f0000, Flags=0x0, BaseAddress=0x4f05c8) returned 1
	[0152.752] GetProcessHeap () returned 0x4f0000
	[0152.752] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x400e) returned 0x4fbc50
	[0152.753] GetProcessHeap () returned 0x4f0000
	[0152.753] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x48) returned 0x4fa7d0
	[0152.753] GetProcessHeap () returned 0x4f0000
	[0152.753] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x4008) returned 0x4ffc68
	[0152.753] GetProcessHeap () returned 0x4f0000
	[0152.753] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x4008) returned 0x503c78
	[0152.754] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0152.755] GetProcessHeap () returned 0x4f0000
	[0152.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x418) returned 0x4fa820
	[0152.755] SetErrorMode (uMode=0x0) returned 0x8003
	[0152.755] SetErrorMode (uMode=0x1) returned 0x0
	[0152.755] GetFullPathNameW (in: lpFileName="taskkill \\f \\.", nBufferLength=0x208, lpBuffer=0x4fa828, lpFilePart=0x19fbac | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f", lpFilePart=0x19fbac*="f") returned 0x29
	[0152.755] SetErrorMode (uMode=0x8003) returned 0x1
	[0152.755] GetProcessHeap () returned 0x4f0000
	[0152.755] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x4fa820, Size=0x7a) returned 0x4fa820
	[0152.755] GetProcessHeap () returned 0x4f0000
	[0152.755] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x4fa820) returned 0x7a
	[0152.755] NeedCurrentDirectoryForExePathW (ExeName="taskkill \\f \\.") returned 1
	[0152.756] GetProcessHeap () returned 0x4f0000
	[0152.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x62) returned 0x4fa8a8
	[0152.756] GetProcessHeap () returned 0x4f0000
	[0152.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xb8) returned 0x4fa918
	[0152.756] GetProcessHeap () returned 0x4f0000
	[0152.756] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x4fa918, Size=0x62) returned 0x4fa918
	[0152.756] GetProcessHeap () returned 0x4f0000
	[0152.756] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x4fa918) returned 0x62
	[0152.756] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0152.756] GetProcessHeap () returned 0x4f0000
	[0152.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xe0) returned 0x4fa988
	[0152.761] GetProcessHeap () returned 0x4f0000
	[0152.761] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x4fa988, Size=0x76) returned 0x4fa988
	[0152.761] GetProcessHeap () returned 0x4f0000
	[0152.761] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x4fa988) returned 0x76
	[0152.761] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0152.761] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f\\im mysqld.exe ", fInfoLevelId=0x1, lpFindFileData=0x19f958, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f958) returned 0xffffffff
	[0152.762] GetLastError () returned 0x3
	[0152.762] GetProcessHeap () returned 0x4f0000
	[0152.762] RtlFreeHeap (HeapHandle=0x4f0000, Flags=0x0, BaseAddress=0x4ffc68) returned 1
	[0152.762] GetProcessHeap () returned 0x4f0000
	[0152.762] RtlFreeHeap (HeapHandle=0x4f0000, Flags=0x0, BaseAddress=0x503c78) returned 1
	[0152.762] GetProcessHeap () returned 0x4f0000
	[0152.763] RtlFreeHeap (HeapHandle=0x4f0000, Flags=0x0, BaseAddress=0x4fbc50) returned 1
	[0152.763] GetConsoleOutputCP () returned 0x1b5
	[0152.765] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0152.765] GetUserDefaultLCID () returned 0x409
	[0152.766] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x13d34a0, cchData=8 | out: lpLCData=":") returned 2
	[0152.766] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0152.766] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0152.766] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2
	[0152.766] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x13d34b0, cchData=8 | out: lpLCData="/") returned 2
	[0152.766] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x13d3500, cchData=32 | out: lpLCData="Mon") returned 4
	[0152.766] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x13d3540, cchData=32 | out: lpLCData="Tue") returned 4
	[0152.766] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x13d3580, cchData=32 | out: lpLCData="Wed") returned 4
	[0152.766] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x13d35c0, cchData=32 | out: lpLCData="Thu") returned 4
	[0152.766] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x13d3600, cchData=32 | out: lpLCData="Fri") returned 4
	[0152.766] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x13d3640, cchData=32 | out: lpLCData="Sat") returned 4
	[0152.766] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x13d3680, cchData=32 | out: lpLCData="Sun") returned 4
	[0152.766] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x13d34c0, cchData=8 | out: lpLCData=".") returned 2
	[0152.766] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x13d34e0, cchData=8 | out: lpLCData=",") returned 2
	[0152.766] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0152.768] GetProcessHeap () returned 0x4f0000
	[0152.768] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x20c) returned 0x4faa50
	[0152.768] GetConsoleTitleW (in: lpConsoleTitle=0x4faa50, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0153.071] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0153.071] GetProcAddress (hModule=0x75600000, lpProcName="CopyFileExW") returned 0x7561ffc0
	[0153.071] GetProcAddress (hModule=0x75600000, lpProcName="IsDebuggerPresent") returned 0x7561b0b0
	[0153.071] GetProcAddress (hModule=0x75600000, lpProcName="SetConsoleInputExeNameW") returned 0x7559b440
	[0153.074] GetProcessHeap () returned 0x4f0000
	[0153.074] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x400a) returned 0x4fbc50
	[0153.074] GetProcessHeap () returned 0x4f0000
	[0153.074] RtlFreeHeap (HeapHandle=0x4f0000, Flags=0x0, BaseAddress=0x4fbc50) returned 1
	[0153.075] _wcsicmp (_String1="taskkill", _String2=")") returned 75
	[0153.075] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14
	[0153.075] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14
	[0153.075] _wcsicmp (_String1="IF", _String2="taskkill") returned -11
	[0153.075] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11
	[0153.075] _wcsicmp (_String1="REM", _String2="taskkill") returned -2
	[0153.075] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2
	[0153.075] GetProcessHeap () returned 0x4f0000
	[0153.075] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x58) returned 0x4fac68
	[0153.075] GetProcessHeap () returned 0x4f0000
	[0153.076] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x1a) returned 0x4f0578
	[0153.076] GetProcessHeap () returned 0x4f0000
	[0153.076] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x30) returned 0x4facc8
	[0153.077] GetConsoleTitleW (in: lpConsoleTitle=0x19fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0153.094] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0153.094] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0153.094] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0153.094] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0153.094] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0153.094] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0153.094] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0153.094] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0153.094] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0153.094] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0153.094] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0153.094] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0153.094] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0153.094] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0153.094] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0153.094] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0153.094] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0153.094] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0153.094] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0153.094] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0153.094] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0153.094] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0153.094] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0153.095] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0153.095] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0153.095] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0153.095] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0153.095] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0153.095] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0153.095] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0153.095] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0153.095] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0153.095] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0153.095] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0153.095] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0153.095] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0153.095] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0153.095] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0153.095] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0153.095] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0153.095] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0153.095] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0153.095] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0153.095] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0153.095] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0153.095] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0153.095] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0153.095] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0153.096] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0153.096] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0153.096] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0153.096] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0153.096] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0153.096] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0153.096] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0153.096] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0153.096] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0153.096] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0153.096] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0153.096] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0153.096] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0153.096] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0153.096] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0153.096] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0153.096] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0153.096] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0153.096] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0153.096] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0153.096] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0153.096] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0153.096] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0153.096] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0153.096] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0153.096] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0153.096] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0153.096] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0153.096] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0153.096] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0153.096] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0153.096] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0153.096] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0153.096] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0153.097] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0153.097] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0153.097] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14
	[0153.097] _wcsicmp (_String1="taskkill", _String2="IF") returned 11
	[0153.097] _wcsicmp (_String1="taskkill", _String2="REM") returned 2
	[0153.097] GetProcessHeap () returned 0x4f0000
	[0153.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x210) returned 0x4fad00
	[0153.097] GetProcessHeap () returned 0x4f0000
	[0153.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x42) returned 0x4faf18
	[0153.097] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0153.098] GetProcessHeap () returned 0x4f0000
	[0153.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x418) returned 0x4f05c8
	[0153.098] SetErrorMode (uMode=0x0) returned 0x8003
	[0153.099] SetErrorMode (uMode=0x1) returned 0x0
	[0153.099] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4f05d0, lpFilePart=0x19f57c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19f57c*="Desktop") returned 0x1d
	[0153.099] SetErrorMode (uMode=0x8003) returned 0x1
	[0153.099] GetProcessHeap () returned 0x4f0000
	[0153.100] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x4f05c8, Size=0x56) returned 0x4f05c8
	[0153.100] GetProcessHeap () returned 0x4f0000
	[0153.100] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x4f05c8) returned 0x56
	[0153.101] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0153.101] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0153.101] GetProcessHeap () returned 0x4f0000
	[0153.101] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x110) returned 0x4faf68
	[0153.101] GetProcessHeap () returned 0x4f0000
	[0153.101] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x218) returned 0x4f0628
	[0153.107] GetProcessHeap () returned 0x4f0000
	[0153.107] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x4f0628, Size=0x112) returned 0x4f0628
	[0153.107] GetProcessHeap () returned 0x4f0000
	[0153.107] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x4f0628) returned 0x112
	[0153.107] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0153.107] GetProcessHeap () returned 0x4f0000
	[0153.107] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xe0) returned 0x4fb080
	[0153.109] GetProcessHeap () returned 0x4f0000
	[0153.109] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x4fb080, Size=0x76) returned 0x4fb080
	[0153.109] GetProcessHeap () returned 0x4f0000
	[0153.109] RtlSizeHeap (HeapHandle=0x4f0000, Flags=0x0, MemoryPointer=0x4fb080) returned 0x76
	[0153.109] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0153.109] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0153.109] GetLastError () returned 0x2
	[0153.109] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0153.109] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x4fb100
	[0153.110] GetProcessHeap () returned 0x4f0000
	[0153.110] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x4f7568
	[0153.110] FindClose (in: hFindFile=0x4fb100 | out: hFindFile=0x4fb100) returned 1
	[0153.110] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0153.110] GetLastError () returned 0x2
	[0153.110] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x4fb100
	[0153.110] GetProcessHeap () returned 0x4f0000
	[0153.110] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x4f7568, Size=0x4) returned 0x4fb140
	[0153.110] FindClose (in: hFindFile=0x4fb100 | out: hFindFile=0x4fb100) returned 1
	[0153.110] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0153.110] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0153.110] GetConsoleTitleW (in: lpConsoleTitle=0x19f7fc, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0153.148] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f728, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f70c | out: lpAttributeList=0x19f728, lpSize=0x19f70c) returned 1
	[0153.148] UpdateProcThreadAttribute (in: lpAttributeList=0x19f728, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f714, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f728, lpPreviousValue=0x0) returned 1
	[0153.148] GetStartupInfoW (in: lpStartupInfo=0x19f760 | out: lpStartupInfo=0x19f760*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x130, hStdOutput=0x13c, hStdError=0x140)) 
	[0153.148] GetProcessHeap () returned 0x4f0000
	[0153.148] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0x18) returned 0x4f76e8
	[0153.148] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0153.148] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0153.148] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0153.148] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0153.148] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0153.149] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0153.149] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0153.149] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0153.149] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0153.149] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0153.149] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0153.149] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0153.149] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0153.149] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0153.149] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0153.149] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0153.149] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0153.149] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0153.149] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0153.149] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0153.149] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0153.149] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0153.149] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0153.149] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0153.149] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0153.149] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0153.149] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0153.149] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0153.149] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0153.149] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0153.150] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0153.150] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0153.150] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0153.150] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0153.150] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0153.150] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0153.150] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0153.150] GetProcessHeap () returned 0x4f0000
	[0153.150] RtlFreeHeap (HeapHandle=0x4f0000, Flags=0x0, BaseAddress=0x4f76e8) returned 1
	[0153.150] GetProcessHeap () returned 0x4f0000
	[0153.150] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xa) returned 0x4fb100
	[0153.150] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1
	[0153.153] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill  /f /im mysqld.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x19f6b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill  /f /im mysqld.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f6fc | out: lpCommandLine="taskkill  /f /im mysqld.exe ", lpProcessInformation=0x19f6fc*(hProcess=0x9c, hThread=0x98, dwProcessId=0x1210, dwThreadId=0x234)) returned 1
	[0153.171] CloseHandle (hObject=0x98) returned 1
	[0153.171] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0153.171] GetProcessHeap () returned 0x4f0000
	[0153.172] RtlFreeHeap (HeapHandle=0x4f0000, Flags=0x0, BaseAddress=0x4f9d50) returned 1
	[0153.172] GetEnvironmentStringsW () returned 0x4f9d50*
	[0153.172] GetProcessHeap () returned 0x4f0000
	[0153.172] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xa76) returned 0x4fbc50
	[0153.172] FreeEnvironmentStringsA (penv="=") returned 1
	[0153.172] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0
	[0155.106] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x19f694 | out: lpExitCode=0x19f694*=0x80) returned 1
	[0155.107] CloseHandle (hObject=0x9c) returned 1
	[0155.107] _vsnwprintf (in: _Buffer=0x19f77c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f69c | out: _Buffer="00000080") returned 8
	[0155.108] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1
	[0155.108] GetProcessHeap () returned 0x4f0000
	[0155.109] RtlFreeHeap (HeapHandle=0x4f0000, Flags=0x0, BaseAddress=0x4fbc50) returned 1
	[0155.109] GetEnvironmentStringsW () returned 0x4fb150*
	[0155.109] GetProcessHeap () returned 0x4f0000
	[0155.109] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xa9c) returned 0x4fbbf8
	[0155.109] FreeEnvironmentStringsA (penv="=") returned 1
	[0155.109] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0155.109] GetProcessHeap () returned 0x4f0000
	[0155.109] RtlFreeHeap (HeapHandle=0x4f0000, Flags=0x0, BaseAddress=0x4fbbf8) returned 1
	[0155.109] GetEnvironmentStringsW () returned 0x4fb150*
	[0155.110] GetProcessHeap () returned 0x4f0000
	[0155.110] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x8, Size=0xa9c) returned 0x4fbbf8
	[0155.110] FreeEnvironmentStringsA (penv="=") returned 1
	[0155.110] GetProcessHeap () returned 0x4f0000
	[0155.110] RtlFreeHeap (HeapHandle=0x4f0000, Flags=0x0, BaseAddress=0x4fb100) returned 1
	[0155.110] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f728 | out: lpAttributeList=0x19f728) 
	[0155.110] _get_osfhandle (_FileHandle=1) returned 0x13c
	[0155.110] SetConsoleMode (hConsoleHandle=0x13c, dwMode=0x0) returned 0
	[0155.110] _get_osfhandle (_FileHandle=1) returned 0x13c
	[0155.110] GetConsoleMode (in: hConsoleHandle=0x13c, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0155.110] _get_osfhandle (_FileHandle=0) returned 0x130
	[0155.110] GetConsoleMode (in: hConsoleHandle=0x130, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0155.110] GetConsoleOutputCP () returned 0x1b5
	[0155.113] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0155.113] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0155.116] exit (_Code=128) 

Thread:
	id = 256
	os_tid = 0xdd8


Process:
	id = "44"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\syswow64\\taskkill.exe"
	page_root = "0x32e12000"
	os_pid = "0x1210"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "43"
	os_parent_pid = "0x120c"
	cmd_line = "taskkill  /f /im mysqld.exe "
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 3356
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 3357
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 3358
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 3359
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 3360
	        start_va = 0xa0000
	          end_va = 0xdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 3361
	        start_va = 0xe0000
	          end_va = 0xe3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 3362
	        start_va = 0xf0000
	          end_va = 0xf0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 3363
	        start_va = 0x100000
	          end_va = 0x101fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 3364
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 3365
	        start_va = 0x13b0000
	          end_va = 0x13c5fff
	       monitored = 0
	     entry_point = 0x13bde80
	     region_type = mapped_file
	            name = "taskkill.exe"
	        filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe")

Region:
	              id = 3366
	        start_va = 0x13d0000
	          end_va = 0x53cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000013d0000"
	        filename = ""

Region:
	              id = 3367
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 3368
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 3369
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 3370
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 3371
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 3372
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 3373
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 3374
	        start_va = 0x1a0000
	          end_va = 0x1affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001a0000"
	        filename = ""

Region:
	              id = 3375
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 3376
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 3377
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 3378
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 3379
	        start_va = 0x400000
	          end_va = 0x5dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 3380
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 3381
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 3382
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 3383
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 3384
	        start_va = 0x400000
	          end_va = 0x4bdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 3385
	        start_va = 0x4e0000
	          end_va = 0x5dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004e0000"
	        filename = ""

Region:
	              id = 3386
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 3387
	        start_va = 0x74650000
	          end_va = 0x746cafff
	       monitored = 0
	     entry_point = 0x7466e970
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 3388
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 3389
	        start_va = 0x110000
	          end_va = 0x14ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000110000"
	        filename = ""

Region:
	              id = 3390
	        start_va = 0x150000
	          end_va = 0x18ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000150000"
	        filename = ""

Region:
	              id = 3391
	        start_va = 0x76ae0000
	          end_va = 0x76b23fff
	       monitored = 0
	     entry_point = 0x76af9d80
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 3392
	        start_va = 0x75260000
	          end_va = 0x7530cfff
	       monitored = 0
	     entry_point = 0x75274f00
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 3393
	        start_va = 0x74450000
	          end_va = 0x7446dfff
	       monitored = 0
	     entry_point = 0x7445b640
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 3394
	        start_va = 0x74440000
	          end_va = 0x74449fff
	       monitored = 0
	     entry_point = 0x74442a00
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 3395
	        start_va = 0x74590000
	          end_va = 0x745e7fff
	       monitored = 0
	     entry_point = 0x745d25c0
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 3396
	        start_va = 0x77450000
	          end_va = 0x77596fff
	       monitored = 0
	     entry_point = 0x77461cf0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 3397
	        start_va = 0x76b30000
	          end_va = 0x76c7efff
	       monitored = 0
	     entry_point = 0x76be6820
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 3398
	        start_va = 0x753c0000
	          end_va = 0x75451fff
	       monitored = 0
	     entry_point = 0x753f8cf0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 3399
	        start_va = 0x77290000
	          end_va = 0x7744cfff
	       monitored = 0
	     entry_point = 0x77372a10
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")

Region:
	              id = 3400
	        start_va = 0x75310000
	          end_va = 0x7536efff
	       monitored = 0
	     entry_point = 0x75314af0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 3401
	        start_va = 0x77240000
	          end_va = 0x77284fff
	       monitored = 0
	     entry_point = 0x7725de90
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 3402
	        start_va = 0x6cc90000
	          end_va = 0x6cc97fff
	       monitored = 0
	     entry_point = 0x6cc917b0
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 3403
	        start_va = 0x6cc70000
	          end_va = 0x6cc85fff
	       monitored = 0
	     entry_point = 0x6cc721d0
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")

Region:
	              id = 3404
	        start_va = 0x6cc30000
	          end_va = 0x6cc6efff
	       monitored = 0
	     entry_point = 0x6cc446c0
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll")

Region:
	              id = 3405
	        start_va = 0x6caf0000
	          end_va = 0x6cc2efff
	       monitored = 0
	     entry_point = 0x6cb1d880
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll")

Region:
	              id = 3407
	        start_va = 0x1b0000
	          end_va = 0x1effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001b0000"
	        filename = ""

Region:
	              id = 3408
	        start_va = 0x5e0000
	          end_va = 0x61ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005e0000"
	        filename = ""

Region:
	              id = 3409
	        start_va = 0x6cad0000
	          end_va = 0x6caebfff
	       monitored = 0
	     entry_point = 0x6cad4720
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")

Region:
	              id = 3410
	        start_va = 0x6cac0000
	          end_va = 0x6cac9fff
	       monitored = 0
	     entry_point = 0x6cac28d0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")

Region:
	              id = 3411
	        start_va = 0x620000
	          end_va = 0x75ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000620000"
	        filename = ""

Region:
	              id = 3412
	        start_va = 0x620000
	          end_va = 0x649fff
	       monitored = 0
	     entry_point = 0x625680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 3413
	        start_va = 0x750000
	          end_va = 0x75ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000750000"
	        filename = ""

Region:
	              id = 3414
	        start_va = 0x760000
	          end_va = 0x8e7fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000760000"
	        filename = ""

Region:
	              id = 3415
	        start_va = 0x74ea0000
	          end_va = 0x74ecafff
	       monitored = 0
	     entry_point = 0x74ea5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 3416
	        start_va = 0x8f0000
	          end_va = 0xa70fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000008f0000"
	        filename = ""

Region:
	              id = 3417
	        start_va = 0x53d0000
	          end_va = 0x67cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000053d0000"
	        filename = ""

Region:
	              id = 3418
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 3419
	        start_va = 0x190000
	          end_va = 0x190fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000190000"
	        filename = ""

Region:
	              id = 3420
	        start_va = 0x1f0000
	          end_va = 0x1f4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taskkill.exe.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui")

Region:
	              id = 3421
	        start_va = 0x4c0000
	          end_va = 0x4c0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004c0000"
	        filename = ""

Region:
	              id = 3422
	        start_va = 0x4d0000
	          end_va = 0x4d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004d0000"
	        filename = ""

Region:
	              id = 3423
	        start_va = 0xa80000
	          end_va = 0xdb6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 3424
	        start_va = 0x620000
	          end_va = 0x709fff
	       monitored = 0
	     entry_point = 0x65d650
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 3425
	        start_va = 0x620000
	          end_va = 0x623fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000620000"
	        filename = ""

Region:
	              id = 3429
	        start_va = 0x630000
	          end_va = 0x70ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 3430
	        start_va = 0x76e20000
	          end_va = 0x76e2bfff
	       monitored = 0
	     entry_point = 0x76e23930
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")

Region:
	              id = 3431
	        start_va = 0x710000
	          end_va = 0x710fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000710000"
	        filename = ""

Region:
	              id = 3432
	        start_va = 0x76c80000
	          end_va = 0x76d03fff
	       monitored = 0
	     entry_point = 0x76ca6220
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 3433
	        start_va = 0x720000
	          end_va = 0x720fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000720000"
	        filename = ""

Region:
	              id = 3434
	        start_va = 0x6cab0000
	          end_va = 0x6cabcfff
	       monitored = 0
	     entry_point = 0x6cab3520
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 3435
	        start_va = 0x6ca40000
	          end_va = 0x6caa6fff
	       monitored = 0
	     entry_point = 0x6ca5b610
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 3436
	        start_va = 0x740f0000
	          end_va = 0x7410afff
	       monitored = 0
	     entry_point = 0x740f9050
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 3437
	        start_va = 0x6c9f0000
	          end_va = 0x6ca33fff
	       monitored = 0
	     entry_point = 0x6ca0aaf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")

Region:
	              id = 3438
	        start_va = 0xdc0000
	          end_va = 0xdfffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000dc0000"
	        filename = ""

Region:
	              id = 3439
	        start_va = 0xe00000
	          end_va = 0xe3ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e00000"
	        filename = ""

Region:
	              id = 3440
	        start_va = 0xe40000
	          end_va = 0xe7ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e40000"
	        filename = ""

Region:
	              id = 3441
	        start_va = 0xe80000
	          end_va = 0xebffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e80000"
	        filename = ""

Region:
	              id = 3442
	        start_va = 0xec0000
	          end_va = 0xefffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ec0000"
	        filename = ""

Region:
	              id = 3443
	        start_va = 0xf00000
	          end_va = 0xf3ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000f00000"
	        filename = ""

Region:
	              id = 3444
	        start_va = 0x6c9d0000
	          end_va = 0x6c9e0fff
	       monitored = 0
	     entry_point = 0x6c9d8fa0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 3445
	        start_va = 0x6c910000
	          end_va = 0x6c9cefff
	       monitored = 0
	     entry_point = 0x6c941e80
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 3448
	        start_va = 0x730000
	          end_va = 0x735fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000730000"
	        filename = ""


Thread:
	id = 257
	os_tid = 0x234


Thread:
	id = 258
	os_tid = 0x1304


Thread:
	id = 259
	os_tid = 0x788


Thread:
	id = 260
	os_tid = 0x4a4


Thread:
	id = 261
	os_tid = 0xcdc


Thread:
	id = 262
	os_tid = 0x1244


Process:
	id = "45"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x32e98000"
	os_pid = "0x13cc"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x614"
	cmd_line = "cmd.exe /c \"taskkill /f /im mysqld-nt.exe \""
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 3451
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 3452
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 3453
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 3454
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 3455
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 3456
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 3457
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 3458
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 3459
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 3460
	        start_va = 0x13a0000
	          end_va = 0x13f1fff
	       monitored = 1
	     entry_point = 0x13b4fd0
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")

Region:
	              id = 3461
	        start_va = 0x1400000
	          end_va = 0x53fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001400000"
	        filename = ""

Region:
	              id = 3462
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 3463
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 3464
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 3465
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 3466
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 3467
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 3468
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 3469
	        start_va = 0x450000
	          end_va = 0x45ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000450000"
	        filename = ""

Region:
	              id = 3470
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 3471
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 3472
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 3473
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 3474
	        start_va = 0x460000
	          end_va = 0x61ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000460000"
	        filename = ""

Region:
	              id = 3475
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 3476
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 3477
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 3478
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 3479
	        start_va = 0x460000
	          end_va = 0x51dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 3480
	        start_va = 0x520000
	          end_va = 0x61ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000520000"
	        filename = ""

Region:
	              id = 3481
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 3482
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 3483
	        start_va = 0x620000
	          end_va = 0x71ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000620000"
	        filename = ""

Region:
	              id = 3484
	        start_va = 0x720000
	          end_va = 0x87ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000720000"
	        filename = ""

Region:
	              id = 3485
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 3486
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 3487
	        start_va = 0x880000
	          end_va = 0xbb6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 263
	os_tid = 0xdb0

	[0155.862] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000
	[0155.862] __set_app_type (_Type=0x1) 
	[0155.863] __p__fmode () returned 0x74974d6c
	[0155.863] __p__commode () returned 0x74975b1c
	[0155.863] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13b5200) returned 0x0
	[0155.863] __getmainargs (in: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0, _DoWildCard=0, _StartInfo=0x13c60fc | out: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0) returned 0
	[0155.863] GetCurrentThreadId () returned 0xdb0
	[0155.863] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xdb0) returned 0x78
	[0155.863] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0155.864] GetProcAddress (hModule=0x75600000, lpProcName="SetThreadUILanguage") returned 0x75642510
	[0155.864] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0155.874] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0155.874] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2
	[0155.874] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0155.874] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0155.874] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0155.874] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0155.875] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0155.875] GetConsoleOutputCP () returned 0x1b5
	[0155.876] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0155.876] SetConsoleCtrlHandler (HandlerRoutine=0x13c0e40, Add=1) returned 1
	[0155.876] _get_osfhandle (_FileHandle=1) returned 0x130
	[0155.876] SetConsoleMode (hConsoleHandle=0x130, dwMode=0x0) returned 0
	[0155.876] _get_osfhandle (_FileHandle=1) returned 0x130
	[0155.876] GetConsoleMode (in: hConsoleHandle=0x130, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0155.876] _get_osfhandle (_FileHandle=0) returned 0x154
	[0155.876] GetConsoleMode (in: hConsoleHandle=0x154, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0155.876] GetEnvironmentStringsW () returned 0x527cc0*
	[0155.877] GetProcessHeap () returned 0x520000
	[0155.877] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xa1a) returned 0x5286e8
	[0155.877] FreeEnvironmentStringsA (penv="A") returned 1
	[0155.877] GetProcessHeap () returned 0x520000
	[0155.877] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x4) returned 0x520550
	[0155.877] GetEnvironmentStringsW () returned 0x527cc0*
	[0155.877] GetProcessHeap () returned 0x520000
	[0155.877] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xa1a) returned 0x529110
	[0155.877] FreeEnvironmentStringsA (penv="A") returned 1
	[0155.877] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0155.877] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0155.877] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0155.877] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0155.877] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0155.878] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0155.878] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0155.878] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0155.878] RegCloseKey (hKey=0x88) returned 0x0
	[0155.878] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0155.878] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0155.878] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0155.878] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0155.878] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0155.878] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0155.878] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0155.878] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0155.878] RegCloseKey (hKey=0x88) returned 0x0
	[0155.878] time (in: timer=0x0 | out: timer=0x0) returned 0x62344226
	[0155.878] srand (_Seed=0x62344226) 
	[0155.878] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im mysqld-nt.exe \""
	[0155.879] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im mysqld-nt.exe \""
	[0155.879] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0155.879] GetProcessHeap () returned 0x520000
	[0155.879] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x210) returned 0x529b38
	[0155.879] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x529b40, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0155.879] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0155.879] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0155.879] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0155.879] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0155.879] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0155.879] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0155.879] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0155.879] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0155.879] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0155.879] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0155.879] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0155.879] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0155.880] GetProcessHeap () returned 0x520000
	[0155.880] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x5286e8) returned 1
	[0155.880] GetEnvironmentStringsW () returned 0x527cc0*
	[0155.880] GetProcessHeap () returned 0x520000
	[0155.880] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xa32) returned 0x52a790
	[0155.880] FreeEnvironmentStringsA (penv="A") returned 1
	[0155.880] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b
	[0155.880] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0155.880] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0155.881] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0155.881] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0155.881] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0155.881] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0155.881] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0155.881] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0155.881] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0155.881] GetProcessHeap () returned 0x520000
	[0155.881] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x44) returned 0x5205c8
	[0155.881] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0155.881] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19fc4c*="Desktop") returned 0x1d
	[0155.881] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0155.881] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x520618
	[0155.881] FindClose (in: hFindFile=0x520618 | out: hFindFile=0x520618) returned 1
	[0155.882] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x520618
	[0155.882] FindClose (in: hFindFile=0x520618 | out: hFindFile=0x520618) returned 1
	[0155.882] _wcsnicmp (_String1="RDHJ0C~1", _String2="RDhJ0CNFevzX", _MaxCount=0xc) returned 16
	[0155.882] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x520618
	[0155.882] FindClose (in: hFindFile=0x520618 | out: hFindFile=0x520618) returned 1
	[0155.882] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0155.882] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1
	[0155.882] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 1
	[0155.882] GetProcessHeap () returned 0x520000
	[0155.883] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x52a790) returned 1
	[0155.883] GetEnvironmentStringsW () returned 0x527cc0*
	[0155.883] GetProcessHeap () returned 0x520000
	[0155.883] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xa76) returned 0x529d50
	[0155.883] FreeEnvironmentStringsA (penv="=") returned 1
	[0155.883] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0155.883] GetProcessHeap () returned 0x520000
	[0155.883] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x5205c8) returned 1
	[0155.883] GetProcessHeap () returned 0x520000
	[0155.883] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x400e) returned 0x52bc50
	[0155.884] GetProcessHeap () returned 0x520000
	[0155.884] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x4e) returned 0x52a7d0
	[0155.884] GetProcessHeap () returned 0x520000
	[0155.884] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x4008) returned 0x52fc68
	[0155.884] GetProcessHeap () returned 0x520000
	[0155.884] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x4008) returned 0x533c78
	[0155.885] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0155.886] GetProcessHeap () returned 0x520000
	[0155.886] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x418) returned 0x52a828
	[0155.886] SetErrorMode (uMode=0x0) returned 0x8003
	[0155.886] SetErrorMode (uMode=0x1) returned 0x0
	[0155.886] GetFullPathNameW (in: lpFileName="taskkill \\f \\.", nBufferLength=0x208, lpBuffer=0x52a830, lpFilePart=0x19fbac | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f", lpFilePart=0x19fbac*="f") returned 0x29
	[0155.886] SetErrorMode (uMode=0x8003) returned 0x1
	[0155.886] GetProcessHeap () returned 0x520000
	[0155.886] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x52a828, Size=0x80) returned 0x52a828
	[0155.886] GetProcessHeap () returned 0x520000
	[0155.886] RtlSizeHeap (HeapHandle=0x520000, Flags=0x0, MemoryPointer=0x52a828) returned 0x80
	[0155.887] NeedCurrentDirectoryForExePathW (ExeName="taskkill \\f \\.") returned 1
	[0155.887] GetProcessHeap () returned 0x520000
	[0155.887] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x62) returned 0x52a8b0
	[0155.887] GetProcessHeap () returned 0x520000
	[0155.887] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xb8) returned 0x52a920
	[0155.887] GetProcessHeap () returned 0x520000
	[0155.887] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x52a920, Size=0x62) returned 0x52a920
	[0155.887] GetProcessHeap () returned 0x520000
	[0155.887] RtlSizeHeap (HeapHandle=0x520000, Flags=0x0, MemoryPointer=0x52a920) returned 0x62
	[0155.887] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0155.887] GetProcessHeap () returned 0x520000
	[0155.887] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xe0) returned 0x52a990
	[0155.892] GetProcessHeap () returned 0x520000
	[0155.892] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x52a990, Size=0x76) returned 0x52a990
	[0155.892] GetProcessHeap () returned 0x520000
	[0155.892] RtlSizeHeap (HeapHandle=0x520000, Flags=0x0, MemoryPointer=0x52a990) returned 0x76
	[0155.892] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0155.892] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f\\im mysqld-nt.exe ", fInfoLevelId=0x1, lpFindFileData=0x19f958, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f958) returned 0xffffffff
	[0155.892] GetLastError () returned 0x3
	[0155.893] GetProcessHeap () returned 0x520000
	[0155.893] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x52fc68) returned 1
	[0155.893] GetProcessHeap () returned 0x520000
	[0155.894] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x533c78) returned 1
	[0155.894] GetProcessHeap () returned 0x520000
	[0155.895] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x52bc50) returned 1
	[0155.895] GetConsoleOutputCP () returned 0x1b5
	[0155.896] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0155.896] GetUserDefaultLCID () returned 0x409
	[0155.897] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x13d34a0, cchData=8 | out: lpLCData=":") returned 2
	[0155.897] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0155.897] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0155.897] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2
	[0155.897] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x13d34b0, cchData=8 | out: lpLCData="/") returned 2
	[0155.897] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x13d3500, cchData=32 | out: lpLCData="Mon") returned 4
	[0155.897] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x13d3540, cchData=32 | out: lpLCData="Tue") returned 4
	[0155.897] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x13d3580, cchData=32 | out: lpLCData="Wed") returned 4
	[0155.897] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x13d35c0, cchData=32 | out: lpLCData="Thu") returned 4
	[0155.897] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x13d3600, cchData=32 | out: lpLCData="Fri") returned 4
	[0155.897] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x13d3640, cchData=32 | out: lpLCData="Sat") returned 4
	[0155.897] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x13d3680, cchData=32 | out: lpLCData="Sun") returned 4
	[0155.897] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x13d34c0, cchData=8 | out: lpLCData=".") returned 2
	[0155.897] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x13d34e0, cchData=8 | out: lpLCData=",") returned 2
	[0155.897] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0155.899] GetProcessHeap () returned 0x520000
	[0155.899] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20c) returned 0x52aa58
	[0155.899] GetConsoleTitleW (in: lpConsoleTitle=0x52aa58, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0155.901] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0155.901] GetProcAddress (hModule=0x75600000, lpProcName="CopyFileExW") returned 0x7561ffc0
	[0155.901] GetProcAddress (hModule=0x75600000, lpProcName="IsDebuggerPresent") returned 0x7561b0b0
	[0155.901] GetProcAddress (hModule=0x75600000, lpProcName="SetConsoleInputExeNameW") returned 0x7559b440
	[0155.901] GetProcessHeap () returned 0x520000
	[0155.901] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x400a) returned 0x52bc50
	[0155.901] GetProcessHeap () returned 0x520000
	[0155.902] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x52bc50) returned 1
	[0155.903] _wcsicmp (_String1="taskkill", _String2=")") returned 75
	[0155.903] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14
	[0155.903] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14
	[0155.903] _wcsicmp (_String1="IF", _String2="taskkill") returned -11
	[0155.903] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11
	[0155.903] _wcsicmp (_String1="REM", _String2="taskkill") returned -2
	[0155.903] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2
	[0155.903] GetProcessHeap () returned 0x520000
	[0155.903] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x58) returned 0x52ac70
	[0155.903] GetProcessHeap () returned 0x520000
	[0155.903] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x1a) returned 0x520578
	[0155.904] GetProcessHeap () returned 0x520000
	[0155.904] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x36) returned 0x52acd0
	[0155.905] GetConsoleTitleW (in: lpConsoleTitle=0x19fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0155.908] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0155.908] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0155.909] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0155.909] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0155.909] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0155.909] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0155.909] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0155.909] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0155.909] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0155.909] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0155.909] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0155.909] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0155.909] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0155.909] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0155.909] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0155.909] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0155.909] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0155.909] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0155.909] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0155.909] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0155.909] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0155.910] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0155.910] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0155.910] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0155.910] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0155.910] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0155.910] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0155.910] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0155.910] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0155.910] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0155.910] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0155.910] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0155.910] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0155.910] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0155.910] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0155.910] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0155.910] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0155.910] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0155.910] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0155.911] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0155.911] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0155.911] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0155.911] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0155.911] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0155.911] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0155.911] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0155.911] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0155.911] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0155.911] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0155.911] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0155.911] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0155.911] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0155.911] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0155.911] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0155.911] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0155.911] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0155.911] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0155.911] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0155.911] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0155.912] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0155.912] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0155.912] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0155.912] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0155.912] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0155.912] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0155.912] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0155.912] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0155.912] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0155.912] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0155.912] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0155.912] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0155.912] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0155.912] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0155.912] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0155.912] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0155.912] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0155.912] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0155.912] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0155.913] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0155.913] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0155.913] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0155.913] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0155.913] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0155.913] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0155.913] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14
	[0155.913] _wcsicmp (_String1="taskkill", _String2="IF") returned 11
	[0155.913] _wcsicmp (_String1="taskkill", _String2="REM") returned 2
	[0155.913] GetProcessHeap () returned 0x520000
	[0155.913] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x210) returned 0x52ad10
	[0155.914] GetProcessHeap () returned 0x520000
	[0155.914] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x48) returned 0x52af28
	[0155.914] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0155.914] GetProcessHeap () returned 0x520000
	[0155.914] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x418) returned 0x5205c8
	[0155.914] SetErrorMode (uMode=0x0) returned 0x8003
	[0155.915] SetErrorMode (uMode=0x1) returned 0x0
	[0155.915] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x5205d0, lpFilePart=0x19f57c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19f57c*="Desktop") returned 0x1d
	[0155.915] SetErrorMode (uMode=0x8003) returned 0x1
	[0155.915] GetProcessHeap () returned 0x520000
	[0155.915] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5205c8, Size=0x56) returned 0x5205c8
	[0155.915] GetProcessHeap () returned 0x520000
	[0155.915] RtlSizeHeap (HeapHandle=0x520000, Flags=0x0, MemoryPointer=0x5205c8) returned 0x56
	[0155.915] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0155.915] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0155.915] GetProcessHeap () returned 0x520000
	[0155.915] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x110) returned 0x52af78
	[0155.915] GetProcessHeap () returned 0x520000
	[0155.916] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x218) returned 0x520628
	[0155.921] GetProcessHeap () returned 0x520000
	[0155.921] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x520628, Size=0x112) returned 0x520628
	[0155.921] GetProcessHeap () returned 0x520000
	[0155.921] RtlSizeHeap (HeapHandle=0x520000, Flags=0x0, MemoryPointer=0x520628) returned 0x112
	[0155.921] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0155.921] GetProcessHeap () returned 0x520000
	[0155.921] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xe0) returned 0x52b090
	[0155.922] GetProcessHeap () returned 0x520000
	[0155.923] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x52b090, Size=0x76) returned 0x52b090
	[0155.923] GetProcessHeap () returned 0x520000
	[0155.923] RtlSizeHeap (HeapHandle=0x520000, Flags=0x0, MemoryPointer=0x52b090) returned 0x76
	[0155.923] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0155.923] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0155.923] GetLastError () returned 0x2
	[0155.923] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0155.923] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x52b110
	[0155.924] GetProcessHeap () returned 0x520000
	[0155.924] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14) returned 0x527568
	[0155.924] FindClose (in: hFindFile=0x52b110 | out: hFindFile=0x52b110) returned 1
	[0155.924] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0155.924] GetLastError () returned 0x2
	[0155.924] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x52b110
	[0155.924] GetProcessHeap () returned 0x520000
	[0155.924] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x527568, Size=0x4) returned 0x52b150
	[0155.924] FindClose (in: hFindFile=0x52b110 | out: hFindFile=0x52b110) returned 1
	[0155.924] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0155.924] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0155.925] GetConsoleTitleW (in: lpConsoleTitle=0x19f7fc, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0155.928] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f728, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f70c | out: lpAttributeList=0x19f728, lpSize=0x19f70c) returned 1
	[0155.928] UpdateProcThreadAttribute (in: lpAttributeList=0x19f728, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f714, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f728, lpPreviousValue=0x0) returned 1
	[0155.928] GetStartupInfoW (in: lpStartupInfo=0x19f760 | out: lpStartupInfo=0x19f760*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x154, hStdOutput=0x130, hStdError=0x13c)) 
	[0155.928] GetProcessHeap () returned 0x520000
	[0155.928] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x18) returned 0x527568
	[0155.929] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0155.929] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0155.929] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0155.929] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0155.929] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0155.929] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0155.929] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0155.929] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0155.929] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0155.929] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0155.929] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0155.929] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0155.929] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0155.929] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0155.929] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0155.929] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0155.929] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0155.929] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0155.929] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0155.929] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0155.929] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0155.929] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0155.929] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0155.929] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0155.929] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0155.929] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0155.929] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0155.929] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0155.930] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0155.930] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0155.930] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0155.930] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0155.930] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0155.930] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0155.930] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0155.930] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0155.930] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0155.930] GetProcessHeap () returned 0x520000
	[0155.930] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x527568) returned 1
	[0155.930] GetProcessHeap () returned 0x520000
	[0155.930] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xa) returned 0x52b110
	[0155.930] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1
	[0155.933] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill  /f /im mysqld-nt.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x19f6b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill  /f /im mysqld-nt.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f6fc | out: lpCommandLine="taskkill  /f /im mysqld-nt.exe ", lpProcessInformation=0x19f6fc*(hProcess=0x9c, hThread=0x98, dwProcessId=0xcf0, dwThreadId=0x54c)) returned 1
	[0155.956] CloseHandle (hObject=0x98) returned 1
	[0155.956] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0155.956] GetProcessHeap () returned 0x520000
	[0155.957] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x529d50) returned 1
	[0155.957] GetEnvironmentStringsW () returned 0x529d50*
	[0155.957] GetProcessHeap () returned 0x520000
	[0155.957] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xa76) returned 0x527cc0
	[0155.957] FreeEnvironmentStringsA (penv="=") returned 1
	[0155.957] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0
	[0156.813] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x19f694 | out: lpExitCode=0x19f694*=0x80) returned 1
	[0156.813] CloseHandle (hObject=0x9c) returned 1
	[0156.814] _vsnwprintf (in: _Buffer=0x19f77c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f69c | out: _Buffer="00000080") returned 8
	[0156.814] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1
	[0156.814] GetProcessHeap () returned 0x520000
	[0156.814] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x527cc0) returned 1
	[0156.815] GetEnvironmentStringsW () returned 0x52b160*
	[0156.815] GetProcessHeap () returned 0x520000
	[0156.815] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xa9c) returned 0x527cc0
	[0156.815] FreeEnvironmentStringsA (penv="=") returned 1
	[0156.815] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0156.815] GetProcessHeap () returned 0x520000
	[0156.815] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x527cc0) returned 1
	[0156.815] GetEnvironmentStringsW () returned 0x52b160*
	[0156.854] GetProcessHeap () returned 0x520000
	[0156.855] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xa9c) returned 0x527cc0
	[0156.855] FreeEnvironmentStringsA (penv="=") returned 1
	[0156.855] GetProcessHeap () returned 0x520000
	[0156.855] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x52b110) returned 1
	[0156.855] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f728 | out: lpAttributeList=0x19f728) 
	[0156.855] _get_osfhandle (_FileHandle=1) returned 0x130
	[0156.855] SetConsoleMode (hConsoleHandle=0x130, dwMode=0x0) returned 0
	[0156.856] _get_osfhandle (_FileHandle=1) returned 0x130
	[0156.856] GetConsoleMode (in: hConsoleHandle=0x130, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0156.856] _get_osfhandle (_FileHandle=0) returned 0x154
	[0156.856] GetConsoleMode (in: hConsoleHandle=0x154, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0156.856] GetConsoleOutputCP () returned 0x1b5
	[0156.862] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0156.862] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0156.865] exit (_Code=128) 

Thread:
	id = 264
	os_tid = 0x494


Process:
	id = "46"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\syswow64\\taskkill.exe"
	page_root = "0x32c18000"
	os_pid = "0xcf0"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "45"
	os_parent_pid = "0x13cc"
	cmd_line = "taskkill  /f /im mysqld-nt.exe "
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 3488
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 3489
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 3490
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 3491
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 3492
	        start_va = 0xa0000
	          end_va = 0xdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 3493
	        start_va = 0xe0000
	          end_va = 0xe3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 3494
	        start_va = 0xf0000
	          end_va = 0xf0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 3495
	        start_va = 0x100000
	          end_va = 0x101fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 3496
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 3497
	        start_va = 0x13b0000
	          end_va = 0x13c5fff
	       monitored = 0
	     entry_point = 0x13bde80
	     region_type = mapped_file
	            name = "taskkill.exe"
	        filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe")

Region:
	              id = 3498
	        start_va = 0x13d0000
	          end_va = 0x53cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000013d0000"
	        filename = ""

Region:
	              id = 3499
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 3500
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 3501
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 3502
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 3503
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 3504
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 3505
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 3506
	        start_va = 0x140000
	          end_va = 0x14ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000140000"
	        filename = ""

Region:
	              id = 3507
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 3508
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 3509
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 3510
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 3511
	        start_va = 0x400000
	          end_va = 0x5affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 3512
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 3513
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 3514
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 3515
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 3516
	        start_va = 0x5b0000
	          end_va = 0x66dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 3517
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 3518
	        start_va = 0x74650000
	          end_va = 0x746cafff
	       monitored = 0
	     entry_point = 0x7466e970
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 3519
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 3520
	        start_va = 0x150000
	          end_va = 0x18ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000150000"
	        filename = ""

Region:
	              id = 3521
	        start_va = 0x190000
	          end_va = 0x1cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000190000"
	        filename = ""

Region:
	              id = 3522
	        start_va = 0x76ae0000
	          end_va = 0x76b23fff
	       monitored = 0
	     entry_point = 0x76af9d80
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 3523
	        start_va = 0x75260000
	          end_va = 0x7530cfff
	       monitored = 0
	     entry_point = 0x75274f00
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 3524
	        start_va = 0x74450000
	          end_va = 0x7446dfff
	       monitored = 0
	     entry_point = 0x7445b640
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 3525
	        start_va = 0x74440000
	          end_va = 0x74449fff
	       monitored = 0
	     entry_point = 0x74442a00
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 3526
	        start_va = 0x74590000
	          end_va = 0x745e7fff
	       monitored = 0
	     entry_point = 0x745d25c0
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 3527
	        start_va = 0x77450000
	          end_va = 0x77596fff
	       monitored = 0
	     entry_point = 0x77461cf0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 3528
	        start_va = 0x76b30000
	          end_va = 0x76c7efff
	       monitored = 0
	     entry_point = 0x76be6820
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 3529
	        start_va = 0x753c0000
	          end_va = 0x75451fff
	       monitored = 0
	     entry_point = 0x753f8cf0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 3530
	        start_va = 0x77290000
	          end_va = 0x7744cfff
	       monitored = 0
	     entry_point = 0x77372a10
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")

Region:
	              id = 3531
	        start_va = 0x75310000
	          end_va = 0x7536efff
	       monitored = 0
	     entry_point = 0x75314af0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 3532
	        start_va = 0x77240000
	          end_va = 0x77284fff
	       monitored = 0
	     entry_point = 0x7725de90
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 3533
	        start_va = 0x6cc90000
	          end_va = 0x6cc97fff
	       monitored = 0
	     entry_point = 0x6cc917b0
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 3534
	        start_va = 0x6cc70000
	          end_va = 0x6cc85fff
	       monitored = 0
	     entry_point = 0x6cc721d0
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")

Region:
	              id = 3535
	        start_va = 0x6cc30000
	          end_va = 0x6cc6efff
	       monitored = 0
	     entry_point = 0x6cc446c0
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll")

Region:
	              id = 3536
	        start_va = 0x6caf0000
	          end_va = 0x6cc2efff
	       monitored = 0
	     entry_point = 0x6cb1d880
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll")

Region:
	              id = 3537
	        start_va = 0x6cad0000
	          end_va = 0x6caebfff
	       monitored = 0
	     entry_point = 0x6cad4720
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")

Region:
	              id = 3538
	        start_va = 0x6cac0000
	          end_va = 0x6cac9fff
	       monitored = 0
	     entry_point = 0x6cac28d0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")

Region:
	              id = 3539
	        start_va = 0x400000
	          end_va = 0x4affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 3540
	        start_va = 0x4b0000
	          end_va = 0x5affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004b0000"
	        filename = ""

Region:
	              id = 3541
	        start_va = 0x110000
	          end_va = 0x139fff
	       monitored = 0
	     entry_point = 0x115680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 3542
	        start_va = 0x670000
	          end_va = 0x7f7fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000670000"
	        filename = ""

Region:
	              id = 3543
	        start_va = 0x74ea0000
	          end_va = 0x74ecafff
	       monitored = 0
	     entry_point = 0x74ea5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 3544
	        start_va = 0x800000
	          end_va = 0x980fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000800000"
	        filename = ""

Region:
	              id = 3545
	        start_va = 0x53d0000
	          end_va = 0x67cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000053d0000"
	        filename = ""

Region:
	              id = 3546
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 3547
	        start_va = 0x110000
	          end_va = 0x110fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000110000"
	        filename = ""

Region:
	              id = 3548
	        start_va = 0x120000
	          end_va = 0x124fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taskkill.exe.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui")

Region:
	              id = 3549
	        start_va = 0x130000
	          end_va = 0x130fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000130000"
	        filename = ""

Region:
	              id = 3550
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001d0000"
	        filename = ""

Region:
	              id = 3551
	        start_va = 0x990000
	          end_va = 0xcc6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 3552
	        start_va = 0xcd0000
	          end_va = 0xdb9fff
	       monitored = 0
	     entry_point = 0xd0d650
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 3553
	        start_va = 0x1e0000
	          end_va = 0x1e3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001e0000"
	        filename = ""

Region:
	              id = 3554
	        start_va = 0xcd0000
	          end_va = 0xdaffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 3555
	        start_va = 0x76e20000
	          end_va = 0x76e2bfff
	       monitored = 0
	     entry_point = 0x76e23930
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")

Region:
	              id = 3556
	        start_va = 0x1f0000
	          end_va = 0x1f0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001f0000"
	        filename = ""

Region:
	              id = 3557
	        start_va = 0x76c80000
	          end_va = 0x76d03fff
	       monitored = 0
	     entry_point = 0x76ca6220
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 3558
	        start_va = 0x400000
	          end_va = 0x400fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 3559
	        start_va = 0x4a0000
	          end_va = 0x4affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004a0000"
	        filename = ""

Region:
	              id = 3560
	        start_va = 0x6cab0000
	          end_va = 0x6cabcfff
	       monitored = 0
	     entry_point = 0x6cab3520
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 3561
	        start_va = 0x6ca40000
	          end_va = 0x6caa6fff
	       monitored = 0
	     entry_point = 0x6ca5b610
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 3562
	        start_va = 0x740f0000
	          end_va = 0x7410afff
	       monitored = 0
	     entry_point = 0x740f9050
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 3563
	        start_va = 0x6c9f0000
	          end_va = 0x6ca33fff
	       monitored = 0
	     entry_point = 0x6ca0aaf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")

Region:
	              id = 3564
	        start_va = 0x410000
	          end_va = 0x44ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000410000"
	        filename = ""

Region:
	              id = 3565
	        start_va = 0x450000
	          end_va = 0x48ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000450000"
	        filename = ""

Region:
	              id = 3566
	        start_va = 0xdb0000
	          end_va = 0xdeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000db0000"
	        filename = ""

Region:
	              id = 3567
	        start_va = 0xdf0000
	          end_va = 0xe2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000df0000"
	        filename = ""

Region:
	              id = 3568
	        start_va = 0xe30000
	          end_va = 0xe6ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e30000"
	        filename = ""

Region:
	              id = 3569
	        start_va = 0xe70000
	          end_va = 0xeaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e70000"
	        filename = ""

Region:
	              id = 3570
	        start_va = 0x6c9d0000
	          end_va = 0x6c9e0fff
	       monitored = 0
	     entry_point = 0x6c9d8fa0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 3571
	        start_va = 0x6c910000
	          end_va = 0x6c9cefff
	       monitored = 0
	     entry_point = 0x6c941e80
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 3573
	        start_va = 0x490000
	          end_va = 0x495fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000490000"
	        filename = ""


Thread:
	id = 265
	os_tid = 0x54c


Thread:
	id = 266
	os_tid = 0x344


Thread:
	id = 267
	os_tid = 0x13d8


Thread:
	id = 268
	os_tid = 0xbd4


Thread:
	id = 269
	os_tid = 0x238


Process:
	id = "47"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x32ba5000"
	os_pid = "0x654"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x614"
	cmd_line = "cmd.exe /c \"taskkill /f /im mysqld-opt.exe \""
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 3576
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 3577
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 3578
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 3579
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 3580
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 3581
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 3582
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 3583
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 3584
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 3585
	        start_va = 0x13a0000
	          end_va = 0x13f1fff
	       monitored = 1
	     entry_point = 0x13b4fd0
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")

Region:
	              id = 3586
	        start_va = 0x1400000
	          end_va = 0x53fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001400000"
	        filename = ""

Region:
	              id = 3587
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 3588
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 3589
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 3590
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 3591
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 3592
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 3593
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 3594
	        start_va = 0x500000
	          end_va = 0x50ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000500000"
	        filename = ""

Region:
	              id = 3595
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 3596
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 3597
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 3598
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 3599
	        start_va = 0x510000
	          end_va = 0x72ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000510000"
	        filename = ""

Region:
	              id = 3600
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 3601
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 3602
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 3603
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 3604
	        start_va = 0x400000
	          end_va = 0x4bdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 3605
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 3606
	        start_va = 0x4c0000
	          end_va = 0x4fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004c0000"
	        filename = ""

Region:
	              id = 3607
	        start_va = 0x510000
	          end_va = 0x60ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000510000"
	        filename = ""

Region:
	              id = 3608
	        start_va = 0x630000
	          end_va = 0x72ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000630000"
	        filename = ""

Region:
	              id = 3609
	        start_va = 0x730000
	          end_va = 0x88ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000730000"
	        filename = ""

Region:
	              id = 3610
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 3611
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 3612
	        start_va = 0x890000
	          end_va = 0xbc6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 270
	os_tid = 0xcbc

	[0157.217] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000
	[0157.217] __set_app_type (_Type=0x1) 
	[0157.217] __p__fmode () returned 0x74974d6c
	[0157.217] __p__commode () returned 0x74975b1c
	[0157.217] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13b5200) returned 0x0
	[0157.217] __getmainargs (in: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0, _DoWildCard=0, _StartInfo=0x13c60fc | out: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0) returned 0
	[0157.217] GetCurrentThreadId () returned 0xcbc
	[0157.217] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xcbc) returned 0x78
	[0157.218] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0157.218] GetProcAddress (hModule=0x75600000, lpProcName="SetThreadUILanguage") returned 0x75642510
	[0157.218] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0157.225] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0157.225] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2
	[0157.225] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0157.225] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0157.225] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0157.225] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0157.225] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0157.225] GetConsoleOutputCP () returned 0x1b5
	[0157.229] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0157.229] SetConsoleCtrlHandler (HandlerRoutine=0x13c0e40, Add=1) returned 1
	[0157.229] _get_osfhandle (_FileHandle=1) returned 0x154
	[0157.229] SetConsoleMode (hConsoleHandle=0x154, dwMode=0x0) returned 0
	[0157.229] _get_osfhandle (_FileHandle=1) returned 0x154
	[0157.229] GetConsoleMode (in: hConsoleHandle=0x154, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0157.229] _get_osfhandle (_FileHandle=0) returned 0x150
	[0157.229] GetConsoleMode (in: hConsoleHandle=0x150, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0157.229] GetEnvironmentStringsW () returned 0x637fe8*
	[0157.229] GetProcessHeap () returned 0x630000
	[0157.229] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xa1a) returned 0x638a10
	[0157.230] FreeEnvironmentStringsA (penv="A") returned 1
	[0157.230] GetProcessHeap () returned 0x630000
	[0157.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x637e70
	[0157.230] GetEnvironmentStringsW () returned 0x637fe8*
	[0157.230] GetProcessHeap () returned 0x630000
	[0157.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xa1a) returned 0x639438
	[0157.230] FreeEnvironmentStringsA (penv="A") returned 1
	[0157.230] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0157.230] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0157.230] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0157.230] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0157.230] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0157.230] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0157.230] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0157.231] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0157.231] RegCloseKey (hKey=0x88) returned 0x0
	[0157.231] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0157.231] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0157.231] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0157.231] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0157.231] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0157.231] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0157.231] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0157.231] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0157.231] RegCloseKey (hKey=0x88) returned 0x0
	[0157.231] time (in: timer=0x0 | out: timer=0x0) returned 0x62344227
	[0157.231] srand (_Seed=0x62344227) 
	[0157.231] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im mysqld-opt.exe \""
	[0157.231] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im mysqld-opt.exe \""
	[0157.231] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0157.232] GetProcessHeap () returned 0x630000
	[0157.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x210) returned 0x636fa0
	[0157.232] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x636fa8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0157.232] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0157.232] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0157.232] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0157.232] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0157.232] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0157.232] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0157.232] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0157.232] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0157.232] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0157.232] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0157.232] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0157.232] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0157.233] GetProcessHeap () returned 0x630000
	[0157.233] RtlFreeHeap (HeapHandle=0x630000, Flags=0x0, BaseAddress=0x638a10) returned 1
	[0157.233] GetEnvironmentStringsW () returned 0x637fe8*
	[0157.233] GetProcessHeap () returned 0x630000
	[0157.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xa32) returned 0x63a8a0
	[0157.233] FreeEnvironmentStringsA (penv="A") returned 1
	[0157.233] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b
	[0157.233] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0157.234] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0157.234] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0157.234] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0157.234] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0157.234] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0157.234] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0157.234] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0157.234] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0157.234] GetProcessHeap () returned 0x630000
	[0157.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x6371b8
	[0157.234] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0157.234] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19fc4c*="Desktop") returned 0x1d
	[0157.234] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0157.236] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x637208
	[0157.237] FindClose (in: hFindFile=0x637208 | out: hFindFile=0x637208) returned 1
	[0157.237] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x637208
	[0157.237] FindClose (in: hFindFile=0x637208 | out: hFindFile=0x637208) returned 1
	[0157.237] _wcsnicmp (_String1="RDHJ0C~1", _String2="RDhJ0CNFevzX", _MaxCount=0xc) returned 16
	[0157.237] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x637208
	[0157.237] FindClose (in: hFindFile=0x637208 | out: hFindFile=0x637208) returned 1
	[0157.237] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0157.238] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1
	[0157.238] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 1
	[0157.238] GetProcessHeap () returned 0x630000
	[0157.238] RtlFreeHeap (HeapHandle=0x630000, Flags=0x0, BaseAddress=0x63a8a0) returned 1
	[0157.239] GetEnvironmentStringsW () returned 0x637fe8*
	[0157.239] GetProcessHeap () returned 0x630000
	[0157.239] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xa76) returned 0x639e60
	[0157.239] FreeEnvironmentStringsA (penv="=") returned 1
	[0157.239] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0157.239] GetProcessHeap () returned 0x630000
	[0157.239] RtlFreeHeap (HeapHandle=0x630000, Flags=0x0, BaseAddress=0x6371b8) returned 1
	[0157.239] GetProcessHeap () returned 0x630000
	[0157.239] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x400e) returned 0x63bd60
	[0157.240] GetProcessHeap () returned 0x630000
	[0157.240] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x50) returned 0x6371b8
	[0157.240] GetProcessHeap () returned 0x630000
	[0157.240] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4008) returned 0x63fd78
	[0157.240] GetProcessHeap () returned 0x630000
	[0157.241] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4008) returned 0x643d88
	[0157.242] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0157.243] GetProcessHeap () returned 0x630000
	[0157.243] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x418) returned 0x63a8e0
	[0157.243] SetErrorMode (uMode=0x0) returned 0x8003
	[0157.243] SetErrorMode (uMode=0x1) returned 0x0
	[0157.243] GetFullPathNameW (in: lpFileName="taskkill \\f \\.", nBufferLength=0x208, lpBuffer=0x63a8e8, lpFilePart=0x19fbac | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f", lpFilePart=0x19fbac*="f") returned 0x29
	[0157.243] SetErrorMode (uMode=0x8003) returned 0x1
	[0157.243] GetProcessHeap () returned 0x630000
	[0157.243] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x63a8e0, Size=0x82) returned 0x63a8e0
	[0157.243] GetProcessHeap () returned 0x630000
	[0157.244] RtlSizeHeap (HeapHandle=0x630000, Flags=0x0, MemoryPointer=0x63a8e0) returned 0x82
	[0157.244] NeedCurrentDirectoryForExePathW (ExeName="taskkill \\f \\.") returned 1
	[0157.244] GetProcessHeap () returned 0x630000
	[0157.244] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x62) returned 0x637210
	[0157.244] GetProcessHeap () returned 0x630000
	[0157.244] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xb8) returned 0x63a970
	[0157.244] GetProcessHeap () returned 0x630000
	[0157.244] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x63a970, Size=0x62) returned 0x63a970
	[0157.244] GetProcessHeap () returned 0x630000
	[0157.244] RtlSizeHeap (HeapHandle=0x630000, Flags=0x0, MemoryPointer=0x63a970) returned 0x62
	[0157.244] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0157.244] GetProcessHeap () returned 0x630000
	[0157.244] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xe0) returned 0x63a9e0
	[0157.250] GetProcessHeap () returned 0x630000
	[0157.250] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x63a9e0, Size=0x76) returned 0x63a9e0
	[0157.250] GetProcessHeap () returned 0x630000
	[0157.250] RtlSizeHeap (HeapHandle=0x630000, Flags=0x0, MemoryPointer=0x63a9e0) returned 0x76
	[0157.250] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0157.251] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f\\im mysqld-opt.exe ", fInfoLevelId=0x1, lpFindFileData=0x19f958, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f958) returned 0xffffffff
	[0157.251] GetLastError () returned 0x3
	[0157.251] GetProcessHeap () returned 0x630000
	[0157.252] RtlFreeHeap (HeapHandle=0x630000, Flags=0x0, BaseAddress=0x63fd78) returned 1
	[0157.252] GetProcessHeap () returned 0x630000
	[0157.252] RtlFreeHeap (HeapHandle=0x630000, Flags=0x0, BaseAddress=0x643d88) returned 1
	[0157.252] GetProcessHeap () returned 0x630000
	[0157.252] RtlFreeHeap (HeapHandle=0x630000, Flags=0x0, BaseAddress=0x63bd60) returned 1
	[0157.252] GetConsoleOutputCP () returned 0x1b5
	[0157.256] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0157.256] GetUserDefaultLCID () returned 0x409
	[0157.257] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x13d34a0, cchData=8 | out: lpLCData=":") returned 2
	[0157.257] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0157.257] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0157.257] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2
	[0157.257] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x13d34b0, cchData=8 | out: lpLCData="/") returned 2
	[0157.258] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x13d3500, cchData=32 | out: lpLCData="Mon") returned 4
	[0157.258] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x13d3540, cchData=32 | out: lpLCData="Tue") returned 4
	[0157.258] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x13d3580, cchData=32 | out: lpLCData="Wed") returned 4
	[0157.258] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x13d35c0, cchData=32 | out: lpLCData="Thu") returned 4
	[0157.258] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x13d3600, cchData=32 | out: lpLCData="Fri") returned 4
	[0157.258] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x13d3640, cchData=32 | out: lpLCData="Sat") returned 4
	[0157.258] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x13d3680, cchData=32 | out: lpLCData="Sun") returned 4
	[0157.258] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x13d34c0, cchData=8 | out: lpLCData=".") returned 2
	[0157.258] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x13d34e0, cchData=8 | out: lpLCData=",") returned 2
	[0157.258] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0157.260] GetProcessHeap () returned 0x630000
	[0157.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x20c) returned 0x63aaa8
	[0157.260] GetConsoleTitleW (in: lpConsoleTitle=0x63aaa8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0157.262] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0157.262] GetProcAddress (hModule=0x75600000, lpProcName="CopyFileExW") returned 0x7561ffc0
	[0157.262] GetProcAddress (hModule=0x75600000, lpProcName="IsDebuggerPresent") returned 0x7561b0b0
	[0157.262] GetProcAddress (hModule=0x75600000, lpProcName="SetConsoleInputExeNameW") returned 0x7559b440
	[0157.262] GetProcessHeap () returned 0x630000
	[0157.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x400a) returned 0x63bd60
	[0157.263] GetProcessHeap () returned 0x630000
	[0157.263] RtlFreeHeap (HeapHandle=0x630000, Flags=0x0, BaseAddress=0x63bd60) returned 1
	[0157.264] _wcsicmp (_String1="taskkill", _String2=")") returned 75
	[0157.264] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14
	[0157.264] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14
	[0157.264] _wcsicmp (_String1="IF", _String2="taskkill") returned -11
	[0157.264] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11
	[0157.264] _wcsicmp (_String1="REM", _String2="taskkill") returned -2
	[0157.264] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2
	[0157.264] GetProcessHeap () returned 0x630000
	[0157.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x58) returned 0x63acc0
	[0157.264] GetProcessHeap () returned 0x630000
	[0157.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x1a) returned 0x637280
	[0157.265] GetProcessHeap () returned 0x630000
	[0157.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x38) returned 0x63ad20
	[0157.266] GetConsoleTitleW (in: lpConsoleTitle=0x19fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0157.270] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0157.270] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0157.270] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0157.270] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0157.271] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0157.271] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0157.271] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0157.271] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0157.271] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0157.271] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0157.271] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0157.271] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0157.271] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0157.271] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0157.271] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0157.271] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0157.271] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0157.271] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0157.271] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0157.271] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0157.271] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0157.271] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0157.272] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0157.272] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0157.272] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0157.272] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0157.272] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0157.272] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0157.272] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0157.272] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0157.272] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0157.272] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0157.272] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0157.272] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0157.272] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0157.272] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0157.272] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0157.272] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0157.272] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0157.272] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0157.272] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0157.272] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0157.272] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0157.272] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0157.272] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0157.273] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0157.273] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0157.273] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0157.273] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0157.273] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0157.273] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0157.273] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0157.273] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0157.273] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0157.273] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0157.273] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0157.273] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0157.273] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0157.273] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0157.273] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0157.273] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0157.273] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0157.273] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0157.273] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0157.273] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0157.273] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0157.273] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0157.273] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0157.274] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0157.274] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0157.274] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0157.274] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0157.274] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0157.274] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0157.274] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0157.274] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0157.274] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0157.274] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0157.274] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0157.274] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0157.274] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0157.274] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0157.274] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0157.274] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0157.274] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14
	[0157.274] _wcsicmp (_String1="taskkill", _String2="IF") returned 11
	[0157.274] _wcsicmp (_String1="taskkill", _String2="REM") returned 2
	[0157.275] GetProcessHeap () returned 0x630000
	[0157.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x210) returned 0x63ad60
	[0157.275] GetProcessHeap () returned 0x630000
	[0157.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4a) returned 0x63af78
	[0157.275] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0157.275] GetProcessHeap () returned 0x630000
	[0157.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x418) returned 0x6305c8
	[0157.276] SetErrorMode (uMode=0x0) returned 0x8003
	[0157.276] SetErrorMode (uMode=0x1) returned 0x0
	[0157.276] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x6305d0, lpFilePart=0x19f57c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19f57c*="Desktop") returned 0x1d
	[0157.276] SetErrorMode (uMode=0x8003) returned 0x1
	[0157.276] GetProcessHeap () returned 0x630000
	[0157.276] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6305c8, Size=0x56) returned 0x6305c8
	[0157.276] GetProcessHeap () returned 0x630000
	[0157.276] RtlSizeHeap (HeapHandle=0x630000, Flags=0x0, MemoryPointer=0x6305c8) returned 0x56
	[0157.276] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0157.276] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0157.276] GetProcessHeap () returned 0x630000
	[0157.276] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x110) returned 0x63afd0
	[0157.276] GetProcessHeap () returned 0x630000
	[0157.276] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x218) returned 0x630628
	[0157.283] GetProcessHeap () returned 0x630000
	[0157.283] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x630628, Size=0x112) returned 0x630628
	[0157.283] GetProcessHeap () returned 0x630000
	[0157.283] RtlSizeHeap (HeapHandle=0x630000, Flags=0x0, MemoryPointer=0x630628) returned 0x112
	[0157.283] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0157.283] GetProcessHeap () returned 0x630000
	[0157.283] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xe0) returned 0x63b0e8
	[0157.285] GetProcessHeap () returned 0x630000
	[0157.285] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x63b0e8, Size=0x76) returned 0x63b0e8
	[0157.285] GetProcessHeap () returned 0x630000
	[0157.285] RtlSizeHeap (HeapHandle=0x630000, Flags=0x0, MemoryPointer=0x63b0e8) returned 0x76
	[0157.286] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0157.286] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0157.286] GetLastError () returned 0x2
	[0157.286] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0157.286] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x63b168
	[0157.286] GetProcessHeap () returned 0x630000
	[0157.287] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x637888
	[0157.287] FindClose (in: hFindFile=0x63b168 | out: hFindFile=0x63b168) returned 1
	[0157.287] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0157.287] GetLastError () returned 0x2
	[0157.287] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x63b168
	[0157.287] GetProcessHeap () returned 0x630000
	[0157.287] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x637888, Size=0x4) returned 0x637e98
	[0157.287] FindClose (in: hFindFile=0x63b168 | out: hFindFile=0x63b168) returned 1
	[0157.288] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0157.288] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0157.288] GetConsoleTitleW (in: lpConsoleTitle=0x19f7fc, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0157.290] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f728, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f70c | out: lpAttributeList=0x19f728, lpSize=0x19f70c) returned 1
	[0157.291] UpdateProcThreadAttribute (in: lpAttributeList=0x19f728, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f714, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f728, lpPreviousValue=0x0) returned 1
	[0157.291] GetStartupInfoW (in: lpStartupInfo=0x19f760 | out: lpStartupInfo=0x19f760*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x150, hStdOutput=0x154, hStdError=0x130)) 
	[0157.291] GetProcessHeap () returned 0x630000
	[0157.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x18) returned 0x637668
	[0157.291] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0157.291] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0157.291] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0157.291] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0157.291] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0157.291] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0157.291] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0157.291] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0157.292] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0157.292] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0157.292] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0157.292] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0157.292] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0157.292] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0157.292] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0157.292] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0157.292] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0157.292] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0157.292] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0157.292] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0157.292] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0157.292] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0157.292] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0157.292] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0157.292] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0157.292] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0157.292] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0157.292] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0157.292] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0157.293] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0157.293] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0157.293] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0157.293] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0157.293] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0157.293] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0157.293] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0157.293] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0157.293] GetProcessHeap () returned 0x630000
	[0157.293] RtlFreeHeap (HeapHandle=0x630000, Flags=0x0, BaseAddress=0x637668) returned 1
	[0157.293] GetProcessHeap () returned 0x630000
	[0157.293] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xa) returned 0x637ea8
	[0157.293] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1
	[0157.297] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill  /f /im mysqld-opt.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x19f6b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill  /f /im mysqld-opt.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f6fc | out: lpCommandLine="taskkill  /f /im mysqld-opt.exe ", lpProcessInformation=0x19f6fc*(hProcess=0x9c, hThread=0x98, dwProcessId=0xd98, dwThreadId=0x9b0)) returned 1
	[0157.320] CloseHandle (hObject=0x98) returned 1
	[0157.320] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0157.320] GetProcessHeap () returned 0x630000
	[0157.321] RtlFreeHeap (HeapHandle=0x630000, Flags=0x0, BaseAddress=0x639e60) returned 1
	[0157.321] GetEnvironmentStringsW () returned 0x639e60*
	[0157.321] GetProcessHeap () returned 0x630000
	[0157.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xa76) returned 0x637fe8
	[0157.321] FreeEnvironmentStringsA (penv="=") returned 1
	[0157.321] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0
	[0158.304] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x19f694 | out: lpExitCode=0x19f694*=0x80) returned 1
	[0158.305] CloseHandle (hObject=0x9c) returned 1
	[0158.305] _vsnwprintf (in: _Buffer=0x19f77c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f69c | out: _Buffer="00000080") returned 8
	[0158.305] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1
	[0158.306] GetProcessHeap () returned 0x630000
	[0158.306] RtlFreeHeap (HeapHandle=0x630000, Flags=0x0, BaseAddress=0x637fe8) returned 1
	[0158.306] GetEnvironmentStringsW () returned 0x63b2b0*
	[0158.306] GetProcessHeap () returned 0x630000
	[0158.306] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xa9c) returned 0x637fe8
	[0158.307] FreeEnvironmentStringsA (penv="=") returned 1
	[0158.307] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0158.307] GetProcessHeap () returned 0x630000
	[0158.307] RtlFreeHeap (HeapHandle=0x630000, Flags=0x0, BaseAddress=0x637fe8) returned 1
	[0158.307] GetEnvironmentStringsW () returned 0x63b2b0*
	[0158.307] GetProcessHeap () returned 0x630000
	[0158.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xa9c) returned 0x637fe8
	[0158.307] FreeEnvironmentStringsA (penv="=") returned 1
	[0158.307] GetProcessHeap () returned 0x630000
	[0158.307] RtlFreeHeap (HeapHandle=0x630000, Flags=0x0, BaseAddress=0x637ea8) returned 1
	[0158.307] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f728 | out: lpAttributeList=0x19f728) 
	[0158.307] _get_osfhandle (_FileHandle=1) returned 0x154
	[0158.308] SetConsoleMode (hConsoleHandle=0x154, dwMode=0x0) returned 0
	[0158.308] _get_osfhandle (_FileHandle=1) returned 0x154
	[0158.308] GetConsoleMode (in: hConsoleHandle=0x154, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0158.308] _get_osfhandle (_FileHandle=0) returned 0x150
	[0158.308] GetConsoleMode (in: hConsoleHandle=0x150, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0158.308] GetConsoleOutputCP () returned 0x1b5
	[0158.310] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0158.310] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0158.312] exit (_Code=128) 

Thread:
	id = 271
	os_tid = 0x9dc


Process:
	id = "48"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\syswow64\\taskkill.exe"
	page_root = "0x32b74000"
	os_pid = "0xd98"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "47"
	os_parent_pid = "0x654"
	cmd_line = "taskkill  /f /im mysqld-opt.exe "
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 3613
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 3614
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 3615
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 3616
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 3617
	        start_va = 0xa0000
	          end_va = 0xdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 3618
	        start_va = 0xe0000
	          end_va = 0xe3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 3619
	        start_va = 0xf0000
	          end_va = 0xf0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 3620
	        start_va = 0x100000
	          end_va = 0x101fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 3621
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 3622
	        start_va = 0x13b0000
	          end_va = 0x13c5fff
	       monitored = 0
	     entry_point = 0x13bde80
	     region_type = mapped_file
	            name = "taskkill.exe"
	        filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe")

Region:
	              id = 3623
	        start_va = 0x13d0000
	          end_va = 0x53cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000013d0000"
	        filename = ""

Region:
	              id = 3624
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 3625
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 3626
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 3627
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 3628
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 3629
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 3630
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 3631
	        start_va = 0x570000
	          end_va = 0x57ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000570000"
	        filename = ""

Region:
	              id = 3632
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 3633
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 3634
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 3635
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 3636
	        start_va = 0x400000
	          end_va = 0x53ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 3637
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 3638
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 3639
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 3640
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 3641
	        start_va = 0x110000
	          end_va = 0x1cdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 3642
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 3643
	        start_va = 0x74650000
	          end_va = 0x746cafff
	       monitored = 0
	     entry_point = 0x7466e970
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 3644
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 3645
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 3646
	        start_va = 0x440000
	          end_va = 0x53ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000440000"
	        filename = ""

Region:
	              id = 3647
	        start_va = 0x580000
	          end_va = 0x5bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000580000"
	        filename = ""

Region:
	              id = 3648
	        start_va = 0x76ae0000
	          end_va = 0x76b23fff
	       monitored = 0
	     entry_point = 0x76af9d80
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 3649
	        start_va = 0x75260000
	          end_va = 0x7530cfff
	       monitored = 0
	     entry_point = 0x75274f00
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 3650
	        start_va = 0x74450000
	          end_va = 0x7446dfff
	       monitored = 0
	     entry_point = 0x7445b640
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 3651
	        start_va = 0x74440000
	          end_va = 0x74449fff
	       monitored = 0
	     entry_point = 0x74442a00
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 3652
	        start_va = 0x74590000
	          end_va = 0x745e7fff
	       monitored = 0
	     entry_point = 0x745d25c0
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 3653
	        start_va = 0x77450000
	          end_va = 0x77596fff
	       monitored = 0
	     entry_point = 0x77461cf0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 3654
	        start_va = 0x76b30000
	          end_va = 0x76c7efff
	       monitored = 0
	     entry_point = 0x76be6820
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 3655
	        start_va = 0x753c0000
	          end_va = 0x75451fff
	       monitored = 0
	     entry_point = 0x753f8cf0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 3656
	        start_va = 0x77290000
	          end_va = 0x7744cfff
	       monitored = 0
	     entry_point = 0x77372a10
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")

Region:
	              id = 3657
	        start_va = 0x75310000
	          end_va = 0x7536efff
	       monitored = 0
	     entry_point = 0x75314af0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 3658
	        start_va = 0x77240000
	          end_va = 0x77284fff
	       monitored = 0
	     entry_point = 0x7725de90
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 3659
	        start_va = 0x6cc90000
	          end_va = 0x6cc97fff
	       monitored = 0
	     entry_point = 0x6cc917b0
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 3660
	        start_va = 0x6cc70000
	          end_va = 0x6cc85fff
	       monitored = 0
	     entry_point = 0x6cc721d0
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")

Region:
	              id = 3661
	        start_va = 0x6cc30000
	          end_va = 0x6cc6efff
	       monitored = 0
	     entry_point = 0x6cc446c0
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll")

Region:
	              id = 3662
	        start_va = 0x6caf0000
	          end_va = 0x6cc2efff
	       monitored = 0
	     entry_point = 0x6cb1d880
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll")

Region:
	              id = 3663
	        start_va = 0x6cad0000
	          end_va = 0x6caebfff
	       monitored = 0
	     entry_point = 0x6cad4720
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")

Region:
	              id = 3664
	        start_va = 0x6cac0000
	          end_va = 0x6cac9fff
	       monitored = 0
	     entry_point = 0x6cac28d0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")

Region:
	              id = 3665
	        start_va = 0x5c0000
	          end_va = 0x77ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005c0000"
	        filename = ""

Region:
	              id = 3666
	        start_va = 0x1d0000
	          end_va = 0x1f9fff
	       monitored = 0
	     entry_point = 0x1d5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 3667
	        start_va = 0x5c0000
	          end_va = 0x747fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000005c0000"
	        filename = ""

Region:
	              id = 3668
	        start_va = 0x770000
	          end_va = 0x77ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000770000"
	        filename = ""

Region:
	              id = 3669
	        start_va = 0x74ea0000
	          end_va = 0x74ecafff
	       monitored = 0
	     entry_point = 0x74ea5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 3670
	        start_va = 0x780000
	          end_va = 0x900fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000780000"
	        filename = ""

Region:
	              id = 3671
	        start_va = 0x53d0000
	          end_va = 0x67cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000053d0000"
	        filename = ""

Region:
	              id = 3672
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 3673
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001d0000"
	        filename = ""

Region:
	              id = 3674
	        start_va = 0x1e0000
	          end_va = 0x1e4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taskkill.exe.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui")

Region:
	              id = 3675
	        start_va = 0x1f0000
	          end_va = 0x1f0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001f0000"
	        filename = ""

Region:
	              id = 3676
	        start_va = 0x540000
	          end_va = 0x540fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000540000"
	        filename = ""

Region:
	              id = 3677
	        start_va = 0x910000
	          end_va = 0xc46fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 3678
	        start_va = 0xc50000
	          end_va = 0xd39fff
	       monitored = 0
	     entry_point = 0xc8d650
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 3679
	        start_va = 0x550000
	          end_va = 0x553fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000550000"
	        filename = ""

Region:
	              id = 3680
	        start_va = 0xc50000
	          end_va = 0xd2ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 3681
	        start_va = 0x76e20000
	          end_va = 0x76e2bfff
	       monitored = 0
	     entry_point = 0x76e23930
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")

Region:
	              id = 3682
	        start_va = 0x560000
	          end_va = 0x560fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000560000"
	        filename = ""

Region:
	              id = 3683
	        start_va = 0x76c80000
	          end_va = 0x76d03fff
	       monitored = 0
	     entry_point = 0x76ca6220
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 3684
	        start_va = 0x750000
	          end_va = 0x750fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000750000"
	        filename = ""

Region:
	              id = 3685
	        start_va = 0x6cab0000
	          end_va = 0x6cabcfff
	       monitored = 0
	     entry_point = 0x6cab3520
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 3686
	        start_va = 0x6ca40000
	          end_va = 0x6caa6fff
	       monitored = 0
	     entry_point = 0x6ca5b610
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 3687
	        start_va = 0x740f0000
	          end_va = 0x7410afff
	       monitored = 0
	     entry_point = 0x740f9050
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 3688
	        start_va = 0x6c9f0000
	          end_va = 0x6ca33fff
	       monitored = 0
	     entry_point = 0x6ca0aaf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")

Region:
	              id = 3689
	        start_va = 0xd30000
	          end_va = 0xd6ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d30000"
	        filename = ""

Region:
	              id = 3690
	        start_va = 0xd70000
	          end_va = 0xdaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d70000"
	        filename = ""

Region:
	              id = 3691
	        start_va = 0xdb0000
	          end_va = 0xdeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000db0000"
	        filename = ""

Region:
	              id = 3692
	        start_va = 0xdf0000
	          end_va = 0xe2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000df0000"
	        filename = ""

Region:
	              id = 3693
	        start_va = 0xe30000
	          end_va = 0xe6ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e30000"
	        filename = ""

Region:
	              id = 3694
	        start_va = 0xe70000
	          end_va = 0xeaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e70000"
	        filename = ""

Region:
	              id = 3695
	        start_va = 0x6c9d0000
	          end_va = 0x6c9e0fff
	       monitored = 0
	     entry_point = 0x6c9d8fa0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 3696
	        start_va = 0x6c910000
	          end_va = 0x6c9cefff
	       monitored = 0
	     entry_point = 0x6c941e80
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 3698
	        start_va = 0x760000
	          end_va = 0x765fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000760000"
	        filename = ""


Thread:
	id = 272
	os_tid = 0x9b0


Thread:
	id = 273
	os_tid = 0x9a0


Thread:
	id = 274
	os_tid = 0xa08


Thread:
	id = 275
	os_tid = 0xad8


Thread:
	id = 276
	os_tid = 0x99c


Process:
	id = "49"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x32bae000"
	os_pid = "0x1240"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x614"
	cmd_line = "cmd.exe /c \"taskkill /f /im dbeng50.exe \""
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 3701
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 3702
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 3703
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 3704
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 3705
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 3706
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 3707
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 3708
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 3709
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 3710
	        start_va = 0x13a0000
	          end_va = 0x13f1fff
	       monitored = 1
	     entry_point = 0x13b4fd0
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")

Region:
	              id = 3711
	        start_va = 0x1400000
	          end_va = 0x53fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001400000"
	        filename = ""

Region:
	              id = 3712
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 3713
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 3714
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 3715
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 3716
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 3717
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 3718
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 3719
	        start_va = 0x540000
	          end_va = 0x54ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000540000"
	        filename = ""

Region:
	              id = 3720
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 3721
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 3722
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 3723
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 3724
	        start_va = 0x550000
	          end_va = 0x6effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000550000"
	        filename = ""

Region:
	              id = 3725
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 3726
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 3727
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 3728
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 3729
	        start_va = 0x400000
	          end_va = 0x4bdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 3730
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 3731
	        start_va = 0x4c0000
	          end_va = 0x4fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004c0000"
	        filename = ""

Region:
	              id = 3732
	        start_va = 0x6f0000
	          end_va = 0x7effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006f0000"
	        filename = ""

Region:
	              id = 3733
	        start_va = 0x7f0000
	          end_va = 0x8dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000007f0000"
	        filename = ""

Region:
	              id = 3734
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 3735
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 3736
	        start_va = 0x8e0000
	          end_va = 0xc16fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 277
	os_tid = 0x1374

	[0158.687] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000
	[0158.687] __set_app_type (_Type=0x1) 
	[0158.687] __p__fmode () returned 0x74974d6c
	[0158.687] __p__commode () returned 0x74975b1c
	[0158.687] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13b5200) returned 0x0
	[0158.688] __getmainargs (in: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0, _DoWildCard=0, _StartInfo=0x13c60fc | out: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0) returned 0
	[0158.688] GetCurrentThreadId () returned 0x1374
	[0158.688] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x1374) returned 0x78
	[0158.688] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0158.688] GetProcAddress (hModule=0x75600000, lpProcName="SetThreadUILanguage") returned 0x75642510
	[0158.688] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0158.698] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0158.698] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2
	[0158.698] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0158.698] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0158.698] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0158.698] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0158.698] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0158.698] GetConsoleOutputCP () returned 0x1b5
	[0158.701] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0158.701] SetConsoleCtrlHandler (HandlerRoutine=0x13c0e40, Add=1) returned 1
	[0158.701] _get_osfhandle (_FileHandle=1) returned 0x150
	[0158.701] SetConsoleMode (hConsoleHandle=0x150, dwMode=0x0) returned 0
	[0158.701] _get_osfhandle (_FileHandle=1) returned 0x150
	[0158.701] GetConsoleMode (in: hConsoleHandle=0x150, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0158.701] _get_osfhandle (_FileHandle=0) returned 0x144
	[0158.701] GetConsoleMode (in: hConsoleHandle=0x144, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0158.702] GetEnvironmentStringsW () returned 0x5f7d08*
	[0158.702] GetProcessHeap () returned 0x5f0000
	[0158.702] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xa1a) returned 0x5f8730
	[0158.703] FreeEnvironmentStringsA (penv="A") returned 1
	[0158.703] GetProcessHeap () returned 0x5f0000
	[0158.703] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x4) returned 0x5f0588
	[0158.703] GetEnvironmentStringsW () returned 0x5f7d08*
	[0158.703] GetProcessHeap () returned 0x5f0000
	[0158.703] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xa1a) returned 0x5f9158
	[0158.703] FreeEnvironmentStringsA (penv="A") returned 1
	[0158.703] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0158.703] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0158.703] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0158.703] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0158.703] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0158.704] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0158.704] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0158.704] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0158.704] RegCloseKey (hKey=0x88) returned 0x0
	[0158.704] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0158.704] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0158.704] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0158.704] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0158.704] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0158.704] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0158.704] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0158.704] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0158.704] RegCloseKey (hKey=0x88) returned 0x0
	[0158.704] time (in: timer=0x0 | out: timer=0x0) returned 0x62344228
	[0158.705] srand (_Seed=0x62344228) 
	[0158.705] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im dbeng50.exe \""
	[0158.705] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im dbeng50.exe \""
	[0158.705] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0158.705] GetProcessHeap () returned 0x5f0000
	[0158.705] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x210) returned 0x5f9b80
	[0158.705] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5f9b88, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0158.705] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0158.705] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0158.705] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0158.705] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0158.705] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0158.705] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0158.705] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0158.705] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0158.705] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0158.705] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0158.705] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0158.706] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0158.706] GetProcessHeap () returned 0x5f0000
	[0158.706] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5f8730) returned 1
	[0158.706] GetEnvironmentStringsW () returned 0x5f7d08*
	[0158.707] GetProcessHeap () returned 0x5f0000
	[0158.707] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xa32) returned 0x5fa7d8
	[0158.707] FreeEnvironmentStringsA (penv="A") returned 1
	[0158.707] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b
	[0158.707] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0158.707] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0158.707] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0158.707] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0158.707] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0158.707] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0158.707] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0158.707] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0158.707] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0158.707] GetProcessHeap () returned 0x5f0000
	[0158.707] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x44) returned 0x5f4140
	[0158.707] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0158.707] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19fc4c*="Desktop") returned 0x1d
	[0158.707] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0158.708] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x5f05c8
	[0158.708] FindClose (in: hFindFile=0x5f05c8 | out: hFindFile=0x5f05c8) returned 1
	[0158.708] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x5f05c8
	[0158.708] FindClose (in: hFindFile=0x5f05c8 | out: hFindFile=0x5f05c8) returned 1
	[0158.708] _wcsnicmp (_String1="RDHJ0C~1", _String2="RDhJ0CNFevzX", _MaxCount=0xc) returned 16
	[0158.708] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x5f05c8
	[0158.708] FindClose (in: hFindFile=0x5f05c8 | out: hFindFile=0x5f05c8) returned 1
	[0158.708] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0158.708] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1
	[0158.709] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 1
	[0158.709] GetProcessHeap () returned 0x5f0000
	[0158.709] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5fa7d8) returned 1
	[0158.709] GetEnvironmentStringsW () returned 0x5f7d08*
	[0158.709] GetProcessHeap () returned 0x5f0000
	[0158.709] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xa76) returned 0x5f9d98
	[0158.709] FreeEnvironmentStringsA (penv="=") returned 1
	[0158.709] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0158.709] GetProcessHeap () returned 0x5f0000
	[0158.709] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5f4140) returned 1
	[0158.710] GetProcessHeap () returned 0x5f0000
	[0158.710] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x400e) returned 0x5fbc98
	[0158.711] GetProcessHeap () returned 0x5f0000
	[0158.711] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x4a) returned 0x5f4140
	[0158.711] GetProcessHeap () returned 0x5f0000
	[0158.711] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x4008) returned 0x5ffcb0
	[0158.711] GetProcessHeap () returned 0x5f0000
	[0158.711] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x4008) returned 0x603cc0
	[0158.712] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0158.713] GetProcessHeap () returned 0x5f0000
	[0158.713] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x418) returned 0x5fa818
	[0158.713] SetErrorMode (uMode=0x0) returned 0x8003
	[0158.713] SetErrorMode (uMode=0x1) returned 0x0
	[0158.713] GetFullPathNameW (in: lpFileName="taskkill \\f \\.", nBufferLength=0x208, lpBuffer=0x5fa820, lpFilePart=0x19fbac | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f", lpFilePart=0x19fbac*="f") returned 0x29
	[0158.713] SetErrorMode (uMode=0x8003) returned 0x1
	[0158.714] GetProcessHeap () returned 0x5f0000
	[0158.714] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x5fa818, Size=0x7c) returned 0x5fa818
	[0158.714] GetProcessHeap () returned 0x5f0000
	[0158.714] RtlSizeHeap (HeapHandle=0x5f0000, Flags=0x0, MemoryPointer=0x5fa818) returned 0x7c
	[0158.714] NeedCurrentDirectoryForExePathW (ExeName="taskkill \\f \\.") returned 1
	[0158.714] GetProcessHeap () returned 0x5f0000
	[0158.714] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x62) returned 0x5fa8a0
	[0158.714] GetProcessHeap () returned 0x5f0000
	[0158.714] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xb8) returned 0x5fa910
	[0158.714] GetProcessHeap () returned 0x5f0000
	[0158.714] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x5fa910, Size=0x62) returned 0x5fa910
	[0158.714] GetProcessHeap () returned 0x5f0000
	[0158.714] RtlSizeHeap (HeapHandle=0x5f0000, Flags=0x0, MemoryPointer=0x5fa910) returned 0x62
	[0158.714] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0158.714] GetProcessHeap () returned 0x5f0000
	[0158.714] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xe0) returned 0x5fa980
	[0158.719] GetProcessHeap () returned 0x5f0000
	[0158.719] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x5fa980, Size=0x76) returned 0x5fa980
	[0158.719] GetProcessHeap () returned 0x5f0000
	[0158.719] RtlSizeHeap (HeapHandle=0x5f0000, Flags=0x0, MemoryPointer=0x5fa980) returned 0x76
	[0158.720] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0158.720] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f\\im dbeng50.exe ", fInfoLevelId=0x1, lpFindFileData=0x19f958, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f958) returned 0xffffffff
	[0158.720] GetLastError () returned 0x3
	[0158.720] GetProcessHeap () returned 0x5f0000
	[0158.721] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5ffcb0) returned 1
	[0158.721] GetProcessHeap () returned 0x5f0000
	[0158.721] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x603cc0) returned 1
	[0158.721] GetProcessHeap () returned 0x5f0000
	[0158.722] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5fbc98) returned 1
	[0158.722] GetConsoleOutputCP () returned 0x1b5
	[0158.774] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0158.774] GetUserDefaultLCID () returned 0x409
	[0158.774] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x13d34a0, cchData=8 | out: lpLCData=":") returned 2
	[0158.774] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0158.775] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0158.775] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2
	[0158.775] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x13d34b0, cchData=8 | out: lpLCData="/") returned 2
	[0158.775] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x13d3500, cchData=32 | out: lpLCData="Mon") returned 4
	[0158.775] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x13d3540, cchData=32 | out: lpLCData="Tue") returned 4
	[0158.775] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x13d3580, cchData=32 | out: lpLCData="Wed") returned 4
	[0158.775] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x13d35c0, cchData=32 | out: lpLCData="Thu") returned 4
	[0158.775] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x13d3600, cchData=32 | out: lpLCData="Fri") returned 4
	[0158.775] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x13d3640, cchData=32 | out: lpLCData="Sat") returned 4
	[0158.775] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x13d3680, cchData=32 | out: lpLCData="Sun") returned 4
	[0158.775] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x13d34c0, cchData=8 | out: lpLCData=".") returned 2
	[0158.775] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x13d34e0, cchData=8 | out: lpLCData=",") returned 2
	[0158.775] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0158.777] GetProcessHeap () returned 0x5f0000
	[0158.777] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x20c) returned 0x5faa48
	[0158.777] GetConsoleTitleW (in: lpConsoleTitle=0x5faa48, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0158.781] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0158.781] GetProcAddress (hModule=0x75600000, lpProcName="CopyFileExW") returned 0x7561ffc0
	[0158.781] GetProcAddress (hModule=0x75600000, lpProcName="IsDebuggerPresent") returned 0x7561b0b0
	[0158.782] GetProcAddress (hModule=0x75600000, lpProcName="SetConsoleInputExeNameW") returned 0x7559b440
	[0158.782] GetProcessHeap () returned 0x5f0000
	[0158.782] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x400a) returned 0x5fbc98
	[0158.782] GetProcessHeap () returned 0x5f0000
	[0158.783] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5fbc98) returned 1
	[0158.784] _wcsicmp (_String1="taskkill", _String2=")") returned 75
	[0158.784] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14
	[0158.784] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14
	[0158.784] _wcsicmp (_String1="IF", _String2="taskkill") returned -11
	[0158.784] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11
	[0158.784] _wcsicmp (_String1="REM", _String2="taskkill") returned -2
	[0158.784] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2
	[0158.784] GetProcessHeap () returned 0x5f0000
	[0158.784] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x58) returned 0x5fac60
	[0158.784] GetProcessHeap () returned 0x5f0000
	[0158.784] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x1a) returned 0x5facc0
	[0158.785] GetProcessHeap () returned 0x5f0000
	[0158.785] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x32) returned 0x5face8
	[0158.786] GetConsoleTitleW (in: lpConsoleTitle=0x19fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0158.789] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0158.789] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0158.789] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0158.789] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0158.789] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0158.789] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0158.789] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0158.789] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0158.789] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0158.790] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0158.790] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0158.790] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0158.790] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0158.790] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0158.790] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0158.790] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0158.790] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0158.790] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0158.790] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0158.790] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0158.790] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0158.790] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0158.790] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0158.790] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0158.790] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0158.790] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0158.790] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0158.790] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0158.790] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0158.790] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0158.790] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0158.791] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0158.791] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0158.791] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0158.791] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0158.791] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0158.791] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0158.791] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0158.791] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0158.791] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0158.791] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0158.791] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0158.791] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0158.791] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0158.791] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0158.791] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0158.791] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0158.791] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0158.791] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0158.791] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0158.791] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0158.791] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0158.791] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0158.791] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0158.791] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0158.792] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0158.792] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0158.792] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0158.792] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0158.792] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0158.792] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0158.792] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0158.792] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0158.792] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0158.792] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0158.792] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0158.792] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0158.792] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0158.792] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0158.792] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0158.792] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0158.792] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0158.792] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0158.792] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0158.792] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0158.792] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0158.792] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0158.792] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0158.792] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0158.792] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0158.792] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0158.793] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0158.793] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0158.793] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0158.793] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14
	[0158.793] _wcsicmp (_String1="taskkill", _String2="IF") returned 11
	[0158.793] _wcsicmp (_String1="taskkill", _String2="REM") returned 2
	[0158.794] GetProcessHeap () returned 0x5f0000
	[0158.794] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x210) returned 0x5fad28
	[0158.794] GetProcessHeap () returned 0x5f0000
	[0158.794] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x44) returned 0x5faf40
	[0158.794] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0158.794] GetProcessHeap () returned 0x5f0000
	[0158.794] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x418) returned 0x5f05c8
	[0158.794] SetErrorMode (uMode=0x0) returned 0x8003
	[0158.794] SetErrorMode (uMode=0x1) returned 0x0
	[0158.795] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x5f05d0, lpFilePart=0x19f57c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19f57c*="Desktop") returned 0x1d
	[0158.795] SetErrorMode (uMode=0x8003) returned 0x1
	[0158.795] GetProcessHeap () returned 0x5f0000
	[0158.795] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x5f05c8, Size=0x56) returned 0x5f05c8
	[0158.795] GetProcessHeap () returned 0x5f0000
	[0158.795] RtlSizeHeap (HeapHandle=0x5f0000, Flags=0x0, MemoryPointer=0x5f05c8) returned 0x56
	[0158.795] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0158.795] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0158.795] GetProcessHeap () returned 0x5f0000
	[0158.795] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x110) returned 0x5faf90
	[0158.795] GetProcessHeap () returned 0x5f0000
	[0158.795] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x218) returned 0x5f0628
	[0158.801] GetProcessHeap () returned 0x5f0000
	[0158.801] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x5f0628, Size=0x112) returned 0x5f0628
	[0158.801] GetProcessHeap () returned 0x5f0000
	[0158.801] RtlSizeHeap (HeapHandle=0x5f0000, Flags=0x0, MemoryPointer=0x5f0628) returned 0x112
	[0158.801] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0158.801] GetProcessHeap () returned 0x5f0000
	[0158.801] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xe0) returned 0x5fb0a8
	[0158.803] GetProcessHeap () returned 0x5f0000
	[0158.803] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x5fb0a8, Size=0x76) returned 0x5fb0a8
	[0158.804] GetProcessHeap () returned 0x5f0000
	[0158.804] RtlSizeHeap (HeapHandle=0x5f0000, Flags=0x0, MemoryPointer=0x5fb0a8) returned 0x76
	[0158.804] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0158.804] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0158.804] GetLastError () returned 0x2
	[0158.805] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0158.805] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x5fb128
	[0158.805] GetProcessHeap () returned 0x5f0000
	[0158.805] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x14) returned 0x5f75e8
	[0158.805] FindClose (in: hFindFile=0x5fb128 | out: hFindFile=0x5fb128) returned 1
	[0158.805] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0158.805] GetLastError () returned 0x2
	[0158.805] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x5fb128
	[0158.806] GetProcessHeap () returned 0x5f0000
	[0158.806] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x5f75e8, Size=0x4) returned 0x5f0598
	[0158.806] FindClose (in: hFindFile=0x5fb128 | out: hFindFile=0x5fb128) returned 1
	[0158.806] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0158.806] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0158.806] GetConsoleTitleW (in: lpConsoleTitle=0x19f7fc, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0158.808] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f728, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f70c | out: lpAttributeList=0x19f728, lpSize=0x19f70c) returned 1
	[0158.808] UpdateProcThreadAttribute (in: lpAttributeList=0x19f728, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f714, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f728, lpPreviousValue=0x0) returned 1
	[0158.808] GetStartupInfoW (in: lpStartupInfo=0x19f760 | out: lpStartupInfo=0x19f760*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x144, hStdOutput=0x150, hStdError=0x154)) 
	[0158.808] GetProcessHeap () returned 0x5f0000
	[0158.808] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x18) returned 0x5f77c8
	[0158.808] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0158.808] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0158.808] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0158.808] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0158.808] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0158.808] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0158.809] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0158.809] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0158.809] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0158.809] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0158.809] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0158.809] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0158.809] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0158.809] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0158.809] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0158.809] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0158.809] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0158.809] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0158.809] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0158.809] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0158.809] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0158.809] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0158.809] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0158.809] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0158.809] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0158.809] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0158.809] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0158.809] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0158.809] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0158.809] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0158.810] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0158.810] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0158.810] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0158.810] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0158.810] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0158.810] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0158.810] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0158.810] GetProcessHeap () returned 0x5f0000
	[0158.810] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5f77c8) returned 1
	[0158.810] GetProcessHeap () returned 0x5f0000
	[0158.810] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xa) returned 0x5fb128
	[0158.810] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1
	[0158.813] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill  /f /im dbeng50.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x19f6b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill  /f /im dbeng50.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f6fc | out: lpCommandLine="taskkill  /f /im dbeng50.exe ", lpProcessInformation=0x19f6fc*(hProcess=0x9c, hThread=0x98, dwProcessId=0x1258, dwThreadId=0x1380)) returned 1
	[0158.834] CloseHandle (hObject=0x98) returned 1
	[0158.834] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0158.834] GetProcessHeap () returned 0x5f0000
	[0158.835] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5f9d98) returned 1
	[0158.835] GetEnvironmentStringsW () returned 0x5f9d98*
	[0158.835] GetProcessHeap () returned 0x5f0000
	[0158.835] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xa76) returned 0x5f7d08
	[0158.835] FreeEnvironmentStringsA (penv="=") returned 1
	[0158.835] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0
	[0159.998] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x19f694 | out: lpExitCode=0x19f694*=0x80) returned 1
	[0159.999] CloseHandle (hObject=0x9c) returned 1
	[0159.999] _vsnwprintf (in: _Buffer=0x19f77c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f69c | out: _Buffer="00000080") returned 8
	[0159.999] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1
	[0160.000] GetProcessHeap () returned 0x5f0000
	[0160.000] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5f7d08) returned 1
	[0160.000] GetEnvironmentStringsW () returned 0x5fb158*
	[0160.000] GetProcessHeap () returned 0x5f0000
	[0160.000] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xa9c) returned 0x5f7d08
	[0160.000] FreeEnvironmentStringsA (penv="=") returned 1
	[0160.000] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0160.000] GetProcessHeap () returned 0x5f0000
	[0160.001] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5f7d08) returned 1
	[0160.001] GetEnvironmentStringsW () returned 0x5fb158*
	[0160.001] GetProcessHeap () returned 0x5f0000
	[0160.001] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xa9c) returned 0x5f7d08
	[0160.001] FreeEnvironmentStringsA (penv="=") returned 1
	[0160.001] GetProcessHeap () returned 0x5f0000
	[0160.001] RtlFreeHeap (HeapHandle=0x5f0000, Flags=0x0, BaseAddress=0x5fb128) returned 1
	[0160.001] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f728 | out: lpAttributeList=0x19f728) 
	[0160.001] _get_osfhandle (_FileHandle=1) returned 0x150
	[0160.001] SetConsoleMode (hConsoleHandle=0x150, dwMode=0x0) returned 0
	[0160.001] _get_osfhandle (_FileHandle=1) returned 0x150
	[0160.001] GetConsoleMode (in: hConsoleHandle=0x150, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0160.001] _get_osfhandle (_FileHandle=0) returned 0x144
	[0160.001] GetConsoleMode (in: hConsoleHandle=0x144, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0160.001] GetConsoleOutputCP () returned 0x1b5
	[0160.003] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0160.003] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0160.004] exit (_Code=128) 

Thread:
	id = 278
	os_tid = 0x121c


Process:
	id = "50"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\syswow64\\taskkill.exe"
	page_root = "0x32818000"
	os_pid = "0x1258"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "49"
	os_parent_pid = "0x1240"
	cmd_line = "taskkill  /f /im dbeng50.exe "
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 3737
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 3738
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 3739
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 3740
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 3741
	        start_va = 0xa0000
	          end_va = 0xdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 3742
	        start_va = 0xe0000
	          end_va = 0xe3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 3743
	        start_va = 0xf0000
	          end_va = 0xf0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 3744
	        start_va = 0x100000
	          end_va = 0x101fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 3745
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 3746
	        start_va = 0x13b0000
	          end_va = 0x13c5fff
	       monitored = 0
	     entry_point = 0x13bde80
	     region_type = mapped_file
	            name = "taskkill.exe"
	        filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe")

Region:
	              id = 3747
	        start_va = 0x13d0000
	          end_va = 0x53cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000013d0000"
	        filename = ""

Region:
	              id = 3748
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 3749
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 3750
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 3751
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 3752
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 3753
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 3754
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 3755
	        start_va = 0x570000
	          end_va = 0x57ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000570000"
	        filename = ""

Region:
	              id = 3756
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 3757
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 3758
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 3759
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 3760
	        start_va = 0x580000
	          end_va = 0x76ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000580000"
	        filename = ""

Region:
	              id = 3761
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 3762
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 3763
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 3764
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 3765
	        start_va = 0x110000
	          end_va = 0x1cdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 3766
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 3767
	        start_va = 0x74650000
	          end_va = 0x746cafff
	       monitored = 0
	     entry_point = 0x7466e970
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 3768
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 3769
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 3770
	        start_va = 0x440000
	          end_va = 0x47ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000440000"
	        filename = ""

Region:
	              id = 3771
	        start_va = 0x76ae0000
	          end_va = 0x76b23fff
	       monitored = 0
	     entry_point = 0x76af9d80
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 3772
	        start_va = 0x75260000
	          end_va = 0x7530cfff
	       monitored = 0
	     entry_point = 0x75274f00
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 3773
	        start_va = 0x74450000
	          end_va = 0x7446dfff
	       monitored = 0
	     entry_point = 0x7445b640
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 3774
	        start_va = 0x74440000
	          end_va = 0x74449fff
	       monitored = 0
	     entry_point = 0x74442a00
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 3775
	        start_va = 0x74590000
	          end_va = 0x745e7fff
	       monitored = 0
	     entry_point = 0x745d25c0
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 3776
	        start_va = 0x77450000
	          end_va = 0x77596fff
	       monitored = 0
	     entry_point = 0x77461cf0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 3777
	        start_va = 0x76b30000
	          end_va = 0x76c7efff
	       monitored = 0
	     entry_point = 0x76be6820
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 3778
	        start_va = 0x753c0000
	          end_va = 0x75451fff
	       monitored = 0
	     entry_point = 0x753f8cf0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 3779
	        start_va = 0x77290000
	          end_va = 0x7744cfff
	       monitored = 0
	     entry_point = 0x77372a10
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")

Region:
	              id = 3780
	        start_va = 0x75310000
	          end_va = 0x7536efff
	       monitored = 0
	     entry_point = 0x75314af0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 3781
	        start_va = 0x77240000
	          end_va = 0x77284fff
	       monitored = 0
	     entry_point = 0x7725de90
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 3782
	        start_va = 0x6cc80000
	          end_va = 0x6cc95fff
	       monitored = 0
	     entry_point = 0x6cc821d0
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")

Region:
	              id = 3783
	        start_va = 0x6cc40000
	          end_va = 0x6cc7efff
	       monitored = 0
	     entry_point = 0x6cc546c0
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll")

Region:
	              id = 3784
	        start_va = 0x6cb00000
	          end_va = 0x6cc3efff
	       monitored = 0
	     entry_point = 0x6cb2d880
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll")

Region:
	              id = 3785
	        start_va = 0x6cae0000
	          end_va = 0x6cafbfff
	       monitored = 0
	     entry_point = 0x6cae4720
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")

Region:
	              id = 3786
	        start_va = 0x6cad0000
	          end_va = 0x6cad9fff
	       monitored = 0
	     entry_point = 0x6cad28d0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")

Region:
	              id = 3787
	        start_va = 0x6cac0000
	          end_va = 0x6cac7fff
	       monitored = 0
	     entry_point = 0x6cac17b0
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 3788
	        start_va = 0x770000
	          end_va = 0x94ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000770000"
	        filename = ""

Region:
	              id = 3789
	        start_va = 0x1d0000
	          end_va = 0x1f9fff
	       monitored = 0
	     entry_point = 0x1d5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 3790
	        start_va = 0x770000
	          end_va = 0x8f7fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000770000"
	        filename = ""

Region:
	              id = 3791
	        start_va = 0x940000
	          end_va = 0x94ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000940000"
	        filename = ""

Region:
	              id = 3792
	        start_va = 0x74ea0000
	          end_va = 0x74ecafff
	       monitored = 0
	     entry_point = 0x74ea5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 3793
	        start_va = 0x950000
	          end_va = 0xad0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000950000"
	        filename = ""

Region:
	              id = 3794
	        start_va = 0x53d0000
	          end_va = 0x67cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000053d0000"
	        filename = ""

Region:
	              id = 3795
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 3796
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001d0000"
	        filename = ""

Region:
	              id = 3797
	        start_va = 0x1e0000
	          end_va = 0x1e4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taskkill.exe.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui")

Region:
	              id = 3798
	        start_va = 0x1f0000
	          end_va = 0x1f0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001f0000"
	        filename = ""

Region:
	              id = 3799
	        start_va = 0x480000
	          end_va = 0x480fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 3800
	        start_va = 0xae0000
	          end_va = 0xe16fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 3801
	        start_va = 0x580000
	          end_va = 0x669fff
	       monitored = 0
	     entry_point = 0x5bd650
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 3802
	        start_va = 0x670000
	          end_va = 0x76ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000670000"
	        filename = ""

Region:
	              id = 3803
	        start_va = 0x490000
	          end_va = 0x493fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000490000"
	        filename = ""

Region:
	              id = 3804
	        start_va = 0x580000
	          end_va = 0x65ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 3805
	        start_va = 0x76e20000
	          end_va = 0x76e2bfff
	       monitored = 0
	     entry_point = 0x76e23930
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")

Region:
	              id = 3806
	        start_va = 0x4a0000
	          end_va = 0x4a0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004a0000"
	        filename = ""

Region:
	              id = 3807
	        start_va = 0x76c80000
	          end_va = 0x76d03fff
	       monitored = 0
	     entry_point = 0x76ca6220
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 3808
	        start_va = 0x4b0000
	          end_va = 0x4b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004b0000"
	        filename = ""

Region:
	              id = 3809
	        start_va = 0x6cab0000
	          end_va = 0x6cabcfff
	       monitored = 0
	     entry_point = 0x6cab3520
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 3810
	        start_va = 0x6ca40000
	          end_va = 0x6caa6fff
	       monitored = 0
	     entry_point = 0x6ca5b610
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 3811
	        start_va = 0x740f0000
	          end_va = 0x7410afff
	       monitored = 0
	     entry_point = 0x740f9050
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 3812
	        start_va = 0x6c9f0000
	          end_va = 0x6ca33fff
	       monitored = 0
	     entry_point = 0x6ca0aaf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")

Region:
	              id = 3813
	        start_va = 0x4c0000
	          end_va = 0x4fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004c0000"
	        filename = ""

Region:
	              id = 3814
	        start_va = 0x500000
	          end_va = 0x53ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000500000"
	        filename = ""

Region:
	              id = 3815
	        start_va = 0x900000
	          end_va = 0x93ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000900000"
	        filename = ""

Region:
	              id = 3816
	        start_va = 0xe20000
	          end_va = 0xe5ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e20000"
	        filename = ""

Region:
	              id = 3817
	        start_va = 0xe60000
	          end_va = 0xe9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e60000"
	        filename = ""

Region:
	              id = 3818
	        start_va = 0xea0000
	          end_va = 0xedffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ea0000"
	        filename = ""

Region:
	              id = 3819
	        start_va = 0x6c9d0000
	          end_va = 0x6c9e0fff
	       monitored = 0
	     entry_point = 0x6c9d8fa0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 3820
	        start_va = 0x6c910000
	          end_va = 0x6c9cefff
	       monitored = 0
	     entry_point = 0x6c941e80
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 3822
	        start_va = 0x540000
	          end_va = 0x545fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000540000"
	        filename = ""


Thread:
	id = 279
	os_tid = 0x1380


Thread:
	id = 280
	os_tid = 0xc7c


Thread:
	id = 281
	os_tid = 0x678


Thread:
	id = 282
	os_tid = 0x964


Thread:
	id = 283
	os_tid = 0xf20


Process:
	id = "51"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x325c1000"
	os_pid = "0xc68"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x614"
	cmd_line = "cmd.exe /c \"taskkill /f /im sqbcoreservice.exe \""
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 3825
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 3826
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 3827
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 3828
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 3829
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 3830
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 3831
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 3832
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 3833
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 3834
	        start_va = 0x13a0000
	          end_va = 0x13f1fff
	       monitored = 1
	     entry_point = 0x13b4fd0
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")

Region:
	              id = 3835
	        start_va = 0x1400000
	          end_va = 0x53fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001400000"
	        filename = ""

Region:
	              id = 3836
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 3837
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 3838
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 3839
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 3840
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 3841
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 3842
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 3843
	        start_va = 0x510000
	          end_va = 0x51ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000510000"
	        filename = ""

Region:
	              id = 3844
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 3845
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 3846
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 3847
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 3848
	        start_va = 0x520000
	          end_va = 0x7dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000520000"
	        filename = ""

Region:
	              id = 3849
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 3850
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 3851
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 3852
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 3853
	        start_va = 0x400000
	          end_va = 0x4bdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 3854
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 3855
	        start_va = 0x4c0000
	          end_va = 0x4fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004c0000"
	        filename = ""

Region:
	              id = 3856
	        start_va = 0x520000
	          end_va = 0x61ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000520000"
	        filename = ""

Region:
	              id = 3857
	        start_va = 0x6e0000
	          end_va = 0x7dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006e0000"
	        filename = ""

Region:
	              id = 3858
	        start_va = 0x7e0000
	          end_va = 0x8fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000007e0000"
	        filename = ""

Region:
	              id = 3859
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 3860
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 3861
	        start_va = 0x900000
	          end_va = 0xc36fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 284
	os_tid = 0x520

	[0163.531] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000
	[0163.531] __set_app_type (_Type=0x1) 
	[0163.531] __p__fmode () returned 0x74974d6c
	[0163.531] __p__commode () returned 0x74975b1c
	[0163.531] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13b5200) returned 0x0
	[0163.531] __getmainargs (in: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0, _DoWildCard=0, _StartInfo=0x13c60fc | out: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0) returned 0
	[0163.531] GetCurrentThreadId () returned 0x520
	[0163.532] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x520) returned 0x78
	[0163.532] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0163.532] GetProcAddress (hModule=0x75600000, lpProcName="SetThreadUILanguage") returned 0x75642510
	[0163.532] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0163.620] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0163.620] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2
	[0163.621] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0163.621] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0163.621] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0163.621] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0163.621] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0163.621] GetConsoleOutputCP () returned 0x1b5
	[0163.624] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0163.625] SetConsoleCtrlHandler (HandlerRoutine=0x13c0e40, Add=1) returned 1
	[0163.625] _get_osfhandle (_FileHandle=1) returned 0x144
	[0163.625] SetConsoleMode (hConsoleHandle=0x144, dwMode=0x0) returned 0
	[0163.625] _get_osfhandle (_FileHandle=1) returned 0x144
	[0163.625] GetConsoleMode (in: hConsoleHandle=0x144, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0163.625] _get_osfhandle (_FileHandle=0) returned 0x140
	[0163.625] GetConsoleMode (in: hConsoleHandle=0x140, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0163.625] GetEnvironmentStringsW () returned 0x6e7cd8*
	[0163.625] GetProcessHeap () returned 0x6e0000
	[0163.625] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0xa1a) returned 0x6e8700
	[0163.626] FreeEnvironmentStringsA (penv="A") returned 1
	[0163.626] GetProcessHeap () returned 0x6e0000
	[0163.626] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0x4) returned 0x6e0550
	[0163.626] GetEnvironmentStringsW () returned 0x6e7cd8*
	[0163.626] GetProcessHeap () returned 0x6e0000
	[0163.626] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0xa1a) returned 0x6e9128
	[0163.626] FreeEnvironmentStringsA (penv="A") returned 1
	[0163.626] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0163.627] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0163.627] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0163.627] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0163.627] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0163.627] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0163.627] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0163.627] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0163.627] RegCloseKey (hKey=0x88) returned 0x0
	[0163.627] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0163.627] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0163.627] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0163.627] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0163.628] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0163.628] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0163.628] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0163.628] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0163.628] RegCloseKey (hKey=0x88) returned 0x0
	[0163.628] time (in: timer=0x0 | out: timer=0x0) returned 0x6234422d
	[0163.628] srand (_Seed=0x6234422d) 
	[0163.628] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im sqbcoreservice.exe \""
	[0163.628] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im sqbcoreservice.exe \""
	[0163.628] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0163.628] GetProcessHeap () returned 0x6e0000
	[0163.628] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0x210) returned 0x6e9b50
	[0163.629] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6e9b58, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0163.629] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0163.629] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0163.629] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0163.629] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0163.629] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0163.629] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0163.629] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0163.629] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0163.629] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0163.629] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0163.629] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0163.629] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0163.630] GetProcessHeap () returned 0x6e0000
	[0163.630] RtlFreeHeap (HeapHandle=0x6e0000, Flags=0x0, BaseAddress=0x6e8700) returned 1
	[0163.630] GetEnvironmentStringsW () returned 0x6e7cd8*
	[0163.630] GetProcessHeap () returned 0x6e0000
	[0163.630] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0xa32) returned 0x6ea7a8
	[0163.631] FreeEnvironmentStringsA (penv="A") returned 1
	[0163.631] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b
	[0163.631] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0163.631] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0163.631] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0163.631] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0163.631] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0163.631] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0163.631] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0163.631] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0163.631] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0163.631] GetProcessHeap () returned 0x6e0000
	[0163.631] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0x44) returned 0x6e05c8
	[0163.631] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0163.631] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19fc4c*="Desktop") returned 0x1d
	[0163.632] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0163.632] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x6e0618
	[0163.632] FindClose (in: hFindFile=0x6e0618 | out: hFindFile=0x6e0618) returned 1
	[0163.632] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x6e0618
	[0163.632] FindClose (in: hFindFile=0x6e0618 | out: hFindFile=0x6e0618) returned 1
	[0163.632] _wcsnicmp (_String1="RDHJ0C~1", _String2="RDhJ0CNFevzX", _MaxCount=0xc) returned 16
	[0163.632] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x6e0618
	[0163.633] FindClose (in: hFindFile=0x6e0618 | out: hFindFile=0x6e0618) returned 1
	[0163.633] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0163.633] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1
	[0163.633] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 1
	[0163.633] GetProcessHeap () returned 0x6e0000
	[0163.633] RtlFreeHeap (HeapHandle=0x6e0000, Flags=0x0, BaseAddress=0x6ea7a8) returned 1
	[0163.633] GetEnvironmentStringsW () returned 0x6e7cd8*
	[0163.634] GetProcessHeap () returned 0x6e0000
	[0163.634] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0xa76) returned 0x6e9d68
	[0163.634] FreeEnvironmentStringsA (penv="=") returned 1
	[0163.634] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0163.634] GetProcessHeap () returned 0x6e0000
	[0163.634] RtlFreeHeap (HeapHandle=0x6e0000, Flags=0x0, BaseAddress=0x6e05c8) returned 1
	[0163.634] GetProcessHeap () returned 0x6e0000
	[0163.634] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0x400e) returned 0x6ebc68
	[0163.635] GetProcessHeap () returned 0x6e0000
	[0163.635] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0x58) returned 0x6ea7e8
	[0163.635] GetProcessHeap () returned 0x6e0000
	[0163.635] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0x4008) returned 0x6efc80
	[0163.635] GetProcessHeap () returned 0x6e0000
	[0163.635] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0x4008) returned 0x6f3c90
	[0163.637] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0163.638] GetProcessHeap () returned 0x6e0000
	[0163.638] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0x418) returned 0x6ea848
	[0163.638] SetErrorMode (uMode=0x0) returned 0x8003
	[0163.638] SetErrorMode (uMode=0x1) returned 0x0
	[0163.638] GetFullPathNameW (in: lpFileName="taskkill \\f \\.", nBufferLength=0x208, lpBuffer=0x6ea850, lpFilePart=0x19fbac | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f", lpFilePart=0x19fbac*="f") returned 0x29
	[0163.638] SetErrorMode (uMode=0x8003) returned 0x1
	[0163.639] GetProcessHeap () returned 0x6e0000
	[0163.639] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6ea848, Size=0x8a) returned 0x6ea848
	[0163.639] GetProcessHeap () returned 0x6e0000
	[0163.639] RtlSizeHeap (HeapHandle=0x6e0000, Flags=0x0, MemoryPointer=0x6ea848) returned 0x8a
	[0163.639] NeedCurrentDirectoryForExePathW (ExeName="taskkill \\f \\.") returned 1
	[0163.639] GetProcessHeap () returned 0x6e0000
	[0163.639] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0x62) returned 0x6ea8e0
	[0163.639] GetProcessHeap () returned 0x6e0000
	[0163.639] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0xb8) returned 0x6ea950
	[0163.639] GetProcessHeap () returned 0x6e0000
	[0163.639] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6ea950, Size=0x62) returned 0x6ea950
	[0163.639] GetProcessHeap () returned 0x6e0000
	[0163.639] RtlSizeHeap (HeapHandle=0x6e0000, Flags=0x0, MemoryPointer=0x6ea950) returned 0x62
	[0163.639] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0163.639] GetProcessHeap () returned 0x6e0000
	[0163.639] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0xe0) returned 0x6ea9c0
	[0163.647] GetProcessHeap () returned 0x6e0000
	[0163.647] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6ea9c0, Size=0x76) returned 0x6ea9c0
	[0163.647] GetProcessHeap () returned 0x6e0000
	[0163.647] RtlSizeHeap (HeapHandle=0x6e0000, Flags=0x0, MemoryPointer=0x6ea9c0) returned 0x76
	[0163.647] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0163.648] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f\\im sqbcoreservice.exe ", fInfoLevelId=0x1, lpFindFileData=0x19f958, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f958) returned 0xffffffff
	[0163.648] GetLastError () returned 0x3
	[0163.648] GetProcessHeap () returned 0x6e0000
	[0163.649] RtlFreeHeap (HeapHandle=0x6e0000, Flags=0x0, BaseAddress=0x6efc80) returned 1
	[0163.649] GetProcessHeap () returned 0x6e0000
	[0163.650] RtlFreeHeap (HeapHandle=0x6e0000, Flags=0x0, BaseAddress=0x6f3c90) returned 1
	[0163.650] GetProcessHeap () returned 0x6e0000
	[0163.650] RtlFreeHeap (HeapHandle=0x6e0000, Flags=0x0, BaseAddress=0x6ebc68) returned 1
	[0163.651] GetConsoleOutputCP () returned 0x1b5
	[0163.653] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0163.653] GetUserDefaultLCID () returned 0x409
	[0163.653] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x13d34a0, cchData=8 | out: lpLCData=":") returned 2
	[0163.654] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0163.654] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0163.654] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2
	[0163.654] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x13d34b0, cchData=8 | out: lpLCData="/") returned 2
	[0163.654] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x13d3500, cchData=32 | out: lpLCData="Mon") returned 4
	[0163.654] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x13d3540, cchData=32 | out: lpLCData="Tue") returned 4
	[0163.654] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x13d3580, cchData=32 | out: lpLCData="Wed") returned 4
	[0163.654] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x13d35c0, cchData=32 | out: lpLCData="Thu") returned 4
	[0163.654] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x13d3600, cchData=32 | out: lpLCData="Fri") returned 4
	[0163.654] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x13d3640, cchData=32 | out: lpLCData="Sat") returned 4
	[0163.654] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x13d3680, cchData=32 | out: lpLCData="Sun") returned 4
	[0163.654] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x13d34c0, cchData=8 | out: lpLCData=".") returned 2
	[0163.654] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x13d34e0, cchData=8 | out: lpLCData=",") returned 2
	[0163.654] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0163.656] GetProcessHeap () returned 0x6e0000
	[0163.656] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x20c) returned 0x6eaa88
	[0163.656] GetConsoleTitleW (in: lpConsoleTitle=0x6eaa88, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0163.659] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0163.659] GetProcAddress (hModule=0x75600000, lpProcName="CopyFileExW") returned 0x7561ffc0
	[0163.659] GetProcAddress (hModule=0x75600000, lpProcName="IsDebuggerPresent") returned 0x7561b0b0
	[0163.659] GetProcAddress (hModule=0x75600000, lpProcName="SetConsoleInputExeNameW") returned 0x7559b440
	[0163.659] GetProcessHeap () returned 0x6e0000
	[0163.660] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0x400a) returned 0x6ebc68
	[0163.660] GetProcessHeap () returned 0x6e0000
	[0163.660] RtlFreeHeap (HeapHandle=0x6e0000, Flags=0x0, BaseAddress=0x6ebc68) returned 1
	[0163.661] _wcsicmp (_String1="taskkill", _String2=")") returned 75
	[0163.661] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14
	[0163.661] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14
	[0163.661] _wcsicmp (_String1="IF", _String2="taskkill") returned -11
	[0163.661] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11
	[0163.661] _wcsicmp (_String1="REM", _String2="taskkill") returned -2
	[0163.661] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2
	[0163.661] GetProcessHeap () returned 0x6e0000
	[0163.661] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0x58) returned 0x6eaca0
	[0163.661] GetProcessHeap () returned 0x6e0000
	[0163.662] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0x1a) returned 0x6e0578
	[0163.662] GetProcessHeap () returned 0x6e0000
	[0163.662] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0x40) returned 0x6ead00
	[0163.663] GetConsoleTitleW (in: lpConsoleTitle=0x19fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0163.667] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0163.667] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0163.667] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0163.667] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0163.667] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0163.667] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0163.667] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0163.667] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0163.667] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0163.667] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0163.667] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0163.667] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0163.667] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0163.667] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0163.667] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0163.667] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0163.668] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0163.668] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0163.668] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0163.668] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0163.668] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0163.668] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0163.668] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0163.668] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0163.668] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0163.668] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0163.668] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0163.668] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0163.668] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0163.668] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0163.668] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0163.668] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0163.669] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0163.669] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0163.669] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0163.669] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0163.669] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0163.669] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0163.669] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0163.669] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0163.669] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0163.669] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0163.669] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0163.669] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0163.669] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0163.669] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0163.669] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0163.669] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0163.669] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0163.669] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0163.669] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0163.669] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0163.669] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0163.669] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0163.669] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0163.670] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0163.670] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0163.670] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0163.670] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0163.670] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0163.670] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0163.670] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0163.670] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0163.670] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0163.670] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0163.670] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0163.670] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0163.670] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0163.670] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0163.670] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0163.670] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0163.670] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0163.670] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0163.670] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0163.670] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0163.670] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0163.670] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0163.670] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0163.670] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0163.671] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0163.671] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0163.671] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0163.671] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0163.671] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0163.671] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14
	[0163.671] _wcsicmp (_String1="taskkill", _String2="IF") returned 11
	[0163.671] _wcsicmp (_String1="taskkill", _String2="REM") returned 2
	[0163.672] GetProcessHeap () returned 0x6e0000
	[0163.672] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0x210) returned 0x6ead48
	[0163.672] GetProcessHeap () returned 0x6e0000
	[0163.672] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0x52) returned 0x6eaf60
	[0163.672] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0163.672] GetProcessHeap () returned 0x6e0000
	[0163.672] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0x418) returned 0x6e05c8
	[0163.672] SetErrorMode (uMode=0x0) returned 0x8003
	[0163.672] SetErrorMode (uMode=0x1) returned 0x0
	[0163.672] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x6e05d0, lpFilePart=0x19f57c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19f57c*="Desktop") returned 0x1d
	[0163.672] SetErrorMode (uMode=0x8003) returned 0x1
	[0163.673] GetProcessHeap () returned 0x6e0000
	[0163.673] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6e05c8, Size=0x56) returned 0x6e05c8
	[0163.673] GetProcessHeap () returned 0x6e0000
	[0163.673] RtlSizeHeap (HeapHandle=0x6e0000, Flags=0x0, MemoryPointer=0x6e05c8) returned 0x56
	[0163.673] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0163.673] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0163.673] GetProcessHeap () returned 0x6e0000
	[0163.673] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0x110) returned 0x6eafc0
	[0163.673] GetProcessHeap () returned 0x6e0000
	[0163.673] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0x218) returned 0x6e0628
	[0163.679] GetProcessHeap () returned 0x6e0000
	[0163.679] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6e0628, Size=0x112) returned 0x6e0628
	[0163.680] GetProcessHeap () returned 0x6e0000
	[0163.680] RtlSizeHeap (HeapHandle=0x6e0000, Flags=0x0, MemoryPointer=0x6e0628) returned 0x112
	[0163.680] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0163.680] GetProcessHeap () returned 0x6e0000
	[0163.680] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0xe0) returned 0x6eb0d8
	[0163.682] GetProcessHeap () returned 0x6e0000
	[0163.682] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6eb0d8, Size=0x76) returned 0x6eb0d8
	[0163.682] GetProcessHeap () returned 0x6e0000
	[0163.682] RtlSizeHeap (HeapHandle=0x6e0000, Flags=0x0, MemoryPointer=0x6eb0d8) returned 0x76
	[0163.682] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0163.682] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0163.683] GetLastError () returned 0x2
	[0163.683] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0163.683] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x6eb158
	[0163.683] GetProcessHeap () returned 0x6e0000
	[0163.683] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x0, Size=0x14) returned 0x6e74e0
	[0163.683] FindClose (in: hFindFile=0x6eb158 | out: hFindFile=0x6eb158) returned 1
	[0163.683] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0163.684] GetLastError () returned 0x2
	[0163.684] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x6eb158
	[0163.684] GetProcessHeap () returned 0x6e0000
	[0163.684] RtlReAllocateHeap (Heap=0x6e0000, Flags=0x0, Ptr=0x6e74e0, Size=0x4) returned 0x6eb198
	[0163.684] FindClose (in: hFindFile=0x6eb158 | out: hFindFile=0x6eb158) returned 1
	[0163.684] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0163.684] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0163.684] GetConsoleTitleW (in: lpConsoleTitle=0x19f7fc, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0163.687] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f728, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f70c | out: lpAttributeList=0x19f728, lpSize=0x19f70c) returned 1
	[0163.687] UpdateProcThreadAttribute (in: lpAttributeList=0x19f728, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f714, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f728, lpPreviousValue=0x0) returned 1
	[0163.687] GetStartupInfoW (in: lpStartupInfo=0x19f760 | out: lpStartupInfo=0x19f760*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x140, hStdOutput=0x144, hStdError=0x150)) 
	[0163.687] GetProcessHeap () returned 0x6e0000
	[0163.687] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0x18) returned 0x6e7780
	[0163.687] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0163.687] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0163.687] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0163.687] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0163.687] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0163.688] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0163.688] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0163.688] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0163.688] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0163.688] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0163.688] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0163.688] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0163.688] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0163.688] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0163.688] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0163.688] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0163.688] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0163.688] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0163.688] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0163.688] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0163.688] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0163.688] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0163.688] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0163.688] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0163.688] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0163.689] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0163.689] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0163.689] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0163.689] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0163.689] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0163.689] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0163.689] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0163.689] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0163.689] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0163.689] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0163.689] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0163.689] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0163.689] GetProcessHeap () returned 0x6e0000
	[0163.689] RtlFreeHeap (HeapHandle=0x6e0000, Flags=0x0, BaseAddress=0x6e7780) returned 1
	[0163.689] GetProcessHeap () returned 0x6e0000
	[0163.689] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0xa) returned 0x6eb158
	[0163.689] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1
	[0163.693] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill  /f /im sqbcoreservice.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x19f6b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill  /f /im sqbcoreservice.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f6fc | out: lpCommandLine="taskkill  /f /im sqbcoreservice.exe ", lpProcessInformation=0x19f6fc*(hProcess=0x9c, hThread=0x98, dwProcessId=0x126c, dwThreadId=0x1254)) returned 1
	[0163.718] CloseHandle (hObject=0x98) returned 1
	[0163.718] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0163.718] GetProcessHeap () returned 0x6e0000
	[0163.719] RtlFreeHeap (HeapHandle=0x6e0000, Flags=0x0, BaseAddress=0x6e9d68) returned 1
	[0163.719] GetEnvironmentStringsW () returned 0x6e9d68*
	[0163.719] GetProcessHeap () returned 0x6e0000
	[0163.719] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0xa76) returned 0x6e7cd8
	[0163.719] FreeEnvironmentStringsA (penv="=") returned 1
	[0163.719] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0
	[0164.697] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x19f694 | out: lpExitCode=0x19f694*=0x80) returned 1
	[0164.697] CloseHandle (hObject=0x9c) returned 1
	[0164.698] _vsnwprintf (in: _Buffer=0x19f77c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f69c | out: _Buffer="00000080") returned 8
	[0164.698] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1
	[0164.698] GetProcessHeap () returned 0x6e0000
	[0164.698] RtlFreeHeap (HeapHandle=0x6e0000, Flags=0x0, BaseAddress=0x6e7cd8) returned 1
	[0164.698] GetEnvironmentStringsW () returned 0x6eb1a8*
	[0164.699] GetProcessHeap () returned 0x6e0000
	[0164.699] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0xa9c) returned 0x6e7cd8
	[0164.699] FreeEnvironmentStringsA (penv="=") returned 1
	[0164.699] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0164.699] GetProcessHeap () returned 0x6e0000
	[0164.699] RtlFreeHeap (HeapHandle=0x6e0000, Flags=0x0, BaseAddress=0x6e7cd8) returned 1
	[0164.699] GetEnvironmentStringsW () returned 0x6eb1a8*
	[0164.699] GetProcessHeap () returned 0x6e0000
	[0164.699] RtlAllocateHeap (HeapHandle=0x6e0000, Flags=0x8, Size=0xa9c) returned 0x6e7cd8
	[0164.699] FreeEnvironmentStringsA (penv="=") returned 1
	[0164.699] GetProcessHeap () returned 0x6e0000
	[0164.699] RtlFreeHeap (HeapHandle=0x6e0000, Flags=0x0, BaseAddress=0x6eb158) returned 1
	[0164.699] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f728 | out: lpAttributeList=0x19f728) 
	[0164.700] _get_osfhandle (_FileHandle=1) returned 0x144
	[0164.700] SetConsoleMode (hConsoleHandle=0x144, dwMode=0x0) returned 0
	[0164.700] _get_osfhandle (_FileHandle=1) returned 0x144
	[0164.700] GetConsoleMode (in: hConsoleHandle=0x144, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0164.700] _get_osfhandle (_FileHandle=0) returned 0x140
	[0164.700] GetConsoleMode (in: hConsoleHandle=0x140, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0164.700] GetConsoleOutputCP () returned 0x1b5
	[0164.701] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0164.702] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0164.702] exit (_Code=128) 

Thread:
	id = 285
	os_tid = 0x138c


Process:
	id = "52"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\syswow64\\taskkill.exe"
	page_root = "0x35410000"
	os_pid = "0x126c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "51"
	os_parent_pid = "0xc68"
	cmd_line = "taskkill  /f /im sqbcoreservice.exe "
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 3862
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 3863
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 3864
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 3865
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 3866
	        start_va = 0xa0000
	          end_va = 0xdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 3867
	        start_va = 0xe0000
	          end_va = 0xe3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 3868
	        start_va = 0xf0000
	          end_va = 0xf0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 3869
	        start_va = 0x100000
	          end_va = 0x101fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 3870
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 3871
	        start_va = 0x13b0000
	          end_va = 0x13c5fff
	       monitored = 0
	     entry_point = 0x13bde80
	     region_type = mapped_file
	            name = "taskkill.exe"
	        filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe")

Region:
	              id = 3872
	        start_va = 0x13d0000
	          end_va = 0x53cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000013d0000"
	        filename = ""

Region:
	              id = 3873
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 3874
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 3875
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 3876
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 3877
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 3878
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 3879
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 3880
	        start_va = 0x5e0000
	          end_va = 0x5effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005e0000"
	        filename = ""

Region:
	              id = 3881
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 3882
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 3883
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 3884
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 3885
	        start_va = 0x400000
	          end_va = 0x5bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 3886
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 3887
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 3888
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 3889
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 3890
	        start_va = 0x110000
	          end_va = 0x1cdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 3891
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 3892
	        start_va = 0x74650000
	          end_va = 0x746cafff
	       monitored = 0
	     entry_point = 0x7466e970
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 3893
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 3894
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 3895
	        start_va = 0x440000
	          end_va = 0x47ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000440000"
	        filename = ""

Region:
	              id = 3896
	        start_va = 0x4c0000
	          end_va = 0x5bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004c0000"
	        filename = ""

Region:
	              id = 3897
	        start_va = 0x76ae0000
	          end_va = 0x76b23fff
	       monitored = 0
	     entry_point = 0x76af9d80
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 3898
	        start_va = 0x75260000
	          end_va = 0x7530cfff
	       monitored = 0
	     entry_point = 0x75274f00
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 3899
	        start_va = 0x74450000
	          end_va = 0x7446dfff
	       monitored = 0
	     entry_point = 0x7445b640
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 3900
	        start_va = 0x74440000
	          end_va = 0x74449fff
	       monitored = 0
	     entry_point = 0x74442a00
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 3901
	        start_va = 0x74590000
	          end_va = 0x745e7fff
	       monitored = 0
	     entry_point = 0x745d25c0
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 3902
	        start_va = 0x77450000
	          end_va = 0x77596fff
	       monitored = 0
	     entry_point = 0x77461cf0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 3903
	        start_va = 0x76b30000
	          end_va = 0x76c7efff
	       monitored = 0
	     entry_point = 0x76be6820
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 3904
	        start_va = 0x753c0000
	          end_va = 0x75451fff
	       monitored = 0
	     entry_point = 0x753f8cf0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 3905
	        start_va = 0x77290000
	          end_va = 0x7744cfff
	       monitored = 0
	     entry_point = 0x77372a10
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")

Region:
	              id = 3906
	        start_va = 0x75310000
	          end_va = 0x7536efff
	       monitored = 0
	     entry_point = 0x75314af0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 3907
	        start_va = 0x77240000
	          end_va = 0x77284fff
	       monitored = 0
	     entry_point = 0x7725de90
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 3908
	        start_va = 0x6cc90000
	          end_va = 0x6cc97fff
	       monitored = 0
	     entry_point = 0x6cc917b0
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 3909
	        start_va = 0x6cc70000
	          end_va = 0x6cc85fff
	       monitored = 0
	     entry_point = 0x6cc721d0
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")

Region:
	              id = 3910
	        start_va = 0x6caf0000
	          end_va = 0x6cc2efff
	       monitored = 0
	     entry_point = 0x6cb1d880
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll")

Region:
	              id = 3911
	        start_va = 0x6cad0000
	          end_va = 0x6caebfff
	       monitored = 0
	     entry_point = 0x6cad4720
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")

Region:
	              id = 3912
	        start_va = 0x6cac0000
	          end_va = 0x6cac9fff
	       monitored = 0
	     entry_point = 0x6cac28d0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")

Region:
	              id = 3913
	        start_va = 0x6cc30000
	          end_va = 0x6cc6efff
	       monitored = 0
	     entry_point = 0x6cc446c0
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll")

Region:
	              id = 3914
	        start_va = 0x5f0000
	          end_va = 0x7effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005f0000"
	        filename = ""

Region:
	              id = 3915
	        start_va = 0x1d0000
	          end_va = 0x1f9fff
	       monitored = 0
	     entry_point = 0x1d5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 3916
	        start_va = 0x5f0000
	          end_va = 0x777fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000005f0000"
	        filename = ""

Region:
	              id = 3917
	        start_va = 0x7e0000
	          end_va = 0x7effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000007e0000"
	        filename = ""

Region:
	              id = 3918
	        start_va = 0x74ea0000
	          end_va = 0x74ecafff
	       monitored = 0
	     entry_point = 0x74ea5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 3919
	        start_va = 0x7f0000
	          end_va = 0x970fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000007f0000"
	        filename = ""

Region:
	              id = 3920
	        start_va = 0x53d0000
	          end_va = 0x67cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000053d0000"
	        filename = ""

Region:
	              id = 3921
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 3922
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001d0000"
	        filename = ""

Region:
	              id = 3923
	        start_va = 0x1e0000
	          end_va = 0x1e4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taskkill.exe.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui")

Region:
	              id = 3924
	        start_va = 0x1f0000
	          end_va = 0x1f0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001f0000"
	        filename = ""

Region:
	              id = 3925
	        start_va = 0x480000
	          end_va = 0x480fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 3926
	        start_va = 0x980000
	          end_va = 0xcb6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 3927
	        start_va = 0xcc0000
	          end_va = 0xda9fff
	       monitored = 0
	     entry_point = 0xcfd650
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 3928
	        start_va = 0x490000
	          end_va = 0x493fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000490000"
	        filename = ""

Region:
	              id = 3929
	        start_va = 0xcc0000
	          end_va = 0xd9ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 3930
	        start_va = 0x76e20000
	          end_va = 0x76e2bfff
	       monitored = 0
	     entry_point = 0x76e23930
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")

Region:
	              id = 3931
	        start_va = 0x4a0000
	          end_va = 0x4a0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004a0000"
	        filename = ""

Region:
	              id = 3932
	        start_va = 0x76c80000
	          end_va = 0x76d03fff
	       monitored = 0
	     entry_point = 0x76ca6220
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 3933
	        start_va = 0x4b0000
	          end_va = 0x4b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004b0000"
	        filename = ""

Region:
	              id = 3934
	        start_va = 0x6cab0000
	          end_va = 0x6cabcfff
	       monitored = 0
	     entry_point = 0x6cab3520
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 3935
	        start_va = 0x6ca40000
	          end_va = 0x6caa6fff
	       monitored = 0
	     entry_point = 0x6ca5b610
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 3936
	        start_va = 0x740f0000
	          end_va = 0x7410afff
	       monitored = 0
	     entry_point = 0x740f9050
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 3937
	        start_va = 0x6c9f0000
	          end_va = 0x6ca33fff
	       monitored = 0
	     entry_point = 0x6ca0aaf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")

Region:
	              id = 3938
	        start_va = 0x780000
	          end_va = 0x7bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000780000"
	        filename = ""

Region:
	              id = 3939
	        start_va = 0xda0000
	          end_va = 0xddffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000da0000"
	        filename = ""

Region:
	              id = 3940
	        start_va = 0xde0000
	          end_va = 0xe1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000de0000"
	        filename = ""

Region:
	              id = 3941
	        start_va = 0xe20000
	          end_va = 0xe5ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e20000"
	        filename = ""

Region:
	              id = 3942
	        start_va = 0xe60000
	          end_va = 0xe9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e60000"
	        filename = ""

Region:
	              id = 3943
	        start_va = 0xea0000
	          end_va = 0xedffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ea0000"
	        filename = ""

Region:
	              id = 3944
	        start_va = 0x6c9d0000
	          end_va = 0x6c9e0fff
	       monitored = 0
	     entry_point = 0x6c9d8fa0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 3945
	        start_va = 0x6c910000
	          end_va = 0x6c9cefff
	       monitored = 0
	     entry_point = 0x6c941e80
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 3947
	        start_va = 0x5c0000
	          end_va = 0x5c5fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000005c0000"
	        filename = ""


Thread:
	id = 286
	os_tid = 0x1254


Thread:
	id = 287
	os_tid = 0x13d0


Thread:
	id = 288
	os_tid = 0x13d4


Thread:
	id = 289
	os_tid = 0x844


Thread:
	id = 290
	os_tid = 0x1250


Process:
	id = "53"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x31bd0000"
	os_pid = "0xb0c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x614"
	cmd_line = "cmd.exe /c \"taskkill /f /im excel.exe \""
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 3950
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 3951
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 3952
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 3953
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 3954
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 3955
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 3956
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 3957
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 3958
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 3959
	        start_va = 0x13a0000
	          end_va = 0x13f1fff
	       monitored = 1
	     entry_point = 0x13b4fd0
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")

Region:
	              id = 3960
	        start_va = 0x1400000
	          end_va = 0x53fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001400000"
	        filename = ""

Region:
	              id = 3961
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 3962
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 3963
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 3964
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 3965
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 3966
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 3967
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 3968
	        start_va = 0x1d0000
	          end_va = 0x1dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001d0000"
	        filename = ""

Region:
	              id = 3969
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 3970
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 3971
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 3972
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 3973
	        start_va = 0x400000
	          end_va = 0x61ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 3974
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 3975
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 3976
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 3977
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 3978
	        start_va = 0x400000
	          end_va = 0x4bdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 3979
	        start_va = 0x520000
	          end_va = 0x61ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000520000"
	        filename = ""

Region:
	              id = 3980
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 3981
	        start_va = 0x4c0000
	          end_va = 0x4fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004c0000"
	        filename = ""

Region:
	              id = 3982
	        start_va = 0x620000
	          end_va = 0x71ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000620000"
	        filename = ""

Region:
	              id = 3983
	        start_va = 0x720000
	          end_va = 0x7bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000720000"
	        filename = ""

Region:
	              id = 3984
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 3985
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 3986
	        start_va = 0x7c0000
	          end_va = 0xaf6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 291
	os_tid = 0x884

	[0165.901] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000
	[0165.901] __set_app_type (_Type=0x1) 
	[0165.901] __p__fmode () returned 0x74974d6c
	[0165.901] __p__commode () returned 0x74975b1c
	[0165.901] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13b5200) returned 0x0
	[0165.901] __getmainargs (in: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0, _DoWildCard=0, _StartInfo=0x13c60fc | out: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0) returned 0
	[0165.902] GetCurrentThreadId () returned 0x884
	[0165.902] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x884) returned 0x78
	[0165.902] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0165.902] GetProcAddress (hModule=0x75600000, lpProcName="SetThreadUILanguage") returned 0x75642510
	[0165.902] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0165.911] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0165.911] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2
	[0165.911] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0165.911] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0165.911] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0165.911] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0165.911] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0165.912] GetConsoleOutputCP () returned 0x1b5
	[0165.913] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0165.913] SetConsoleCtrlHandler (HandlerRoutine=0x13c0e40, Add=1) returned 1
	[0165.913] _get_osfhandle (_FileHandle=1) returned 0x140
	[0165.913] SetConsoleMode (hConsoleHandle=0x140, dwMode=0x0) returned 0
	[0165.913] _get_osfhandle (_FileHandle=1) returned 0x140
	[0165.914] GetConsoleMode (in: hConsoleHandle=0x140, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0165.914] _get_osfhandle (_FileHandle=0) returned 0x13c
	[0165.914] GetConsoleMode (in: hConsoleHandle=0x13c, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0165.914] GetEnvironmentStringsW () returned 0x527fd0*
	[0165.914] GetProcessHeap () returned 0x520000
	[0165.914] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xa1a) returned 0x5289f8
	[0165.914] FreeEnvironmentStringsA (penv="A") returned 1
	[0165.914] GetProcessHeap () returned 0x520000
	[0165.914] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x4) returned 0x527e58
	[0165.914] GetEnvironmentStringsW () returned 0x527fd0*
	[0165.914] GetProcessHeap () returned 0x520000
	[0165.914] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xa1a) returned 0x529420
	[0165.914] FreeEnvironmentStringsA (penv="A") returned 1
	[0165.914] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0165.914] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0165.914] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0165.914] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0165.915] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0165.915] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0165.915] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0165.915] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0165.915] RegCloseKey (hKey=0x88) returned 0x0
	[0165.915] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0165.915] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0165.915] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0165.915] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0165.915] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0165.915] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0165.915] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0165.915] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0165.915] RegCloseKey (hKey=0x88) returned 0x0
	[0165.915] time (in: timer=0x0 | out: timer=0x0) returned 0x62344230
	[0165.915] srand (_Seed=0x62344230) 
	[0165.915] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im excel.exe \""
	[0165.915] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im excel.exe \""
	[0165.915] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0165.916] GetProcessHeap () returned 0x520000
	[0165.916] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x210) returned 0x526f88
	[0165.916] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x526f90, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0165.916] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0165.916] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0165.916] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0165.916] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0165.916] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0165.916] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0165.916] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0165.916] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0165.916] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0165.916] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0165.916] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0165.917] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0165.917] GetProcessHeap () returned 0x520000
	[0165.917] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x5289f8) returned 1
	[0165.917] GetEnvironmentStringsW () returned 0x527fd0*
	[0165.917] GetProcessHeap () returned 0x520000
	[0165.917] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xa32) returned 0x52a888
	[0165.918] FreeEnvironmentStringsA (penv="A") returned 1
	[0165.918] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b
	[0165.918] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0165.918] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0165.918] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0165.918] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0165.918] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0165.918] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0165.918] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0165.918] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0165.918] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0165.918] GetProcessHeap () returned 0x520000
	[0165.918] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x44) returned 0x5271a0
	[0165.918] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0165.918] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19fc4c*="Desktop") returned 0x1d
	[0165.919] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0165.919] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x5271f0
	[0165.919] FindClose (in: hFindFile=0x5271f0 | out: hFindFile=0x5271f0) returned 1
	[0165.919] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x5271f0
	[0165.919] FindClose (in: hFindFile=0x5271f0 | out: hFindFile=0x5271f0) returned 1
	[0165.919] _wcsnicmp (_String1="RDHJ0C~1", _String2="RDhJ0CNFevzX", _MaxCount=0xc) returned 16
	[0165.919] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x5271f0
	[0165.920] FindClose (in: hFindFile=0x5271f0 | out: hFindFile=0x5271f0) returned 1
	[0165.920] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0165.920] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1
	[0165.920] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 1
	[0165.920] GetProcessHeap () returned 0x520000
	[0165.920] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x52a888) returned 1
	[0165.920] GetEnvironmentStringsW () returned 0x527fd0*
	[0165.921] GetProcessHeap () returned 0x520000
	[0165.921] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xa76) returned 0x529e48
	[0165.921] FreeEnvironmentStringsA (penv="=") returned 1
	[0165.921] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0165.921] GetProcessHeap () returned 0x520000
	[0165.921] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x5271a0) returned 1
	[0165.921] GetProcessHeap () returned 0x520000
	[0165.921] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x400e) returned 0x52bd48
	[0165.922] GetProcessHeap () returned 0x520000
	[0165.922] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x46) returned 0x5271a0
	[0165.922] GetProcessHeap () returned 0x520000
	[0165.922] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x4008) returned 0x52fd60
	[0165.922] GetProcessHeap () returned 0x520000
	[0165.922] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x4008) returned 0x533d70
	[0165.923] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0165.924] GetProcessHeap () returned 0x520000
	[0165.924] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x418) returned 0x52a8c8
	[0165.924] SetErrorMode (uMode=0x0) returned 0x8003
	[0165.924] SetErrorMode (uMode=0x1) returned 0x0
	[0165.924] GetFullPathNameW (in: lpFileName="taskkill \\f \\.", nBufferLength=0x208, lpBuffer=0x52a8d0, lpFilePart=0x19fbac | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f", lpFilePart=0x19fbac*="f") returned 0x29
	[0165.924] SetErrorMode (uMode=0x8003) returned 0x1
	[0165.924] GetProcessHeap () returned 0x520000
	[0165.924] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x52a8c8, Size=0x78) returned 0x52a8c8
	[0165.924] GetProcessHeap () returned 0x520000
	[0165.924] RtlSizeHeap (HeapHandle=0x520000, Flags=0x0, MemoryPointer=0x52a8c8) returned 0x78
	[0165.924] NeedCurrentDirectoryForExePathW (ExeName="taskkill \\f \\.") returned 1
	[0165.924] GetProcessHeap () returned 0x520000
	[0165.924] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x62) returned 0x5271f0
	[0165.924] GetProcessHeap () returned 0x520000
	[0165.924] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xb8) returned 0x52a948
	[0165.925] GetProcessHeap () returned 0x520000
	[0165.925] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x52a948, Size=0x62) returned 0x52a948
	[0165.925] GetProcessHeap () returned 0x520000
	[0165.925] RtlSizeHeap (HeapHandle=0x520000, Flags=0x0, MemoryPointer=0x52a948) returned 0x62
	[0165.925] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0165.925] GetProcessHeap () returned 0x520000
	[0165.925] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xe0) returned 0x52a9b8
	[0165.929] GetProcessHeap () returned 0x520000
	[0165.929] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x52a9b8, Size=0x76) returned 0x52a9b8
	[0165.929] GetProcessHeap () returned 0x520000
	[0165.929] RtlSizeHeap (HeapHandle=0x520000, Flags=0x0, MemoryPointer=0x52a9b8) returned 0x76
	[0165.929] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0165.929] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f\\im excel.exe ", fInfoLevelId=0x1, lpFindFileData=0x19f958, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f958) returned 0xffffffff
	[0165.930] GetLastError () returned 0x3
	[0165.930] GetProcessHeap () returned 0x520000
	[0165.930] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x52fd60) returned 1
	[0165.930] GetProcessHeap () returned 0x520000
	[0165.931] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x533d70) returned 1
	[0165.931] GetProcessHeap () returned 0x520000
	[0165.931] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x52bd48) returned 1
	[0165.931] GetConsoleOutputCP () returned 0x1b5
	[0165.932] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0165.932] GetUserDefaultLCID () returned 0x409
	[0165.933] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x13d34a0, cchData=8 | out: lpLCData=":") returned 2
	[0165.933] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0165.933] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0165.933] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2
	[0165.933] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x13d34b0, cchData=8 | out: lpLCData="/") returned 2
	[0165.933] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x13d3500, cchData=32 | out: lpLCData="Mon") returned 4
	[0165.933] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x13d3540, cchData=32 | out: lpLCData="Tue") returned 4
	[0165.933] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x13d3580, cchData=32 | out: lpLCData="Wed") returned 4
	[0165.933] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x13d35c0, cchData=32 | out: lpLCData="Thu") returned 4
	[0165.933] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x13d3600, cchData=32 | out: lpLCData="Fri") returned 4
	[0165.933] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x13d3640, cchData=32 | out: lpLCData="Sat") returned 4
	[0165.933] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x13d3680, cchData=32 | out: lpLCData="Sun") returned 4
	[0165.933] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x13d34c0, cchData=8 | out: lpLCData=".") returned 2
	[0165.933] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x13d34e0, cchData=8 | out: lpLCData=",") returned 2
	[0165.934] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0165.935] GetProcessHeap () returned 0x520000
	[0165.935] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x20c) returned 0x52aa80
	[0165.935] GetConsoleTitleW (in: lpConsoleTitle=0x52aa80, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0165.939] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0165.939] GetProcAddress (hModule=0x75600000, lpProcName="CopyFileExW") returned 0x7561ffc0
	[0165.939] GetProcAddress (hModule=0x75600000, lpProcName="IsDebuggerPresent") returned 0x7561b0b0
	[0165.939] GetProcAddress (hModule=0x75600000, lpProcName="SetConsoleInputExeNameW") returned 0x7559b440
	[0165.939] GetProcessHeap () returned 0x520000
	[0165.940] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x400a) returned 0x52bd48
	[0165.940] GetProcessHeap () returned 0x520000
	[0165.940] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x52bd48) returned 1
	[0165.941] _wcsicmp (_String1="taskkill", _String2=")") returned 75
	[0165.941] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14
	[0165.941] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14
	[0165.941] _wcsicmp (_String1="IF", _String2="taskkill") returned -11
	[0165.941] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11
	[0165.941] _wcsicmp (_String1="REM", _String2="taskkill") returned -2
	[0165.941] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2
	[0165.941] GetProcessHeap () returned 0x520000
	[0165.941] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x58) returned 0x52ac98
	[0165.941] GetProcessHeap () returned 0x520000
	[0165.941] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x1a) returned 0x527e80
	[0165.941] GetProcessHeap () returned 0x520000
	[0165.941] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x2e) returned 0x527260
	[0165.942] GetConsoleTitleW (in: lpConsoleTitle=0x19fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0165.946] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0165.946] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0165.946] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0165.946] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0165.946] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0165.946] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0165.946] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0165.946] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0165.946] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0165.946] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0165.946] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0165.946] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0165.946] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0165.946] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0165.946] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0165.946] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0165.946] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0165.946] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0165.946] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0165.946] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0165.946] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0165.946] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0165.946] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0165.946] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0165.946] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0165.946] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0165.946] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0165.946] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0165.947] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0165.947] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0165.947] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0165.947] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0165.947] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0165.947] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0165.947] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0165.947] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0165.947] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0165.947] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0165.947] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0165.947] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0165.947] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0165.947] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0165.947] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0165.947] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0165.947] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0165.947] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0165.947] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0165.947] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0165.947] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0165.947] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0165.947] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0165.947] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0165.947] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0165.947] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0165.948] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0165.948] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0165.948] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0165.948] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0165.948] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0165.948] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0165.948] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0165.948] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0165.948] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0165.948] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0165.948] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0165.948] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0165.948] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0165.948] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0165.948] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0165.948] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0165.948] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0165.948] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0165.948] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0165.948] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0165.948] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0165.948] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0165.948] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0165.948] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0165.948] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0165.948] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0165.948] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0165.948] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0165.948] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0165.948] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0165.949] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14
	[0165.949] _wcsicmp (_String1="taskkill", _String2="IF") returned 11
	[0165.949] _wcsicmp (_String1="taskkill", _String2="REM") returned 2
	[0165.949] GetProcessHeap () returned 0x520000
	[0165.949] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x210) returned 0x52acf8
	[0165.949] GetProcessHeap () returned 0x520000
	[0165.949] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x40) returned 0x52af10
	[0165.949] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0165.950] GetProcessHeap () returned 0x520000
	[0165.950] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x418) returned 0x5205c8
	[0165.950] SetErrorMode (uMode=0x0) returned 0x8003
	[0165.950] SetErrorMode (uMode=0x1) returned 0x0
	[0165.950] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x5205d0, lpFilePart=0x19f57c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19f57c*="Desktop") returned 0x1d
	[0165.950] SetErrorMode (uMode=0x8003) returned 0x1
	[0165.950] GetProcessHeap () returned 0x520000
	[0165.950] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x5205c8, Size=0x56) returned 0x5205c8
	[0165.950] GetProcessHeap () returned 0x520000
	[0165.950] RtlSizeHeap (HeapHandle=0x520000, Flags=0x0, MemoryPointer=0x5205c8) returned 0x56
	[0165.950] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0165.950] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0165.950] GetProcessHeap () returned 0x520000
	[0165.951] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x110) returned 0x52af58
	[0165.951] GetProcessHeap () returned 0x520000
	[0165.951] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x218) returned 0x52b070
	[0165.956] GetProcessHeap () returned 0x520000
	[0165.956] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x52b070, Size=0x112) returned 0x52b070
	[0165.956] GetProcessHeap () returned 0x520000
	[0165.956] RtlSizeHeap (HeapHandle=0x520000, Flags=0x0, MemoryPointer=0x52b070) returned 0x112
	[0165.956] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0165.956] GetProcessHeap () returned 0x520000
	[0165.956] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xe0) returned 0x52b190
	[0165.959] GetProcessHeap () returned 0x520000
	[0165.959] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x52b190, Size=0x76) returned 0x52b190
	[0165.959] GetProcessHeap () returned 0x520000
	[0165.959] RtlSizeHeap (HeapHandle=0x520000, Flags=0x0, MemoryPointer=0x52b190) returned 0x76
	[0165.959] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0165.959] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0165.959] GetLastError () returned 0x2
	[0165.959] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0165.959] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x52b210
	[0165.959] GetProcessHeap () returned 0x520000
	[0165.959] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14) returned 0x527810
	[0165.959] FindClose (in: hFindFile=0x52b210 | out: hFindFile=0x52b210) returned 1
	[0165.960] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0165.960] GetLastError () returned 0x2
	[0165.960] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x52b210
	[0165.960] GetProcessHeap () returned 0x520000
	[0165.960] RtlReAllocateHeap (Heap=0x520000, Flags=0x0, Ptr=0x527810, Size=0x4) returned 0x52b250
	[0165.960] FindClose (in: hFindFile=0x52b210 | out: hFindFile=0x52b210) returned 1
	[0165.960] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0165.960] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0165.960] GetConsoleTitleW (in: lpConsoleTitle=0x19f7fc, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0165.962] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f728, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f70c | out: lpAttributeList=0x19f728, lpSize=0x19f70c) returned 1
	[0165.962] UpdateProcThreadAttribute (in: lpAttributeList=0x19f728, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f714, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f728, lpPreviousValue=0x0) returned 1
	[0165.962] GetStartupInfoW (in: lpStartupInfo=0x19f760 | out: lpStartupInfo=0x19f760*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x13c, hStdOutput=0x140, hStdError=0x144)) 
	[0165.963] GetProcessHeap () returned 0x520000
	[0165.963] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0x18) returned 0x527610
	[0165.963] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0165.963] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0165.963] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0165.963] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0165.963] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0165.963] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0165.963] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0165.963] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0165.963] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0165.963] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0165.963] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0165.963] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0165.963] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0165.963] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0165.963] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0165.963] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0165.963] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0165.963] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0165.963] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0165.963] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0165.963] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0165.963] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0165.963] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0165.963] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0165.963] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0165.963] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0165.964] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0165.964] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0165.964] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0165.964] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0165.964] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0165.964] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0165.964] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0165.964] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0165.964] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0165.964] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0165.964] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0165.964] GetProcessHeap () returned 0x520000
	[0165.964] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x527610) returned 1
	[0165.964] GetProcessHeap () returned 0x520000
	[0165.964] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xa) returned 0x52b210
	[0165.964] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1
	[0165.967] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill  /f /im excel.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x19f6b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill  /f /im excel.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f6fc | out: lpCommandLine="taskkill  /f /im excel.exe ", lpProcessInformation=0x19f6fc*(hProcess=0x9c, hThread=0x98, dwProcessId=0x75c, dwThreadId=0xf90)) returned 1
	[0165.982] CloseHandle (hObject=0x98) returned 1
	[0165.982] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0165.982] GetProcessHeap () returned 0x520000
	[0165.983] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x529e48) returned 1
	[0165.983] GetEnvironmentStringsW () returned 0x529e48*
	[0165.983] GetProcessHeap () returned 0x520000
	[0165.983] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xa76) returned 0x52bd48
	[0165.983] FreeEnvironmentStringsA (penv="=") returned 1
	[0165.983] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0
	[0167.323] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x19f694 | out: lpExitCode=0x19f694*=0x80) returned 1
	[0167.323] CloseHandle (hObject=0x9c) returned 1
	[0167.324] _vsnwprintf (in: _Buffer=0x19f77c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f69c | out: _Buffer="00000080") returned 8
	[0167.324] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1
	[0167.324] GetProcessHeap () returned 0x520000
	[0167.325] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x52bd48) returned 1
	[0167.325] GetEnvironmentStringsW () returned 0x52b260*
	[0167.325] GetProcessHeap () returned 0x520000
	[0167.325] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xa9c) returned 0x52bd08
	[0167.325] FreeEnvironmentStringsA (penv="=") returned 1
	[0167.325] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0167.325] GetProcessHeap () returned 0x520000
	[0167.326] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x52bd08) returned 1
	[0167.326] GetEnvironmentStringsW () returned 0x52b260*
	[0167.326] GetProcessHeap () returned 0x520000
	[0167.326] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x8, Size=0xa9c) returned 0x52bd08
	[0167.326] FreeEnvironmentStringsA (penv="=") returned 1
	[0167.326] GetProcessHeap () returned 0x520000
	[0167.326] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x52b210) returned 1
	[0167.326] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f728 | out: lpAttributeList=0x19f728) 
	[0167.327] _get_osfhandle (_FileHandle=1) returned 0x140
	[0167.327] SetConsoleMode (hConsoleHandle=0x140, dwMode=0x0) returned 0
	[0167.327] _get_osfhandle (_FileHandle=1) returned 0x140
	[0167.327] GetConsoleMode (in: hConsoleHandle=0x140, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0167.327] _get_osfhandle (_FileHandle=0) returned 0x13c
	[0167.327] GetConsoleMode (in: hConsoleHandle=0x13c, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0167.327] GetConsoleOutputCP () returned 0x1b5
	[0167.330] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0167.330] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0167.332] exit (_Code=128) 

Thread:
	id = 292
	os_tid = 0x7a0


Process:
	id = "54"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\syswow64\\taskkill.exe"
	page_root = "0x31ada000"
	os_pid = "0x75c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "53"
	os_parent_pid = "0xb0c"
	cmd_line = "taskkill  /f /im excel.exe "
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 3987
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 3988
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 3989
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 3990
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 3991
	        start_va = 0xa0000
	          end_va = 0xdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 3992
	        start_va = 0xe0000
	          end_va = 0xe3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 3993
	        start_va = 0xf0000
	          end_va = 0xf0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 3994
	        start_va = 0x100000
	          end_va = 0x101fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 3995
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 3996
	        start_va = 0x13b0000
	          end_va = 0x13c5fff
	       monitored = 0
	     entry_point = 0x13bde80
	     region_type = mapped_file
	            name = "taskkill.exe"
	        filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe")

Region:
	              id = 3997
	        start_va = 0x13d0000
	          end_va = 0x53cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000013d0000"
	        filename = ""

Region:
	              id = 3998
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 3999
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 4000
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 4001
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 4002
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 4003
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 4004
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 4005
	        start_va = 0x5b0000
	          end_va = 0x5bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005b0000"
	        filename = ""

Region:
	              id = 4006
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 4007
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 4008
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 4009
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 4010
	        start_va = 0x5c0000
	          end_va = 0x7effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005c0000"
	        filename = ""

Region:
	              id = 4011
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 4012
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 4013
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 4014
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 4015
	        start_va = 0x110000
	          end_va = 0x1cdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 4016
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 4017
	        start_va = 0x74650000
	          end_va = 0x746cafff
	       monitored = 0
	     entry_point = 0x7466e970
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 4018
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 4019
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 4020
	        start_va = 0x440000
	          end_va = 0x47ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000440000"
	        filename = ""

Region:
	              id = 4021
	        start_va = 0x76ae0000
	          end_va = 0x76b23fff
	       monitored = 0
	     entry_point = 0x76af9d80
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 4022
	        start_va = 0x75260000
	          end_va = 0x7530cfff
	       monitored = 0
	     entry_point = 0x75274f00
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 4023
	        start_va = 0x74450000
	          end_va = 0x7446dfff
	       monitored = 0
	     entry_point = 0x7445b640
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 4024
	        start_va = 0x74440000
	          end_va = 0x74449fff
	       monitored = 0
	     entry_point = 0x74442a00
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 4025
	        start_va = 0x74590000
	          end_va = 0x745e7fff
	       monitored = 0
	     entry_point = 0x745d25c0
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 4026
	        start_va = 0x77450000
	          end_va = 0x77596fff
	       monitored = 0
	     entry_point = 0x77461cf0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 4027
	        start_va = 0x76b30000
	          end_va = 0x76c7efff
	       monitored = 0
	     entry_point = 0x76be6820
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 4028
	        start_va = 0x753c0000
	          end_va = 0x75451fff
	       monitored = 0
	     entry_point = 0x753f8cf0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 4029
	        start_va = 0x77290000
	          end_va = 0x7744cfff
	       monitored = 0
	     entry_point = 0x77372a10
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")

Region:
	              id = 4030
	        start_va = 0x75310000
	          end_va = 0x7536efff
	       monitored = 0
	     entry_point = 0x75314af0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 4031
	        start_va = 0x77240000
	          end_va = 0x77284fff
	       monitored = 0
	     entry_point = 0x7725de90
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 4032
	        start_va = 0x6cc90000
	          end_va = 0x6cc97fff
	       monitored = 0
	     entry_point = 0x6cc917b0
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 4033
	        start_va = 0x6cc70000
	          end_va = 0x6cc85fff
	       monitored = 0
	     entry_point = 0x6cc721d0
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")

Region:
	              id = 4034
	        start_va = 0x6cc30000
	          end_va = 0x6cc6efff
	       monitored = 0
	     entry_point = 0x6cc446c0
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll")

Region:
	              id = 4035
	        start_va = 0x6cad0000
	          end_va = 0x6caebfff
	       monitored = 0
	     entry_point = 0x6cad4720
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")

Region:
	              id = 4036
	        start_va = 0x6cac0000
	          end_va = 0x6cac9fff
	       monitored = 0
	     entry_point = 0x6cac28d0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")

Region:
	              id = 4037
	        start_va = 0x6caf0000
	          end_va = 0x6cc2efff
	       monitored = 0
	     entry_point = 0x6cb1d880
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll")

Region:
	              id = 4038
	        start_va = 0x480000
	          end_va = 0x50ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 4039
	        start_va = 0x1d0000
	          end_va = 0x1f9fff
	       monitored = 0
	     entry_point = 0x1d5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 4040
	        start_va = 0x7f0000
	          end_va = 0x977fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000007f0000"
	        filename = ""

Region:
	              id = 4041
	        start_va = 0x74ea0000
	          end_va = 0x74ecafff
	       monitored = 0
	     entry_point = 0x74ea5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 4042
	        start_va = 0x980000
	          end_va = 0xb00fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000980000"
	        filename = ""

Region:
	              id = 4043
	        start_va = 0x53d0000
	          end_va = 0x67cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000053d0000"
	        filename = ""

Region:
	              id = 4044
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 4045
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001d0000"
	        filename = ""

Region:
	              id = 4046
	        start_va = 0x1e0000
	          end_va = 0x1e4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taskkill.exe.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui")

Region:
	              id = 4047
	        start_va = 0x1f0000
	          end_va = 0x1f0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001f0000"
	        filename = ""

Region:
	              id = 4048
	        start_va = 0x480000
	          end_va = 0x480fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 4049
	        start_va = 0x500000
	          end_va = 0x50ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000500000"
	        filename = ""

Region:
	              id = 4050
	        start_va = 0xb10000
	          end_va = 0xe46fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 4051
	        start_va = 0x5c0000
	          end_va = 0x6a9fff
	       monitored = 0
	     entry_point = 0x5fd650
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 4052
	        start_va = 0x6f0000
	          end_va = 0x7effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006f0000"
	        filename = ""

Region:
	              id = 4053
	        start_va = 0x490000
	          end_va = 0x493fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000490000"
	        filename = ""

Region:
	              id = 4054
	        start_va = 0x5c0000
	          end_va = 0x69ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 4055
	        start_va = 0x76e20000
	          end_va = 0x76e2bfff
	       monitored = 0
	     entry_point = 0x76e23930
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")

Region:
	              id = 4056
	        start_va = 0x4a0000
	          end_va = 0x4a0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004a0000"
	        filename = ""

Region:
	              id = 4057
	        start_va = 0x76c80000
	          end_va = 0x76d03fff
	       monitored = 0
	     entry_point = 0x76ca6220
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 4058
	        start_va = 0x4b0000
	          end_va = 0x4b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004b0000"
	        filename = ""

Region:
	              id = 4059
	        start_va = 0x6cab0000
	          end_va = 0x6cabcfff
	       monitored = 0
	     entry_point = 0x6cab3520
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 4060
	        start_va = 0x6ca40000
	          end_va = 0x6caa6fff
	       monitored = 0
	     entry_point = 0x6ca5b610
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 4061
	        start_va = 0x740f0000
	          end_va = 0x7410afff
	       monitored = 0
	     entry_point = 0x740f9050
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 4062
	        start_va = 0x6c9f0000
	          end_va = 0x6ca33fff
	       monitored = 0
	     entry_point = 0x6ca0aaf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")

Region:
	              id = 4063
	        start_va = 0x4c0000
	          end_va = 0x4fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004c0000"
	        filename = ""

Region:
	              id = 4064
	        start_va = 0x510000
	          end_va = 0x54ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000510000"
	        filename = ""

Region:
	              id = 4065
	        start_va = 0x550000
	          end_va = 0x58ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000550000"
	        filename = ""

Region:
	              id = 4066
	        start_va = 0x6a0000
	          end_va = 0x6dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006a0000"
	        filename = ""

Region:
	              id = 4067
	        start_va = 0xe50000
	          end_va = 0xe8ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e50000"
	        filename = ""

Region:
	              id = 4068
	        start_va = 0xe90000
	          end_va = 0xecffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e90000"
	        filename = ""

Region:
	              id = 4069
	        start_va = 0x6c9d0000
	          end_va = 0x6c9e0fff
	       monitored = 0
	     entry_point = 0x6c9d8fa0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 4070
	        start_va = 0x6c910000
	          end_va = 0x6c9cefff
	       monitored = 0
	     entry_point = 0x6c941e80
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 4072
	        start_va = 0x590000
	          end_va = 0x595fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000590000"
	        filename = ""


Thread:
	id = 293
	os_tid = 0xf90


Thread:
	id = 294
	os_tid = 0x968


Thread:
	id = 295
	os_tid = 0xf1c


Thread:
	id = 296
	os_tid = 0xd30


Thread:
	id = 297
	os_tid = 0xb0


Process:
	id = "55"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x610dc000"
	os_pid = "0x81c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x614"
	cmd_line = "cmd.exe /c \"taskkill /f /im infopath.exe \""
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 4075
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 4076
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 4077
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 4078
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 4079
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 4080
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 4081
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 4082
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 4083
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 4084
	        start_va = 0x13a0000
	          end_va = 0x13f1fff
	       monitored = 1
	     entry_point = 0x13b4fd0
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")

Region:
	              id = 4085
	        start_va = 0x1400000
	          end_va = 0x53fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001400000"
	        filename = ""

Region:
	              id = 4086
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 4087
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 4088
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 4089
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 4090
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 4091
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 4092
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 4093
	        start_va = 0x590000
	          end_va = 0x59ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000590000"
	        filename = ""

Region:
	              id = 4094
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 4095
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 4096
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 4097
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 4098
	        start_va = 0x5a0000
	          end_va = 0x74ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005a0000"
	        filename = ""

Region:
	              id = 4099
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 4100
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 4101
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 4102
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 4103
	        start_va = 0x400000
	          end_va = 0x4bdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 4104
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 4105
	        start_va = 0x4c0000
	          end_va = 0x4fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004c0000"
	        filename = ""

Region:
	              id = 4106
	        start_va = 0x750000
	          end_va = 0x84ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000750000"
	        filename = ""

Region:
	              id = 4107
	        start_va = 0x850000
	          end_va = 0x95ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000850000"
	        filename = ""

Region:
	              id = 4108
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 4109
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 4110
	        start_va = 0x960000
	          end_va = 0xc96fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 298
	os_tid = 0xd2c

	[0173.044] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000
	[0173.044] __set_app_type (_Type=0x1) 
	[0173.044] __p__fmode () returned 0x74974d6c
	[0173.044] __p__commode () returned 0x74975b1c
	[0173.045] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13b5200) returned 0x0
	[0173.045] __getmainargs (in: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0, _DoWildCard=0, _StartInfo=0x13c60fc | out: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0) returned 0
	[0173.045] GetCurrentThreadId () returned 0xd2c
	[0173.045] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xd2c) returned 0x78
	[0173.046] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0173.046] GetProcAddress (hModule=0x75600000, lpProcName="SetThreadUILanguage") returned 0x75642510
	[0173.046] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0173.058] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0173.059] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2
	[0173.059] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0173.059] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0173.060] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0173.060] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0173.060] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0173.060] GetConsoleOutputCP () returned 0x1b5
	[0173.063] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0173.064] SetConsoleCtrlHandler (HandlerRoutine=0x13c0e40, Add=1) returned 1
	[0173.064] _get_osfhandle (_FileHandle=1) returned 0x13c
	[0173.064] SetConsoleMode (hConsoleHandle=0x13c, dwMode=0x0) returned 0
	[0173.064] _get_osfhandle (_FileHandle=1) returned 0x13c
	[0173.064] GetConsoleMode (in: hConsoleHandle=0x13c, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0173.065] _get_osfhandle (_FileHandle=0) returned 0x130
	[0173.065] GetConsoleMode (in: hConsoleHandle=0x130, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0173.065] GetEnvironmentStringsW () returned 0x657cc0*
	[0173.065] GetProcessHeap () returned 0x650000
	[0173.065] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0xa1a) returned 0x6586e8
	[0173.066] FreeEnvironmentStringsA (penv="A") returned 1
	[0173.066] GetProcessHeap () returned 0x650000
	[0173.066] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x4) returned 0x650550
	[0173.066] GetEnvironmentStringsW () returned 0x657cc0*
	[0173.066] GetProcessHeap () returned 0x650000
	[0173.066] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0xa1a) returned 0x659110
	[0173.066] FreeEnvironmentStringsA (penv="A") returned 1
	[0173.066] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0173.066] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0173.066] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0173.067] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0173.067] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0173.067] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0173.067] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0173.067] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0173.067] RegCloseKey (hKey=0x88) returned 0x0
	[0173.067] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0173.067] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0173.068] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0173.068] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0173.068] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0173.068] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0173.068] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0173.068] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0173.068] RegCloseKey (hKey=0x88) returned 0x0
	[0173.068] time (in: timer=0x0 | out: timer=0x0) returned 0x62344237
	[0173.068] srand (_Seed=0x62344237) 
	[0173.068] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im infopath.exe \""
	[0173.068] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im infopath.exe \""
	[0173.069] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0173.069] GetProcessHeap () returned 0x650000
	[0173.069] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x210) returned 0x659b38
	[0173.069] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x659b40, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0173.070] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0173.070] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0173.070] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0173.070] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0173.070] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0173.070] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0173.070] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0173.070] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0173.070] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0173.070] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0173.070] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0173.070] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0173.071] GetProcessHeap () returned 0x650000
	[0173.072] RtlFreeHeap (HeapHandle=0x650000, Flags=0x0, BaseAddress=0x6586e8) returned 1
	[0173.072] GetEnvironmentStringsW () returned 0x657cc0*
	[0173.072] GetProcessHeap () returned 0x650000
	[0173.072] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0xa32) returned 0x65a790
	[0173.072] FreeEnvironmentStringsA (penv="A") returned 1
	[0173.072] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b
	[0173.072] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0173.072] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0173.072] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0173.072] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0173.072] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0173.073] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0173.073] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0173.073] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0173.073] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0173.073] GetProcessHeap () returned 0x650000
	[0173.074] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x44) returned 0x6505c8
	[0173.074] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0173.074] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19fc4c*="Desktop") returned 0x1d
	[0173.074] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0173.074] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x650618
	[0173.074] FindClose (in: hFindFile=0x650618 | out: hFindFile=0x650618) returned 1
	[0173.075] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x650618
	[0173.075] FindClose (in: hFindFile=0x650618 | out: hFindFile=0x650618) returned 1
	[0173.075] _wcsnicmp (_String1="RDHJ0C~1", _String2="RDhJ0CNFevzX", _MaxCount=0xc) returned 16
	[0173.075] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x650618
	[0173.075] FindClose (in: hFindFile=0x650618 | out: hFindFile=0x650618) returned 1
	[0173.075] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0173.075] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1
	[0173.076] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 1
	[0173.076] GetProcessHeap () returned 0x650000
	[0173.076] RtlFreeHeap (HeapHandle=0x650000, Flags=0x0, BaseAddress=0x65a790) returned 1
	[0173.076] GetEnvironmentStringsW () returned 0x657cc0*
	[0173.076] GetProcessHeap () returned 0x650000
	[0173.076] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0xa76) returned 0x659d50
	[0173.077] FreeEnvironmentStringsA (penv="=") returned 1
	[0173.077] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0173.077] GetProcessHeap () returned 0x650000
	[0173.077] RtlFreeHeap (HeapHandle=0x650000, Flags=0x0, BaseAddress=0x6505c8) returned 1
	[0173.077] GetProcessHeap () returned 0x650000
	[0173.077] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x400e) returned 0x65bc50
	[0173.078] GetProcessHeap () returned 0x650000
	[0173.078] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x4c) returned 0x65a7d0
	[0173.079] GetProcessHeap () returned 0x650000
	[0173.079] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x4008) returned 0x65fc68
	[0173.079] GetProcessHeap () returned 0x650000
	[0173.079] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x4008) returned 0x663c78
	[0173.081] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0173.082] GetProcessHeap () returned 0x650000
	[0173.082] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x418) returned 0x65a828
	[0173.082] SetErrorMode (uMode=0x0) returned 0x8003
	[0173.082] SetErrorMode (uMode=0x1) returned 0x0
	[0173.082] GetFullPathNameW (in: lpFileName="taskkill \\f \\.", nBufferLength=0x208, lpBuffer=0x65a830, lpFilePart=0x19fbac | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f", lpFilePart=0x19fbac*="f") returned 0x29
	[0173.082] SetErrorMode (uMode=0x8003) returned 0x1
	[0173.082] GetProcessHeap () returned 0x650000
	[0173.083] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x65a828, Size=0x7e) returned 0x65a828
	[0173.083] GetProcessHeap () returned 0x650000
	[0173.083] RtlSizeHeap (HeapHandle=0x650000, Flags=0x0, MemoryPointer=0x65a828) returned 0x7e
	[0173.083] NeedCurrentDirectoryForExePathW (ExeName="taskkill \\f \\.") returned 1
	[0173.083] GetProcessHeap () returned 0x650000
	[0173.083] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x62) returned 0x65a8b0
	[0173.083] GetProcessHeap () returned 0x650000
	[0173.083] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0xb8) returned 0x65a920
	[0173.083] GetProcessHeap () returned 0x650000
	[0173.083] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x65a920, Size=0x62) returned 0x65a920
	[0173.083] GetProcessHeap () returned 0x650000
	[0173.083] RtlSizeHeap (HeapHandle=0x650000, Flags=0x0, MemoryPointer=0x65a920) returned 0x62
	[0173.083] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0173.084] GetProcessHeap () returned 0x650000
	[0173.084] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0xe0) returned 0x65a990
	[0173.088] GetProcessHeap () returned 0x650000
	[0173.088] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x65a990, Size=0x76) returned 0x65a990
	[0173.088] GetProcessHeap () returned 0x650000
	[0173.088] RtlSizeHeap (HeapHandle=0x650000, Flags=0x0, MemoryPointer=0x65a990) returned 0x76
	[0173.088] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0173.088] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f\\im infopath.exe ", fInfoLevelId=0x1, lpFindFileData=0x19f958, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f958) returned 0xffffffff
	[0173.089] GetLastError () returned 0x3
	[0173.089] GetProcessHeap () returned 0x650000
	[0173.089] RtlFreeHeap (HeapHandle=0x650000, Flags=0x0, BaseAddress=0x65fc68) returned 1
	[0173.089] GetProcessHeap () returned 0x650000
	[0173.090] RtlFreeHeap (HeapHandle=0x650000, Flags=0x0, BaseAddress=0x663c78) returned 1
	[0173.090] GetProcessHeap () returned 0x650000
	[0173.090] RtlFreeHeap (HeapHandle=0x650000, Flags=0x0, BaseAddress=0x65bc50) returned 1
	[0173.090] GetConsoleOutputCP () returned 0x1b5
	[0173.091] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0173.091] GetUserDefaultLCID () returned 0x409
	[0173.092] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x13d34a0, cchData=8 | out: lpLCData=":") returned 2
	[0173.092] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0173.092] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0173.092] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2
	[0173.092] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x13d34b0, cchData=8 | out: lpLCData="/") returned 2
	[0173.092] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x13d3500, cchData=32 | out: lpLCData="Mon") returned 4
	[0173.092] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x13d3540, cchData=32 | out: lpLCData="Tue") returned 4
	[0173.092] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x13d3580, cchData=32 | out: lpLCData="Wed") returned 4
	[0173.092] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x13d35c0, cchData=32 | out: lpLCData="Thu") returned 4
	[0173.092] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x13d3600, cchData=32 | out: lpLCData="Fri") returned 4
	[0173.092] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x13d3640, cchData=32 | out: lpLCData="Sat") returned 4
	[0173.092] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x13d3680, cchData=32 | out: lpLCData="Sun") returned 4
	[0173.092] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x13d34c0, cchData=8 | out: lpLCData=".") returned 2
	[0173.092] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x13d34e0, cchData=8 | out: lpLCData=",") returned 2
	[0173.092] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0173.095] GetProcessHeap () returned 0x650000
	[0173.095] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x20c) returned 0x65aa58
	[0173.095] GetConsoleTitleW (in: lpConsoleTitle=0x65aa58, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0173.096] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0173.096] GetProcAddress (hModule=0x75600000, lpProcName="CopyFileExW") returned 0x7561ffc0
	[0173.096] GetProcAddress (hModule=0x75600000, lpProcName="IsDebuggerPresent") returned 0x7561b0b0
	[0173.096] GetProcAddress (hModule=0x75600000, lpProcName="SetConsoleInputExeNameW") returned 0x7559b440
	[0173.096] GetProcessHeap () returned 0x650000
	[0173.097] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x400a) returned 0x65bc50
	[0173.097] GetProcessHeap () returned 0x650000
	[0173.097] RtlFreeHeap (HeapHandle=0x650000, Flags=0x0, BaseAddress=0x65bc50) returned 1
	[0173.098] _wcsicmp (_String1="taskkill", _String2=")") returned 75
	[0173.098] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14
	[0173.098] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14
	[0173.098] _wcsicmp (_String1="IF", _String2="taskkill") returned -11
	[0173.098] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11
	[0173.098] _wcsicmp (_String1="REM", _String2="taskkill") returned -2
	[0173.098] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2
	[0173.098] GetProcessHeap () returned 0x650000
	[0173.098] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x58) returned 0x65ac70
	[0173.098] GetProcessHeap () returned 0x650000
	[0173.098] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x1a) returned 0x650578
	[0173.099] GetProcessHeap () returned 0x650000
	[0173.099] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x34) returned 0x65acd0
	[0173.100] GetConsoleTitleW (in: lpConsoleTitle=0x19fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0173.101] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0173.101] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0173.101] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0173.101] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0173.101] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0173.102] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0173.102] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0173.102] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0173.102] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0173.102] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0173.102] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0173.102] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0173.102] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0173.102] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0173.102] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0173.102] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0173.102] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0173.102] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0173.102] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0173.102] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0173.102] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0173.102] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0173.102] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0173.102] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0173.102] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0173.102] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0173.102] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0173.102] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0173.102] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0173.102] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0173.102] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0173.102] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0173.102] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0173.102] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0173.102] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0173.102] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0173.102] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0173.103] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0173.103] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0173.103] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0173.103] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0173.103] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0173.103] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0173.103] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0173.103] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0173.103] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0173.103] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0173.103] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0173.103] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0173.103] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0173.103] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0173.103] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0173.103] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0173.103] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0173.103] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0173.103] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0173.103] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0173.103] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0173.103] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0173.103] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0173.103] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0173.103] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0173.103] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0173.103] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0173.104] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0173.104] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0173.104] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0173.104] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0173.104] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0173.104] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0173.104] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0173.104] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0173.104] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0173.104] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0173.104] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0173.104] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0173.104] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0173.104] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0173.104] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0173.104] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0173.104] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0173.104] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0173.104] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0173.104] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0173.104] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14
	[0173.104] _wcsicmp (_String1="taskkill", _String2="IF") returned 11
	[0173.104] _wcsicmp (_String1="taskkill", _String2="REM") returned 2
	[0173.105] GetProcessHeap () returned 0x650000
	[0173.105] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x210) returned 0x65ad10
	[0173.105] GetProcessHeap () returned 0x650000
	[0173.105] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x46) returned 0x65af28
	[0173.105] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0173.106] GetProcessHeap () returned 0x650000
	[0173.106] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x418) returned 0x6505c8
	[0173.106] SetErrorMode (uMode=0x0) returned 0x8003
	[0173.106] SetErrorMode (uMode=0x1) returned 0x0
	[0173.106] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x6505d0, lpFilePart=0x19f57c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19f57c*="Desktop") returned 0x1d
	[0173.106] SetErrorMode (uMode=0x8003) returned 0x1
	[0173.106] GetProcessHeap () returned 0x650000
	[0173.106] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6505c8, Size=0x56) returned 0x6505c8
	[0173.106] GetProcessHeap () returned 0x650000
	[0173.106] RtlSizeHeap (HeapHandle=0x650000, Flags=0x0, MemoryPointer=0x6505c8) returned 0x56
	[0173.106] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0173.106] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0173.106] GetProcessHeap () returned 0x650000
	[0173.106] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x110) returned 0x65af78
	[0173.106] GetProcessHeap () returned 0x650000
	[0173.106] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x218) returned 0x650628
	[0173.111] GetProcessHeap () returned 0x650000
	[0173.111] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x650628, Size=0x112) returned 0x650628
	[0173.111] GetProcessHeap () returned 0x650000
	[0173.111] RtlSizeHeap (HeapHandle=0x650000, Flags=0x0, MemoryPointer=0x650628) returned 0x112
	[0173.111] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0173.111] GetProcessHeap () returned 0x650000
	[0173.112] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0xe0) returned 0x65b090
	[0173.114] GetProcessHeap () returned 0x650000
	[0173.114] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x65b090, Size=0x76) returned 0x65b090
	[0173.114] GetProcessHeap () returned 0x650000
	[0173.114] RtlSizeHeap (HeapHandle=0x650000, Flags=0x0, MemoryPointer=0x65b090) returned 0x76
	[0173.114] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0173.114] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0173.115] GetLastError () returned 0x2
	[0173.115] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0173.115] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x65b110
	[0173.115] GetProcessHeap () returned 0x650000
	[0173.115] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x14) returned 0x6576e8
	[0173.115] FindClose (in: hFindFile=0x65b110 | out: hFindFile=0x65b110) returned 1
	[0173.115] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0173.116] GetLastError () returned 0x2
	[0173.116] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x65b110
	[0173.116] GetProcessHeap () returned 0x650000
	[0173.116] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x6576e8, Size=0x4) returned 0x65b150
	[0173.116] FindClose (in: hFindFile=0x65b110 | out: hFindFile=0x65b110) returned 1
	[0173.116] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0173.116] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0173.116] GetConsoleTitleW (in: lpConsoleTitle=0x19f7fc, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0173.118] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f728, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f70c | out: lpAttributeList=0x19f728, lpSize=0x19f70c) returned 1
	[0173.118] UpdateProcThreadAttribute (in: lpAttributeList=0x19f728, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f714, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f728, lpPreviousValue=0x0) returned 1
	[0173.118] GetStartupInfoW (in: lpStartupInfo=0x19f760 | out: lpStartupInfo=0x19f760*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x130, hStdOutput=0x13c, hStdError=0x140)) 
	[0173.118] GetProcessHeap () returned 0x650000
	[0173.118] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0x18) returned 0x657788
	[0173.118] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0173.118] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0173.118] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0173.118] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0173.118] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0173.118] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0173.118] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0173.118] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0173.118] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0173.118] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0173.119] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0173.119] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0173.119] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0173.119] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0173.119] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0173.119] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0173.119] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0173.119] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0173.119] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0173.119] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0173.119] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0173.119] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0173.119] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0173.119] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0173.119] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0173.119] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0173.119] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0173.119] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0173.119] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0173.119] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0173.119] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0173.119] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0173.119] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0173.119] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0173.119] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0173.119] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0173.119] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0173.119] GetProcessHeap () returned 0x650000
	[0173.119] RtlFreeHeap (HeapHandle=0x650000, Flags=0x0, BaseAddress=0x657788) returned 1
	[0173.119] GetProcessHeap () returned 0x650000
	[0173.119] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0xa) returned 0x65b110
	[0173.120] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1
	[0173.123] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill  /f /im infopath.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x19f6b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill  /f /im infopath.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f6fc | out: lpCommandLine="taskkill  /f /im infopath.exe ", lpProcessInformation=0x19f6fc*(hProcess=0x9c, hThread=0x98, dwProcessId=0xab0, dwThreadId=0x4e4)) returned 1
	[0173.209] CloseHandle (hObject=0x98) returned 1
	[0173.209] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0173.209] GetProcessHeap () returned 0x650000
	[0173.209] RtlFreeHeap (HeapHandle=0x650000, Flags=0x0, BaseAddress=0x659d50) returned 1
	[0173.209] GetEnvironmentStringsW () returned 0x659d50*
	[0173.209] GetProcessHeap () returned 0x650000
	[0173.210] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0xa76) returned 0x657cc0
	[0173.210] FreeEnvironmentStringsA (penv="=") returned 1
	[0173.210] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0
	[0174.864] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x19f694 | out: lpExitCode=0x19f694*=0x80) returned 1
	[0174.864] CloseHandle (hObject=0x9c) returned 1
	[0174.865] _vsnwprintf (in: _Buffer=0x19f77c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f69c | out: _Buffer="00000080") returned 8
	[0174.865] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1
	[0174.865] GetProcessHeap () returned 0x650000
	[0174.866] RtlFreeHeap (HeapHandle=0x650000, Flags=0x0, BaseAddress=0x657cc0) returned 1
	[0174.866] GetEnvironmentStringsW () returned 0x65b160*
	[0174.866] GetProcessHeap () returned 0x650000
	[0174.866] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0xa9c) returned 0x657cc0
	[0174.866] FreeEnvironmentStringsA (penv="=") returned 1
	[0174.866] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0174.866] GetProcessHeap () returned 0x650000
	[0174.866] RtlFreeHeap (HeapHandle=0x650000, Flags=0x0, BaseAddress=0x657cc0) returned 1
	[0174.866] GetEnvironmentStringsW () returned 0x65b160*
	[0174.866] GetProcessHeap () returned 0x650000
	[0174.866] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x8, Size=0xa9c) returned 0x657cc0
	[0174.867] FreeEnvironmentStringsA (penv="=") returned 1
	[0174.867] GetProcessHeap () returned 0x650000
	[0174.867] RtlFreeHeap (HeapHandle=0x650000, Flags=0x0, BaseAddress=0x65b110) returned 1
	[0174.867] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f728 | out: lpAttributeList=0x19f728) 
	[0174.867] _get_osfhandle (_FileHandle=1) returned 0x13c
	[0174.867] SetConsoleMode (hConsoleHandle=0x13c, dwMode=0x0) returned 0
	[0174.867] _get_osfhandle (_FileHandle=1) returned 0x13c
	[0174.867] GetConsoleMode (in: hConsoleHandle=0x13c, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0174.867] _get_osfhandle (_FileHandle=0) returned 0x130
	[0174.867] GetConsoleMode (in: hConsoleHandle=0x130, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0174.867] GetConsoleOutputCP () returned 0x1b5
	[0174.868] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0174.868] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0174.870] exit (_Code=128) 

Thread:
	id = 299
	os_tid = 0x8ec


Process:
	id = "56"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\syswow64\\taskkill.exe"
	page_root = "0x58320000"
	os_pid = "0xab0"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "55"
	os_parent_pid = "0x81c"
	cmd_line = "taskkill  /f /im infopath.exe "
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 4111
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 4112
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 4113
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 4114
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 4115
	        start_va = 0xa0000
	          end_va = 0xdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 4116
	        start_va = 0xe0000
	          end_va = 0xe3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 4117
	        start_va = 0xf0000
	          end_va = 0xf0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 4118
	        start_va = 0x100000
	          end_va = 0x101fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 4119
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 4120
	        start_va = 0x13b0000
	          end_va = 0x13c5fff
	       monitored = 0
	     entry_point = 0x13bde80
	     region_type = mapped_file
	            name = "taskkill.exe"
	        filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe")

Region:
	              id = 4121
	        start_va = 0x13d0000
	          end_va = 0x53cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000013d0000"
	        filename = ""

Region:
	              id = 4122
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 4123
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 4124
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 4125
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 4126
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 4127
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 4128
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 4129
	        start_va = 0x580000
	          end_va = 0x58ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000580000"
	        filename = ""

Region:
	              id = 4130
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 4131
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 4132
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 4133
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 4134
	        start_va = 0x590000
	          end_va = 0x74ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000590000"
	        filename = ""

Region:
	              id = 4135
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 4136
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 4137
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 4138
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 4139
	        start_va = 0x110000
	          end_va = 0x1cdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 4140
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 4141
	        start_va = 0x74650000
	          end_va = 0x746cafff
	       monitored = 0
	     entry_point = 0x7466e970
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 4142
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 4143
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 4144
	        start_va = 0x440000
	          end_va = 0x47ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000440000"
	        filename = ""

Region:
	              id = 4145
	        start_va = 0x76ae0000
	          end_va = 0x76b23fff
	       monitored = 0
	     entry_point = 0x76af9d80
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 4146
	        start_va = 0x75260000
	          end_va = 0x7530cfff
	       monitored = 0
	     entry_point = 0x75274f00
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 4147
	        start_va = 0x74450000
	          end_va = 0x7446dfff
	       monitored = 0
	     entry_point = 0x7445b640
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 4148
	        start_va = 0x74440000
	          end_va = 0x74449fff
	       monitored = 0
	     entry_point = 0x74442a00
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 4149
	        start_va = 0x74590000
	          end_va = 0x745e7fff
	       monitored = 0
	     entry_point = 0x745d25c0
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 4150
	        start_va = 0x77450000
	          end_va = 0x77596fff
	       monitored = 0
	     entry_point = 0x77461cf0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 4151
	        start_va = 0x6cc90000
	          end_va = 0x6cc97fff
	       monitored = 0
	     entry_point = 0x6cc917b0
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 4152
	        start_va = 0x76b30000
	          end_va = 0x76c7efff
	       monitored = 0
	     entry_point = 0x76be6820
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 4153
	        start_va = 0x753c0000
	          end_va = 0x75451fff
	       monitored = 0
	     entry_point = 0x753f8cf0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 4154
	        start_va = 0x77290000
	          end_va = 0x7744cfff
	       monitored = 0
	     entry_point = 0x77372a10
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")

Region:
	              id = 4155
	        start_va = 0x75310000
	          end_va = 0x7536efff
	       monitored = 0
	     entry_point = 0x75314af0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 4156
	        start_va = 0x77240000
	          end_va = 0x77284fff
	       monitored = 0
	     entry_point = 0x7725de90
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 4157
	        start_va = 0x6cc70000
	          end_va = 0x6cc85fff
	       monitored = 0
	     entry_point = 0x6cc721d0
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")

Region:
	              id = 4158
	        start_va = 0x6cc30000
	          end_va = 0x6cc6efff
	       monitored = 0
	     entry_point = 0x6cc446c0
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll")

Region:
	              id = 4159
	        start_va = 0x6caf0000
	          end_va = 0x6cc2efff
	       monitored = 0
	     entry_point = 0x6cb1d880
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll")

Region:
	              id = 4160
	        start_va = 0x6cad0000
	          end_va = 0x6caebfff
	       monitored = 0
	     entry_point = 0x6cad4720
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")

Region:
	              id = 4161
	        start_va = 0x6cac0000
	          end_va = 0x6cac9fff
	       monitored = 0
	     entry_point = 0x6cac28d0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")

Region:
	              id = 4162
	        start_va = 0x750000
	          end_va = 0x94ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000750000"
	        filename = ""

Region:
	              id = 4163
	        start_va = 0x1d0000
	          end_va = 0x1f9fff
	       monitored = 0
	     entry_point = 0x1d5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 4164
	        start_va = 0x750000
	          end_va = 0x8d7fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000750000"
	        filename = ""

Region:
	              id = 4165
	        start_va = 0x940000
	          end_va = 0x94ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000940000"
	        filename = ""

Region:
	              id = 4166
	        start_va = 0x74ea0000
	          end_va = 0x74ecafff
	       monitored = 0
	     entry_point = 0x74ea5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 4167
	        start_va = 0x950000
	          end_va = 0xad0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000950000"
	        filename = ""

Region:
	              id = 4168
	        start_va = 0x53d0000
	          end_va = 0x67cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000053d0000"
	        filename = ""

Region:
	              id = 4169
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 4170
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001d0000"
	        filename = ""

Region:
	              id = 4171
	        start_va = 0x1e0000
	          end_va = 0x1e4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taskkill.exe.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui")

Region:
	              id = 4172
	        start_va = 0x1f0000
	          end_va = 0x1f0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001f0000"
	        filename = ""

Region:
	              id = 4173
	        start_va = 0x480000
	          end_va = 0x480fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 4174
	        start_va = 0xae0000
	          end_va = 0xe16fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 4175
	        start_va = 0x490000
	          end_va = 0x579fff
	       monitored = 0
	     entry_point = 0x4cd650
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 4176
	        start_va = 0x490000
	          end_va = 0x493fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000490000"
	        filename = ""

Region:
	              id = 4177
	        start_va = 0x4a0000
	          end_va = 0x57ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 4178
	        start_va = 0x76e20000
	          end_va = 0x76e2bfff
	       monitored = 0
	     entry_point = 0x76e23930
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")

Region:
	              id = 4179
	        start_va = 0x590000
	          end_va = 0x590fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000590000"
	        filename = ""

Region:
	              id = 4180
	        start_va = 0x650000
	          end_va = 0x74ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000650000"
	        filename = ""

Region:
	              id = 4181
	        start_va = 0x76c80000
	          end_va = 0x76d03fff
	       monitored = 0
	     entry_point = 0x76ca6220
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 4182
	        start_va = 0x5a0000
	          end_va = 0x5a0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000005a0000"
	        filename = ""

Region:
	              id = 4183
	        start_va = 0x6cab0000
	          end_va = 0x6cabcfff
	       monitored = 0
	     entry_point = 0x6cab3520
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 4184
	        start_va = 0x6ca40000
	          end_va = 0x6caa6fff
	       monitored = 0
	     entry_point = 0x6ca5b610
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 4185
	        start_va = 0x740f0000
	          end_va = 0x7410afff
	       monitored = 0
	     entry_point = 0x740f9050
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 4186
	        start_va = 0x6c9f0000
	          end_va = 0x6ca33fff
	       monitored = 0
	     entry_point = 0x6ca0aaf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")

Region:
	              id = 4187
	        start_va = 0x5b0000
	          end_va = 0x5effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005b0000"
	        filename = ""

Region:
	              id = 4188
	        start_va = 0x5f0000
	          end_va = 0x62ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005f0000"
	        filename = ""

Region:
	              id = 4189
	        start_va = 0x8e0000
	          end_va = 0x91ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000008e0000"
	        filename = ""

Region:
	              id = 4190
	        start_va = 0xe20000
	          end_va = 0xe5ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e20000"
	        filename = ""

Region:
	              id = 4191
	        start_va = 0xe60000
	          end_va = 0xe9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e60000"
	        filename = ""

Region:
	              id = 4192
	        start_va = 0xea0000
	          end_va = 0xedffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ea0000"
	        filename = ""

Region:
	              id = 4193
	        start_va = 0x6c9d0000
	          end_va = 0x6c9e0fff
	       monitored = 0
	     entry_point = 0x6c9d8fa0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 4194
	        start_va = 0x6c910000
	          end_va = 0x6c9cefff
	       monitored = 0
	     entry_point = 0x6c941e80
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 4196
	        start_va = 0x630000
	          end_va = 0x635fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000630000"
	        filename = ""


Thread:
	id = 300
	os_tid = 0x4e4


Thread:
	id = 301
	os_tid = 0x340


Thread:
	id = 302
	os_tid = 0x658


Thread:
	id = 303
	os_tid = 0xf48


Thread:
	id = 304
	os_tid = 0x97c


Process:
	id = "57"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x316e9000"
	os_pid = "0xc54"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x614"
	cmd_line = "cmd.exe /c \"taskkill /f /im msaccess.exe \""
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 4201
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 4202
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 4203
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 4204
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 4205
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 4206
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 4207
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 4208
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 4209
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 4210
	        start_va = 0x13a0000
	          end_va = 0x13f1fff
	       monitored = 1
	     entry_point = 0x13b4fd0
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")

Region:
	              id = 4211
	        start_va = 0x1400000
	          end_va = 0x53fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001400000"
	        filename = ""

Region:
	              id = 4212
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 4213
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 4214
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 4215
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 4216
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 4217
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 4218
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 4219
	        start_va = 0x1f0000
	          end_va = 0x1fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001f0000"
	        filename = ""

Region:
	              id = 4220
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 4221
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 4222
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 4223
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 4224
	        start_va = 0x400000
	          end_va = 0x63ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 4225
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 4226
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 4227
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 4228
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 4229
	        start_va = 0x400000
	          end_va = 0x4bdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 4230
	        start_va = 0x540000
	          end_va = 0x63ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000540000"
	        filename = ""

Region:
	              id = 4231
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 4232
	        start_va = 0x4c0000
	          end_va = 0x4fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004c0000"
	        filename = ""

Region:
	              id = 4233
	        start_va = 0x640000
	          end_va = 0x73ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000640000"
	        filename = ""

Region:
	              id = 4234
	        start_va = 0x740000
	          end_va = 0x7dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000740000"
	        filename = ""

Region:
	              id = 4235
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 4236
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 4237
	        start_va = 0x7e0000
	          end_va = 0xb16fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 307
	os_tid = 0xb98

	[0175.074] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000
	[0175.074] __set_app_type (_Type=0x1) 
	[0175.074] __p__fmode () returned 0x74974d6c
	[0175.074] __p__commode () returned 0x74975b1c
	[0175.075] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13b5200) returned 0x0
	[0175.075] __getmainargs (in: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0, _DoWildCard=0, _StartInfo=0x13c60fc | out: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0) returned 0
	[0175.075] GetCurrentThreadId () returned 0xb98
	[0175.075] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb98) returned 0x78
	[0175.075] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0175.076] GetProcAddress (hModule=0x75600000, lpProcName="SetThreadUILanguage") returned 0x75642510
	[0175.076] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0175.083] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0175.083] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2
	[0175.084] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0175.084] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0175.084] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0175.084] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0175.084] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0175.084] GetConsoleOutputCP () returned 0x1b5
	[0175.085] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0175.085] SetConsoleCtrlHandler (HandlerRoutine=0x13c0e40, Add=1) returned 1
	[0175.085] _get_osfhandle (_FileHandle=1) returned 0x130
	[0175.085] SetConsoleMode (hConsoleHandle=0x130, dwMode=0x0) returned 0
	[0175.085] _get_osfhandle (_FileHandle=1) returned 0x130
	[0175.085] GetConsoleMode (in: hConsoleHandle=0x130, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0175.085] _get_osfhandle (_FileHandle=0) returned 0x154
	[0175.085] GetConsoleMode (in: hConsoleHandle=0x154, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0175.085] GetEnvironmentStringsW () returned 0x547cc0*
	[0175.086] GetProcessHeap () returned 0x540000
	[0175.086] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xa1a) returned 0x5486e8
	[0175.086] FreeEnvironmentStringsA (penv="A") returned 1
	[0175.086] GetProcessHeap () returned 0x540000
	[0175.086] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4) returned 0x540550
	[0175.086] GetEnvironmentStringsW () returned 0x547cc0*
	[0175.086] GetProcessHeap () returned 0x540000
	[0175.086] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xa1a) returned 0x549110
	[0175.086] FreeEnvironmentStringsA (penv="A") returned 1
	[0175.086] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0175.087] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0175.087] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0175.087] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0175.087] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0175.087] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0175.087] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0175.087] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0175.087] RegCloseKey (hKey=0x88) returned 0x0
	[0175.088] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0175.088] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0175.088] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0175.088] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0175.088] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0175.088] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0175.088] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0175.088] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0175.088] RegCloseKey (hKey=0x88) returned 0x0
	[0175.088] time (in: timer=0x0 | out: timer=0x0) returned 0x62344239
	[0175.088] srand (_Seed=0x62344239) 
	[0175.088] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im msaccess.exe \""
	[0175.088] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im msaccess.exe \""
	[0175.088] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0175.088] GetProcessHeap () returned 0x540000
	[0175.088] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x210) returned 0x549b38
	[0175.089] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x549b40, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0175.089] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0175.089] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0175.089] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0175.089] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0175.089] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0175.089] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0175.089] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0175.089] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0175.089] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0175.089] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0175.089] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0175.089] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0175.089] GetProcessHeap () returned 0x540000
	[0175.090] RtlFreeHeap (HeapHandle=0x540000, Flags=0x0, BaseAddress=0x5486e8) returned 1
	[0175.090] GetEnvironmentStringsW () returned 0x547cc0*
	[0175.090] GetProcessHeap () returned 0x540000
	[0175.090] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xa32) returned 0x54a790
	[0175.090] FreeEnvironmentStringsA (penv="A") returned 1
	[0175.090] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b
	[0175.090] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0175.091] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0175.091] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0175.091] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0175.091] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0175.091] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0175.091] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0175.091] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0175.091] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0175.091] GetProcessHeap () returned 0x540000
	[0175.091] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x44) returned 0x5405c8
	[0175.091] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0175.091] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19fc4c*="Desktop") returned 0x1d
	[0175.091] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0175.091] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x540618
	[0175.091] FindClose (in: hFindFile=0x540618 | out: hFindFile=0x540618) returned 1
	[0175.092] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x540618
	[0175.092] FindClose (in: hFindFile=0x540618 | out: hFindFile=0x540618) returned 1
	[0175.092] _wcsnicmp (_String1="RDHJ0C~1", _String2="RDhJ0CNFevzX", _MaxCount=0xc) returned 16
	[0175.092] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x540618
	[0175.092] FindClose (in: hFindFile=0x540618 | out: hFindFile=0x540618) returned 1
	[0175.092] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0175.092] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1
	[0175.092] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 1
	[0175.092] GetProcessHeap () returned 0x540000
	[0175.093] RtlFreeHeap (HeapHandle=0x540000, Flags=0x0, BaseAddress=0x54a790) returned 1
	[0175.093] GetEnvironmentStringsW () returned 0x547cc0*
	[0175.093] GetProcessHeap () returned 0x540000
	[0175.093] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xa76) returned 0x549d50
	[0175.094] FreeEnvironmentStringsA (penv="=") returned 1
	[0175.094] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0175.094] GetProcessHeap () returned 0x540000
	[0175.094] RtlFreeHeap (HeapHandle=0x540000, Flags=0x0, BaseAddress=0x5405c8) returned 1
	[0175.094] GetProcessHeap () returned 0x540000
	[0175.094] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x400e) returned 0x54bc50
	[0175.095] GetProcessHeap () returned 0x540000
	[0175.095] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4c) returned 0x54a7d0
	[0175.095] GetProcessHeap () returned 0x540000
	[0175.095] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4008) returned 0x54fc68
	[0175.095] GetProcessHeap () returned 0x540000
	[0175.095] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x4008) returned 0x553c78
	[0175.097] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0175.097] GetProcessHeap () returned 0x540000
	[0175.097] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x418) returned 0x54a828
	[0175.097] SetErrorMode (uMode=0x0) returned 0x8003
	[0175.097] SetErrorMode (uMode=0x1) returned 0x0
	[0175.098] GetFullPathNameW (in: lpFileName="taskkill \\f \\.", nBufferLength=0x208, lpBuffer=0x54a830, lpFilePart=0x19fbac | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f", lpFilePart=0x19fbac*="f") returned 0x29
	[0175.098] SetErrorMode (uMode=0x8003) returned 0x1
	[0175.098] GetProcessHeap () returned 0x540000
	[0175.098] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x54a828, Size=0x7e) returned 0x54a828
	[0175.098] GetProcessHeap () returned 0x540000
	[0175.098] RtlSizeHeap (HeapHandle=0x540000, Flags=0x0, MemoryPointer=0x54a828) returned 0x7e
	[0175.098] NeedCurrentDirectoryForExePathW (ExeName="taskkill \\f \\.") returned 1
	[0175.098] GetProcessHeap () returned 0x540000
	[0175.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x62) returned 0x54a8b0
	[0175.098] GetProcessHeap () returned 0x540000
	[0175.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xb8) returned 0x54a920
	[0175.098] GetProcessHeap () returned 0x540000
	[0175.098] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x54a920, Size=0x62) returned 0x54a920
	[0175.098] GetProcessHeap () returned 0x540000
	[0175.098] RtlSizeHeap (HeapHandle=0x540000, Flags=0x0, MemoryPointer=0x54a920) returned 0x62
	[0175.098] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0175.098] GetProcessHeap () returned 0x540000
	[0175.098] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xe0) returned 0x54a990
	[0175.103] GetProcessHeap () returned 0x540000
	[0175.103] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x54a990, Size=0x76) returned 0x54a990
	[0175.103] GetProcessHeap () returned 0x540000
	[0175.103] RtlSizeHeap (HeapHandle=0x540000, Flags=0x0, MemoryPointer=0x54a990) returned 0x76
	[0175.103] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0175.103] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f\\im msaccess.exe ", fInfoLevelId=0x1, lpFindFileData=0x19f958, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f958) returned 0xffffffff
	[0175.104] GetLastError () returned 0x3
	[0175.104] GetProcessHeap () returned 0x540000
	[0175.104] RtlFreeHeap (HeapHandle=0x540000, Flags=0x0, BaseAddress=0x54fc68) returned 1
	[0175.105] GetProcessHeap () returned 0x540000
	[0175.105] RtlFreeHeap (HeapHandle=0x540000, Flags=0x0, BaseAddress=0x553c78) returned 1
	[0175.105] GetProcessHeap () returned 0x540000
	[0175.105] RtlFreeHeap (HeapHandle=0x540000, Flags=0x0, BaseAddress=0x54bc50) returned 1
	[0175.106] GetConsoleOutputCP () returned 0x1b5
	[0175.108] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0175.108] GetUserDefaultLCID () returned 0x409
	[0175.108] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x13d34a0, cchData=8 | out: lpLCData=":") returned 2
	[0175.108] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0175.108] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0175.108] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2
	[0175.109] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x13d34b0, cchData=8 | out: lpLCData="/") returned 2
	[0175.109] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x13d3500, cchData=32 | out: lpLCData="Mon") returned 4
	[0175.109] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x13d3540, cchData=32 | out: lpLCData="Tue") returned 4
	[0175.109] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x13d3580, cchData=32 | out: lpLCData="Wed") returned 4
	[0175.109] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x13d35c0, cchData=32 | out: lpLCData="Thu") returned 4
	[0175.109] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x13d3600, cchData=32 | out: lpLCData="Fri") returned 4
	[0175.109] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x13d3640, cchData=32 | out: lpLCData="Sat") returned 4
	[0175.109] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x13d3680, cchData=32 | out: lpLCData="Sun") returned 4
	[0175.109] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x13d34c0, cchData=8 | out: lpLCData=".") returned 2
	[0175.109] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x13d34e0, cchData=8 | out: lpLCData=",") returned 2
	[0175.109] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0175.110] GetProcessHeap () returned 0x540000
	[0175.110] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20c) returned 0x54aa58
	[0175.111] GetConsoleTitleW (in: lpConsoleTitle=0x54aa58, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0175.111] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0175.111] GetProcAddress (hModule=0x75600000, lpProcName="CopyFileExW") returned 0x7561ffc0
	[0175.112] GetProcAddress (hModule=0x75600000, lpProcName="IsDebuggerPresent") returned 0x7561b0b0
	[0175.112] GetProcAddress (hModule=0x75600000, lpProcName="SetConsoleInputExeNameW") returned 0x7559b440
	[0175.112] GetProcessHeap () returned 0x540000
	[0175.112] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x400a) returned 0x54bc50
	[0175.112] GetProcessHeap () returned 0x540000
	[0175.112] RtlFreeHeap (HeapHandle=0x540000, Flags=0x0, BaseAddress=0x54bc50) returned 1
	[0175.113] _wcsicmp (_String1="taskkill", _String2=")") returned 75
	[0175.113] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14
	[0175.113] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14
	[0175.113] _wcsicmp (_String1="IF", _String2="taskkill") returned -11
	[0175.113] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11
	[0175.113] _wcsicmp (_String1="REM", _String2="taskkill") returned -2
	[0175.113] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2
	[0175.113] GetProcessHeap () returned 0x540000
	[0175.113] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x58) returned 0x54ac70
	[0175.113] GetProcessHeap () returned 0x540000
	[0175.113] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x1a) returned 0x540578
	[0175.114] GetProcessHeap () returned 0x540000
	[0175.114] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x34) returned 0x54acd0
	[0175.115] GetConsoleTitleW (in: lpConsoleTitle=0x19fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0175.123] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0175.123] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0175.123] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0175.123] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0175.123] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0175.123] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0175.123] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0175.123] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0175.123] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0175.123] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0175.123] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0175.123] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0175.123] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0175.123] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0175.123] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0175.123] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0175.123] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0175.123] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0175.123] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0175.123] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0175.123] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0175.123] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0175.123] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0175.123] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0175.123] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0175.123] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0175.124] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0175.124] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0175.124] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0175.124] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0175.124] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0175.124] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0175.124] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0175.124] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0175.124] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0175.124] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0175.124] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0175.124] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0175.124] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0175.124] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0175.124] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0175.124] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0175.124] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0175.124] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0175.124] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0175.124] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0175.124] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0175.124] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0175.124] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0175.124] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0175.124] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0175.124] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0175.124] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0175.124] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0175.124] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0175.125] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0175.125] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0175.125] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0175.125] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0175.125] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0175.125] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0175.125] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0175.125] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0175.125] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0175.125] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0175.125] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0175.125] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0175.125] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0175.125] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0175.125] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0175.125] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0175.125] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0175.125] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0175.125] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0175.125] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0175.125] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0175.125] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0175.125] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0175.125] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0175.126] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0175.126] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0175.126] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0175.126] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0175.126] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0175.126] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14
	[0175.126] _wcsicmp (_String1="taskkill", _String2="IF") returned 11
	[0175.126] _wcsicmp (_String1="taskkill", _String2="REM") returned 2
	[0175.126] GetProcessHeap () returned 0x540000
	[0175.126] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x210) returned 0x54ad10
	[0175.126] GetProcessHeap () returned 0x540000
	[0175.126] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x46) returned 0x54af28
	[0175.126] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0175.127] GetProcessHeap () returned 0x540000
	[0175.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x418) returned 0x5405c8
	[0175.127] SetErrorMode (uMode=0x0) returned 0x8003
	[0175.127] SetErrorMode (uMode=0x1) returned 0x0
	[0175.127] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x5405d0, lpFilePart=0x19f57c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19f57c*="Desktop") returned 0x1d
	[0175.127] SetErrorMode (uMode=0x8003) returned 0x1
	[0175.127] GetProcessHeap () returned 0x540000
	[0175.127] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5405c8, Size=0x56) returned 0x5405c8
	[0175.127] GetProcessHeap () returned 0x540000
	[0175.127] RtlSizeHeap (HeapHandle=0x540000, Flags=0x0, MemoryPointer=0x5405c8) returned 0x56
	[0175.127] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0175.127] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0175.127] GetProcessHeap () returned 0x540000
	[0175.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x110) returned 0x54af78
	[0175.128] GetProcessHeap () returned 0x540000
	[0175.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x218) returned 0x540628
	[0175.132] GetProcessHeap () returned 0x540000
	[0175.132] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x540628, Size=0x112) returned 0x540628
	[0175.132] GetProcessHeap () returned 0x540000
	[0175.132] RtlSizeHeap (HeapHandle=0x540000, Flags=0x0, MemoryPointer=0x540628) returned 0x112
	[0175.132] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0175.132] GetProcessHeap () returned 0x540000
	[0175.133] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xe0) returned 0x54b090
	[0175.135] GetProcessHeap () returned 0x540000
	[0175.135] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x54b090, Size=0x76) returned 0x54b090
	[0175.135] GetProcessHeap () returned 0x540000
	[0175.135] RtlSizeHeap (HeapHandle=0x540000, Flags=0x0, MemoryPointer=0x54b090) returned 0x76
	[0175.135] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0175.135] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0175.135] GetLastError () returned 0x2
	[0175.135] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0175.136] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x54b110
	[0175.136] GetProcessHeap () returned 0x540000
	[0175.136] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x5476a8
	[0175.136] FindClose (in: hFindFile=0x54b110 | out: hFindFile=0x54b110) returned 1
	[0175.136] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0175.136] GetLastError () returned 0x2
	[0175.136] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x54b110
	[0175.136] GetProcessHeap () returned 0x540000
	[0175.136] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5476a8, Size=0x4) returned 0x54b150
	[0175.136] FindClose (in: hFindFile=0x54b110 | out: hFindFile=0x54b110) returned 1
	[0175.137] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0175.137] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0175.137] GetConsoleTitleW (in: lpConsoleTitle=0x19f7fc, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0175.188] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f728, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f70c | out: lpAttributeList=0x19f728, lpSize=0x19f70c) returned 1
	[0175.188] UpdateProcThreadAttribute (in: lpAttributeList=0x19f728, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f714, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f728, lpPreviousValue=0x0) returned 1
	[0175.189] GetStartupInfoW (in: lpStartupInfo=0x19f760 | out: lpStartupInfo=0x19f760*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x154, hStdOutput=0x130, hStdError=0x13c)) 
	[0175.189] GetProcessHeap () returned 0x540000
	[0175.189] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0x18) returned 0x5474c8
	[0175.189] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0175.189] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0175.189] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0175.189] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0175.189] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0175.189] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0175.189] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0175.189] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0175.189] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0175.189] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0175.189] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0175.189] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0175.189] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0175.189] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0175.189] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0175.189] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0175.189] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0175.189] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0175.189] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0175.189] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0175.189] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0175.190] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0175.190] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0175.190] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0175.190] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0175.190] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0175.190] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0175.190] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0175.190] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0175.190] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0175.190] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0175.190] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0175.190] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0175.190] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0175.190] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0175.190] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0175.190] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0175.190] GetProcessHeap () returned 0x540000
	[0175.190] RtlFreeHeap (HeapHandle=0x540000, Flags=0x0, BaseAddress=0x5474c8) returned 1
	[0175.190] GetProcessHeap () returned 0x540000
	[0175.190] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xa) returned 0x54b110
	[0175.190] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1
	[0175.194] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill  /f /im msaccess.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x19f6b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill  /f /im msaccess.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f6fc | out: lpCommandLine="taskkill  /f /im msaccess.exe ", lpProcessInformation=0x19f6fc*(hProcess=0x9c, hThread=0x98, dwProcessId=0xa88, dwThreadId=0x254)) returned 1
	[0175.240] CloseHandle (hObject=0x98) returned 1
	[0175.240] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0175.240] GetProcessHeap () returned 0x540000
	[0175.240] RtlFreeHeap (HeapHandle=0x540000, Flags=0x0, BaseAddress=0x549d50) returned 1
	[0175.240] GetEnvironmentStringsW () returned 0x549d50*
	[0175.241] GetProcessHeap () returned 0x540000
	[0175.241] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xa76) returned 0x547cc0
	[0175.241] FreeEnvironmentStringsA (penv="=") returned 1
	[0175.241] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0
	[0176.491] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x19f694 | out: lpExitCode=0x19f694*=0x80) returned 1
	[0176.491] CloseHandle (hObject=0x9c) returned 1
	[0176.492] _vsnwprintf (in: _Buffer=0x19f77c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f69c | out: _Buffer="00000080") returned 8
	[0176.492] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1
	[0176.492] GetProcessHeap () returned 0x540000
	[0176.493] RtlFreeHeap (HeapHandle=0x540000, Flags=0x0, BaseAddress=0x547cc0) returned 1
	[0176.493] GetEnvironmentStringsW () returned 0x54b160*
	[0176.493] GetProcessHeap () returned 0x540000
	[0176.493] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xa9c) returned 0x547cc0
	[0176.493] FreeEnvironmentStringsA (penv="=") returned 1
	[0176.493] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0176.493] GetProcessHeap () returned 0x540000
	[0176.493] RtlFreeHeap (HeapHandle=0x540000, Flags=0x0, BaseAddress=0x547cc0) returned 1
	[0176.493] GetEnvironmentStringsW () returned 0x54b160*
	[0176.494] GetProcessHeap () returned 0x540000
	[0176.494] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x8, Size=0xa9c) returned 0x547cc0
	[0176.494] FreeEnvironmentStringsA (penv="=") returned 1
	[0176.494] GetProcessHeap () returned 0x540000
	[0176.494] RtlFreeHeap (HeapHandle=0x540000, Flags=0x0, BaseAddress=0x54b110) returned 1
	[0176.494] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f728 | out: lpAttributeList=0x19f728) 
	[0176.494] _get_osfhandle (_FileHandle=1) returned 0x130
	[0176.494] SetConsoleMode (hConsoleHandle=0x130, dwMode=0x0) returned 0
	[0176.494] _get_osfhandle (_FileHandle=1) returned 0x130
	[0176.494] GetConsoleMode (in: hConsoleHandle=0x130, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0176.494] _get_osfhandle (_FileHandle=0) returned 0x154
	[0176.494] GetConsoleMode (in: hConsoleHandle=0x154, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0176.494] GetConsoleOutputCP () returned 0x1b5
	[0176.497] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0176.497] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0176.499] exit (_Code=128) 

Thread:
	id = 308
	os_tid = 0xb44


Process:
	id = "58"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\syswow64\\taskkill.exe"
	page_root = "0x31a43000"
	os_pid = "0xa88"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "57"
	os_parent_pid = "0xc54"
	cmd_line = "taskkill  /f /im msaccess.exe "
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 4238
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 4239
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 4240
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 4241
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 4242
	        start_va = 0xa0000
	          end_va = 0xdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 4243
	        start_va = 0xe0000
	          end_va = 0xe3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 4244
	        start_va = 0xf0000
	          end_va = 0xf0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 4245
	        start_va = 0x100000
	          end_va = 0x101fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 4246
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 4247
	        start_va = 0x13b0000
	          end_va = 0x13c5fff
	       monitored = 0
	     entry_point = 0x13bde80
	     region_type = mapped_file
	            name = "taskkill.exe"
	        filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe")

Region:
	              id = 4248
	        start_va = 0x13d0000
	          end_va = 0x53cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000013d0000"
	        filename = ""

Region:
	              id = 4249
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 4250
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 4251
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 4252
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 4253
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 4254
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 4255
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 4256
	        start_va = 0x5d0000
	          end_va = 0x5dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005d0000"
	        filename = ""

Region:
	              id = 4257
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 4258
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 4259
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 4260
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 4261
	        start_va = 0x5e0000
	          end_va = 0x8bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005e0000"
	        filename = ""

Region:
	              id = 4262
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 4263
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 4264
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 4265
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 4266
	        start_va = 0x110000
	          end_va = 0x1cdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 4267
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 4268
	        start_va = 0x74650000
	          end_va = 0x746cafff
	       monitored = 0
	     entry_point = 0x7466e970
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 4269
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 4270
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 4271
	        start_va = 0x440000
	          end_va = 0x47ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000440000"
	        filename = ""

Region:
	              id = 4272
	        start_va = 0x76ae0000
	          end_va = 0x76b23fff
	       monitored = 0
	     entry_point = 0x76af9d80
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 4273
	        start_va = 0x75260000
	          end_va = 0x7530cfff
	       monitored = 0
	     entry_point = 0x75274f00
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 4274
	        start_va = 0x74450000
	          end_va = 0x7446dfff
	       monitored = 0
	     entry_point = 0x7445b640
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 4275
	        start_va = 0x74440000
	          end_va = 0x74449fff
	       monitored = 0
	     entry_point = 0x74442a00
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 4276
	        start_va = 0x74590000
	          end_va = 0x745e7fff
	       monitored = 0
	     entry_point = 0x745d25c0
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 4277
	        start_va = 0x77450000
	          end_va = 0x77596fff
	       monitored = 0
	     entry_point = 0x77461cf0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 4278
	        start_va = 0x76b30000
	          end_va = 0x76c7efff
	       monitored = 0
	     entry_point = 0x76be6820
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 4279
	        start_va = 0x753c0000
	          end_va = 0x75451fff
	       monitored = 0
	     entry_point = 0x753f8cf0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 4280
	        start_va = 0x77290000
	          end_va = 0x7744cfff
	       monitored = 0
	     entry_point = 0x77372a10
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")

Region:
	              id = 4281
	        start_va = 0x6cc90000
	          end_va = 0x6cc97fff
	       monitored = 0
	     entry_point = 0x6cc917b0
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 4282
	        start_va = 0x6cc70000
	          end_va = 0x6cc85fff
	       monitored = 0
	     entry_point = 0x6cc721d0
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")

Region:
	              id = 4283
	        start_va = 0x75310000
	          end_va = 0x7536efff
	       monitored = 0
	     entry_point = 0x75314af0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 4284
	        start_va = 0x77240000
	          end_va = 0x77284fff
	       monitored = 0
	     entry_point = 0x7725de90
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 4285
	        start_va = 0x6cc30000
	          end_va = 0x6cc6efff
	       monitored = 0
	     entry_point = 0x6cc446c0
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll")

Region:
	              id = 4286
	        start_va = 0x6caf0000
	          end_va = 0x6cc2efff
	       monitored = 0
	     entry_point = 0x6cb1d880
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll")

Region:
	              id = 4287
	        start_va = 0x6cad0000
	          end_va = 0x6caebfff
	       monitored = 0
	     entry_point = 0x6cad4720
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")

Region:
	              id = 4288
	        start_va = 0x6cac0000
	          end_va = 0x6cac9fff
	       monitored = 0
	     entry_point = 0x6cac28d0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")

Region:
	              id = 4289
	        start_va = 0x5e0000
	          end_va = 0x73ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005e0000"
	        filename = ""

Region:
	              id = 4290
	        start_va = 0x7c0000
	          end_va = 0x8bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000007c0000"
	        filename = ""

Region:
	              id = 4291
	        start_va = 0x1d0000
	          end_va = 0x1f9fff
	       monitored = 0
	     entry_point = 0x1d5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 4292
	        start_va = 0x8c0000
	          end_va = 0xa47fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000008c0000"
	        filename = ""

Region:
	              id = 4293
	        start_va = 0x74ea0000
	          end_va = 0x74ecafff
	       monitored = 0
	     entry_point = 0x74ea5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 4294
	        start_va = 0xa50000
	          end_va = 0xbd0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000a50000"
	        filename = ""

Region:
	              id = 4295
	        start_va = 0x53d0000
	          end_va = 0x67cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000053d0000"
	        filename = ""

Region:
	              id = 4296
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 4297
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001d0000"
	        filename = ""

Region:
	              id = 4298
	        start_va = 0x1e0000
	          end_va = 0x1e4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taskkill.exe.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui")

Region:
	              id = 4299
	        start_va = 0x1f0000
	          end_va = 0x1f0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001f0000"
	        filename = ""

Region:
	              id = 4300
	        start_va = 0x480000
	          end_va = 0x480fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 4301
	        start_va = 0xbe0000
	          end_va = 0xf16fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 4302
	        start_va = 0x490000
	          end_va = 0x579fff
	       monitored = 0
	     entry_point = 0x4cd650
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 4303
	        start_va = 0x490000
	          end_va = 0x493fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000490000"
	        filename = ""

Region:
	              id = 4304
	        start_va = 0x4a0000
	          end_va = 0x57ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 4305
	        start_va = 0x76e20000
	          end_va = 0x76e2bfff
	       monitored = 0
	     entry_point = 0x76e23930
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")

Region:
	              id = 4306
	        start_va = 0x580000
	          end_va = 0x580fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000580000"
	        filename = ""

Region:
	              id = 4307
	        start_va = 0x76c80000
	          end_va = 0x76d03fff
	       monitored = 0
	     entry_point = 0x76ca6220
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 4308
	        start_va = 0x590000
	          end_va = 0x590fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000590000"
	        filename = ""

Region:
	              id = 4309
	        start_va = 0x6cab0000
	          end_va = 0x6cabcfff
	       monitored = 0
	     entry_point = 0x6cab3520
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 4310
	        start_va = 0x6ca40000
	          end_va = 0x6caa6fff
	       monitored = 0
	     entry_point = 0x6ca5b610
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 4311
	        start_va = 0x740f0000
	          end_va = 0x7410afff
	       monitored = 0
	     entry_point = 0x740f9050
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 4312
	        start_va = 0x6c9f0000
	          end_va = 0x6ca33fff
	       monitored = 0
	     entry_point = 0x6ca0aaf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")

Region:
	              id = 4313
	        start_va = 0x5e0000
	          end_va = 0x61ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005e0000"
	        filename = ""

Region:
	              id = 4314
	        start_va = 0x620000
	          end_va = 0x65ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000620000"
	        filename = ""

Region:
	              id = 4315
	        start_va = 0x730000
	          end_va = 0x73ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000730000"
	        filename = ""

Region:
	              id = 4316
	        start_va = 0x660000
	          end_va = 0x69ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000660000"
	        filename = ""

Region:
	              id = 4317
	        start_va = 0x6a0000
	          end_va = 0x6dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006a0000"
	        filename = ""

Region:
	              id = 4318
	        start_va = 0x6e0000
	          end_va = 0x71ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006e0000"
	        filename = ""

Region:
	              id = 4319
	        start_va = 0x740000
	          end_va = 0x77ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000740000"
	        filename = ""

Region:
	              id = 4320
	        start_va = 0x6c9d0000
	          end_va = 0x6c9e0fff
	       monitored = 0
	     entry_point = 0x6c9d8fa0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 4321
	        start_va = 0x6c910000
	          end_va = 0x6c9cefff
	       monitored = 0
	     entry_point = 0x6c941e80
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 4323
	        start_va = 0x5a0000
	          end_va = 0x5a5fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000005a0000"
	        filename = ""


Thread:
	id = 309
	os_tid = 0x254


Thread:
	id = 310
	os_tid = 0x96c


Thread:
	id = 311
	os_tid = 0x688


Thread:
	id = 312
	os_tid = 0xd38


Thread:
	id = 313
	os_tid = 0x1018


Process:
	id = "59"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x311f6000"
	os_pid = "0x92c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x614"
	cmd_line = "cmd.exe /c \"taskkill /f /im mspub.exe \""
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 4326
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 4327
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 4328
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 4329
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 4330
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 4331
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 4332
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 4333
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 4334
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 4335
	        start_va = 0x13a0000
	          end_va = 0x13f1fff
	       monitored = 1
	     entry_point = 0x13b4fd0
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")

Region:
	              id = 4336
	        start_va = 0x1400000
	          end_va = 0x53fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001400000"
	        filename = ""

Region:
	              id = 4337
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 4338
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 4339
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 4340
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 4341
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 4342
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 4343
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 4344
	        start_va = 0x460000
	          end_va = 0x46ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000460000"
	        filename = ""

Region:
	              id = 4345
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 4346
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 4347
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 4348
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 4349
	        start_va = 0x470000
	          end_va = 0x59ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000470000"
	        filename = ""

Region:
	              id = 4350
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 4351
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 4352
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 4353
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 4354
	        start_va = 0x5a0000
	          end_va = 0x65dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 4355
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 4356
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 4357
	        start_va = 0x660000
	          end_va = 0x75ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000660000"
	        filename = ""

Region:
	              id = 4358
	        start_va = 0x760000
	          end_va = 0x7fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000760000"
	        filename = ""

Region:
	              id = 4359
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 4360
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 4361
	        start_va = 0x800000
	          end_va = 0xb36fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 314
	os_tid = 0x10f4

	[0176.686] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000
	[0176.686] __set_app_type (_Type=0x1) 
	[0176.686] __p__fmode () returned 0x74974d6c
	[0176.686] __p__commode () returned 0x74975b1c
	[0176.686] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13b5200) returned 0x0
	[0176.686] __getmainargs (in: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0, _DoWildCard=0, _StartInfo=0x13c60fc | out: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0) returned 0
	[0176.687] GetCurrentThreadId () returned 0x10f4
	[0176.687] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x10f4) returned 0x78
	[0176.687] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0176.687] GetProcAddress (hModule=0x75600000, lpProcName="SetThreadUILanguage") returned 0x75642510
	[0176.687] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0176.697] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0176.697] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2
	[0176.697] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0176.697] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0176.697] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0176.697] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0176.697] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0176.697] GetConsoleOutputCP () returned 0x1b5
	[0176.743] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0176.743] SetConsoleCtrlHandler (HandlerRoutine=0x13c0e40, Add=1) returned 1
	[0176.743] _get_osfhandle (_FileHandle=1) returned 0x154
	[0176.743] SetConsoleMode (hConsoleHandle=0x154, dwMode=0x0) returned 0
	[0176.743] _get_osfhandle (_FileHandle=1) returned 0x154
	[0176.743] GetConsoleMode (in: hConsoleHandle=0x154, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0176.743] _get_osfhandle (_FileHandle=0) returned 0x150
	[0176.743] GetConsoleMode (in: hConsoleHandle=0x150, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0176.743] GetEnvironmentStringsW () returned 0x4a7cb0*
	[0176.743] GetProcessHeap () returned 0x4a0000
	[0176.743] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xa1a) returned 0x4a86d8
	[0176.744] FreeEnvironmentStringsA (penv="A") returned 1
	[0176.744] GetProcessHeap () returned 0x4a0000
	[0176.744] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4) returned 0x4a0550
	[0176.744] GetEnvironmentStringsW () returned 0x4a7cb0*
	[0176.744] GetProcessHeap () returned 0x4a0000
	[0176.744] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xa1a) returned 0x4a9100
	[0176.744] FreeEnvironmentStringsA (penv="A") returned 1
	[0176.744] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0176.744] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0176.744] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0176.744] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0176.744] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0176.744] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0176.744] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0176.744] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0176.744] RegCloseKey (hKey=0x88) returned 0x0
	[0176.745] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0176.745] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0176.745] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0176.745] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0176.745] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0176.745] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0176.745] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0176.745] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0176.745] RegCloseKey (hKey=0x88) returned 0x0
	[0176.745] time (in: timer=0x0 | out: timer=0x0) returned 0x6234423a
	[0176.745] srand (_Seed=0x6234423a) 
	[0176.745] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im mspub.exe \""
	[0176.745] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im mspub.exe \""
	[0176.745] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0176.745] GetProcessHeap () returned 0x4a0000
	[0176.745] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x210) returned 0x4a9b28
	[0176.745] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4a9b30, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0176.746] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0176.746] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0176.746] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0176.746] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0176.746] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0176.746] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0176.746] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0176.746] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0176.746] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0176.746] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0176.746] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0176.746] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0176.746] GetProcessHeap () returned 0x4a0000
	[0176.747] RtlFreeHeap (HeapHandle=0x4a0000, Flags=0x0, BaseAddress=0x4a86d8) returned 1
	[0176.747] GetEnvironmentStringsW () returned 0x4a7cb0*
	[0176.747] GetProcessHeap () returned 0x4a0000
	[0176.747] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xa32) returned 0x4aa780
	[0176.747] FreeEnvironmentStringsA (penv="A") returned 1
	[0176.747] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b
	[0176.747] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0176.747] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0176.747] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0176.747] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0176.747] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0176.747] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0176.747] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0176.747] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0176.747] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0176.747] GetProcessHeap () returned 0x4a0000
	[0176.747] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x44) returned 0x4a05c8
	[0176.747] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0176.748] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19fc4c*="Desktop") returned 0x1d
	[0176.748] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0176.748] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x4a0618
	[0176.748] FindClose (in: hFindFile=0x4a0618 | out: hFindFile=0x4a0618) returned 1
	[0176.748] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x4a0618
	[0176.748] FindClose (in: hFindFile=0x4a0618 | out: hFindFile=0x4a0618) returned 1
	[0176.748] _wcsnicmp (_String1="RDHJ0C~1", _String2="RDhJ0CNFevzX", _MaxCount=0xc) returned 16
	[0176.748] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x4a0618
	[0176.749] FindClose (in: hFindFile=0x4a0618 | out: hFindFile=0x4a0618) returned 1
	[0176.749] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0176.749] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1
	[0176.749] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 1
	[0176.749] GetProcessHeap () returned 0x4a0000
	[0176.749] RtlFreeHeap (HeapHandle=0x4a0000, Flags=0x0, BaseAddress=0x4aa780) returned 1
	[0176.749] GetEnvironmentStringsW () returned 0x4a7cb0*
	[0176.749] GetProcessHeap () returned 0x4a0000
	[0176.749] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xa76) returned 0x4a9d40
	[0176.749] FreeEnvironmentStringsA (penv="=") returned 1
	[0176.749] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0176.749] GetProcessHeap () returned 0x4a0000
	[0176.750] RtlFreeHeap (HeapHandle=0x4a0000, Flags=0x0, BaseAddress=0x4a05c8) returned 1
	[0176.750] GetProcessHeap () returned 0x4a0000
	[0176.750] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x400e) returned 0x4abc40
	[0176.750] GetProcessHeap () returned 0x4a0000
	[0176.750] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x46) returned 0x4aa7c0
	[0176.750] GetProcessHeap () returned 0x4a0000
	[0176.750] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4008) returned 0x4afc58
	[0176.751] GetProcessHeap () returned 0x4a0000
	[0176.751] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x4008) returned 0x4b3c68
	[0176.752] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0176.753] GetProcessHeap () returned 0x4a0000
	[0176.753] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x418) returned 0x4aa810
	[0176.753] SetErrorMode (uMode=0x0) returned 0x8003
	[0176.753] SetErrorMode (uMode=0x1) returned 0x0
	[0176.753] GetFullPathNameW (in: lpFileName="taskkill \\f \\.", nBufferLength=0x208, lpBuffer=0x4aa818, lpFilePart=0x19fbac | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f", lpFilePart=0x19fbac*="f") returned 0x29
	[0176.753] SetErrorMode (uMode=0x8003) returned 0x1
	[0176.753] GetProcessHeap () returned 0x4a0000
	[0176.753] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4aa810, Size=0x78) returned 0x4aa810
	[0176.753] GetProcessHeap () returned 0x4a0000
	[0176.753] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4aa810) returned 0x78
	[0176.753] NeedCurrentDirectoryForExePathW (ExeName="taskkill \\f \\.") returned 1
	[0176.753] GetProcessHeap () returned 0x4a0000
	[0176.753] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x62) returned 0x4aa890
	[0176.753] GetProcessHeap () returned 0x4a0000
	[0176.753] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xb8) returned 0x4aa900
	[0176.753] GetProcessHeap () returned 0x4a0000
	[0176.753] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4aa900, Size=0x62) returned 0x4aa900
	[0176.753] GetProcessHeap () returned 0x4a0000
	[0176.754] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4aa900) returned 0x62
	[0176.754] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0176.754] GetProcessHeap () returned 0x4a0000
	[0176.754] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe0) returned 0x4aa970
	[0176.758] GetProcessHeap () returned 0x4a0000
	[0176.758] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4aa970, Size=0x76) returned 0x4aa970
	[0176.758] GetProcessHeap () returned 0x4a0000
	[0176.758] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4aa970) returned 0x76
	[0176.758] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0176.758] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f\\im mspub.exe ", fInfoLevelId=0x1, lpFindFileData=0x19f958, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f958) returned 0xffffffff
	[0176.758] GetLastError () returned 0x3
	[0176.758] GetProcessHeap () returned 0x4a0000
	[0176.759] RtlFreeHeap (HeapHandle=0x4a0000, Flags=0x0, BaseAddress=0x4afc58) returned 1
	[0176.759] GetProcessHeap () returned 0x4a0000
	[0176.759] RtlFreeHeap (HeapHandle=0x4a0000, Flags=0x0, BaseAddress=0x4b3c68) returned 1
	[0176.759] GetProcessHeap () returned 0x4a0000
	[0176.759] RtlFreeHeap (HeapHandle=0x4a0000, Flags=0x0, BaseAddress=0x4abc40) returned 1
	[0176.759] GetConsoleOutputCP () returned 0x1b5
	[0176.763] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0176.763] GetUserDefaultLCID () returned 0x409
	[0176.763] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x13d34a0, cchData=8 | out: lpLCData=":") returned 2
	[0176.763] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0176.764] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0176.764] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2
	[0176.764] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x13d34b0, cchData=8 | out: lpLCData="/") returned 2
	[0176.764] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x13d3500, cchData=32 | out: lpLCData="Mon") returned 4
	[0176.764] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x13d3540, cchData=32 | out: lpLCData="Tue") returned 4
	[0176.764] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x13d3580, cchData=32 | out: lpLCData="Wed") returned 4
	[0176.764] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x13d35c0, cchData=32 | out: lpLCData="Thu") returned 4
	[0176.764] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x13d3600, cchData=32 | out: lpLCData="Fri") returned 4
	[0176.764] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x13d3640, cchData=32 | out: lpLCData="Sat") returned 4
	[0176.764] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x13d3680, cchData=32 | out: lpLCData="Sun") returned 4
	[0176.764] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x13d34c0, cchData=8 | out: lpLCData=".") returned 2
	[0176.764] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x13d34e0, cchData=8 | out: lpLCData=",") returned 2
	[0176.764] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0176.766] GetProcessHeap () returned 0x4a0000
	[0176.766] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x20c) returned 0x4aaa38
	[0176.766] GetConsoleTitleW (in: lpConsoleTitle=0x4aaa38, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0176.768] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0176.768] GetProcAddress (hModule=0x75600000, lpProcName="CopyFileExW") returned 0x7561ffc0
	[0176.768] GetProcAddress (hModule=0x75600000, lpProcName="IsDebuggerPresent") returned 0x7561b0b0
	[0176.768] GetProcAddress (hModule=0x75600000, lpProcName="SetConsoleInputExeNameW") returned 0x7559b440
	[0176.769] GetProcessHeap () returned 0x4a0000
	[0176.769] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x400a) returned 0x4abc40
	[0176.769] GetProcessHeap () returned 0x4a0000
	[0176.769] RtlFreeHeap (HeapHandle=0x4a0000, Flags=0x0, BaseAddress=0x4abc40) returned 1
	[0176.771] _wcsicmp (_String1="taskkill", _String2=")") returned 75
	[0176.771] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14
	[0176.771] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14
	[0176.771] _wcsicmp (_String1="IF", _String2="taskkill") returned -11
	[0176.771] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11
	[0176.771] _wcsicmp (_String1="REM", _String2="taskkill") returned -2
	[0176.771] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2
	[0176.771] GetProcessHeap () returned 0x4a0000
	[0176.771] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x58) returned 0x4aac50
	[0176.771] GetProcessHeap () returned 0x4a0000
	[0176.771] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x1a) returned 0x4a0578
	[0176.772] GetProcessHeap () returned 0x4a0000
	[0176.772] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x2e) returned 0x4aacb0
	[0176.773] GetConsoleTitleW (in: lpConsoleTitle=0x19fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0176.775] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0176.775] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0176.775] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0176.775] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0176.775] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0176.775] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0176.775] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0176.775] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0176.775] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0176.775] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0176.775] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0176.775] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0176.775] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0176.775] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0176.775] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0176.775] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0176.775] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0176.775] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0176.775] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0176.775] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0176.775] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0176.776] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0176.776] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0176.776] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0176.776] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0176.776] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0176.776] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0176.776] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0176.776] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0176.776] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0176.776] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0176.776] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0176.776] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0176.776] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0176.776] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0176.776] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0176.776] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0176.776] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0176.776] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0176.776] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0176.776] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0176.776] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0176.776] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0176.776] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0176.776] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0176.776] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0176.776] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0176.776] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0176.776] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0176.776] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0176.777] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0176.777] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0176.777] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0176.777] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0176.777] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0176.777] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0176.777] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0176.777] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0176.777] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0176.777] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0176.777] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0176.777] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0176.777] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0176.777] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0176.777] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0176.777] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0176.777] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0176.777] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0176.777] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0176.777] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0176.777] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0176.777] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0176.777] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0176.777] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0176.777] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0176.777] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0176.777] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0176.777] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0176.777] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0176.778] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0176.778] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0176.778] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0176.778] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0176.778] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0176.778] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14
	[0176.778] _wcsicmp (_String1="taskkill", _String2="IF") returned 11
	[0176.778] _wcsicmp (_String1="taskkill", _String2="REM") returned 2
	[0176.778] GetProcessHeap () returned 0x4a0000
	[0176.778] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x210) returned 0x4aace8
	[0176.778] GetProcessHeap () returned 0x4a0000
	[0176.778] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x40) returned 0x4aaf00
	[0176.778] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0176.779] GetProcessHeap () returned 0x4a0000
	[0176.779] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x418) returned 0x4a05c8
	[0176.779] SetErrorMode (uMode=0x0) returned 0x8003
	[0176.779] SetErrorMode (uMode=0x1) returned 0x0
	[0176.779] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4a05d0, lpFilePart=0x19f57c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19f57c*="Desktop") returned 0x1d
	[0176.779] SetErrorMode (uMode=0x8003) returned 0x1
	[0176.779] GetProcessHeap () returned 0x4a0000
	[0176.779] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a05c8, Size=0x56) returned 0x4a05c8
	[0176.779] GetProcessHeap () returned 0x4a0000
	[0176.779] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a05c8) returned 0x56
	[0176.779] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0176.779] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0176.779] GetProcessHeap () returned 0x4a0000
	[0176.779] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x110) returned 0x4aaf48
	[0176.779] GetProcessHeap () returned 0x4a0000
	[0176.779] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x218) returned 0x4a0628
	[0176.784] GetProcessHeap () returned 0x4a0000
	[0176.784] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a0628, Size=0x112) returned 0x4a0628
	[0176.784] GetProcessHeap () returned 0x4a0000
	[0176.784] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4a0628) returned 0x112
	[0176.784] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0176.785] GetProcessHeap () returned 0x4a0000
	[0176.785] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xe0) returned 0x4ab060
	[0176.786] GetProcessHeap () returned 0x4a0000
	[0176.786] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4ab060, Size=0x76) returned 0x4ab060
	[0176.786] GetProcessHeap () returned 0x4a0000
	[0176.786] RtlSizeHeap (HeapHandle=0x4a0000, Flags=0x0, MemoryPointer=0x4ab060) returned 0x76
	[0176.787] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0176.787] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0176.787] GetLastError () returned 0x2
	[0176.787] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0176.787] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x4ab0e0
	[0176.787] GetProcessHeap () returned 0x4a0000
	[0176.787] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x0, Size=0x14) returned 0x4a74b8
	[0176.787] FindClose (in: hFindFile=0x4ab0e0 | out: hFindFile=0x4ab0e0) returned 1
	[0176.788] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0176.788] GetLastError () returned 0x2
	[0176.788] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x4ab0e0
	[0176.788] GetProcessHeap () returned 0x4a0000
	[0176.788] RtlReAllocateHeap (Heap=0x4a0000, Flags=0x0, Ptr=0x4a74b8, Size=0x4) returned 0x4ab120
	[0176.788] FindClose (in: hFindFile=0x4ab0e0 | out: hFindFile=0x4ab0e0) returned 1
	[0176.788] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0176.788] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0176.788] GetConsoleTitleW (in: lpConsoleTitle=0x19f7fc, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0176.791] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f728, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f70c | out: lpAttributeList=0x19f728, lpSize=0x19f70c) returned 1
	[0176.791] UpdateProcThreadAttribute (in: lpAttributeList=0x19f728, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f714, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f728, lpPreviousValue=0x0) returned 1
	[0176.791] GetStartupInfoW (in: lpStartupInfo=0x19f760 | out: lpStartupInfo=0x19f760*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x150, hStdOutput=0x154, hStdError=0x130)) 
	[0176.791] GetProcessHeap () returned 0x4a0000
	[0176.791] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0x18) returned 0x4a76f8
	[0176.791] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0176.791] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0176.791] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0176.792] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0176.792] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0176.792] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0176.792] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0176.792] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0176.792] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0176.792] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0176.792] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0176.792] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0176.792] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0176.792] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0176.792] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0176.792] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0176.792] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0176.792] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0176.792] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0176.792] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0176.792] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0176.792] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0176.792] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0176.792] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0176.792] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0176.792] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0176.792] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0176.792] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0176.792] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0176.792] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0176.793] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0176.793] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0176.793] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0176.793] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0176.793] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0176.793] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0176.793] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0176.793] GetProcessHeap () returned 0x4a0000
	[0176.793] RtlFreeHeap (HeapHandle=0x4a0000, Flags=0x0, BaseAddress=0x4a76f8) returned 1
	[0176.793] GetProcessHeap () returned 0x4a0000
	[0176.793] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xa) returned 0x4ab0e0
	[0176.793] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1
	[0176.796] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill  /f /im mspub.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x19f6b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill  /f /im mspub.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f6fc | out: lpCommandLine="taskkill  /f /im mspub.exe ", lpProcessInformation=0x19f6fc*(hProcess=0x9c, hThread=0x98, dwProcessId=0x1054, dwThreadId=0x10ec)) returned 1
	[0176.813] CloseHandle (hObject=0x98) returned 1
	[0176.813] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0176.813] GetProcessHeap () returned 0x4a0000
	[0176.813] RtlFreeHeap (HeapHandle=0x4a0000, Flags=0x0, BaseAddress=0x4a9d40) returned 1
	[0176.814] GetEnvironmentStringsW () returned 0x4a9d40*
	[0176.814] GetProcessHeap () returned 0x4a0000
	[0176.814] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xa76) returned 0x4abc40
	[0176.814] FreeEnvironmentStringsA (penv="=") returned 1
	[0176.814] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0
	[0177.978] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x19f694 | out: lpExitCode=0x19f694*=0x80) returned 1
	[0177.978] CloseHandle (hObject=0x9c) returned 1
	[0177.978] _vsnwprintf (in: _Buffer=0x19f77c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f69c | out: _Buffer="00000080") returned 8
	[0177.978] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1
	[0177.979] GetProcessHeap () returned 0x4a0000
	[0177.979] RtlFreeHeap (HeapHandle=0x4a0000, Flags=0x0, BaseAddress=0x4abc40) returned 1
	[0177.979] GetEnvironmentStringsW () returned 0x4ab130*
	[0177.979] GetProcessHeap () returned 0x4a0000
	[0177.979] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xa9c) returned 0x4abbd8
	[0177.979] FreeEnvironmentStringsA (penv="=") returned 1
	[0177.979] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0177.979] GetProcessHeap () returned 0x4a0000
	[0177.979] RtlFreeHeap (HeapHandle=0x4a0000, Flags=0x0, BaseAddress=0x4abbd8) returned 1
	[0177.979] GetEnvironmentStringsW () returned 0x4ab130*
	[0177.979] GetProcessHeap () returned 0x4a0000
	[0177.980] RtlAllocateHeap (HeapHandle=0x4a0000, Flags=0x8, Size=0xa9c) returned 0x4abbd8
	[0177.980] FreeEnvironmentStringsA (penv="=") returned 1
	[0177.980] GetProcessHeap () returned 0x4a0000
	[0177.980] RtlFreeHeap (HeapHandle=0x4a0000, Flags=0x0, BaseAddress=0x4ab0e0) returned 1
	[0177.980] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f728 | out: lpAttributeList=0x19f728) 
	[0177.980] _get_osfhandle (_FileHandle=1) returned 0x154
	[0177.980] SetConsoleMode (hConsoleHandle=0x154, dwMode=0x0) returned 0
	[0177.980] _get_osfhandle (_FileHandle=1) returned 0x154
	[0177.980] GetConsoleMode (in: hConsoleHandle=0x154, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0177.980] _get_osfhandle (_FileHandle=0) returned 0x150
	[0177.980] GetConsoleMode (in: hConsoleHandle=0x150, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0177.980] GetConsoleOutputCP () returned 0x1b5
	[0177.984] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0177.984] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0177.986] exit (_Code=128) 

Thread:
	id = 315
	os_tid = 0x10f0


Process:
	id = "60"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\syswow64\\taskkill.exe"
	page_root = "0x311fc000"
	os_pid = "0x1054"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "59"
	os_parent_pid = "0x92c"
	cmd_line = "taskkill  /f /im mspub.exe "
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 4362
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 4363
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 4364
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 4365
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 4366
	        start_va = 0xa0000
	          end_va = 0xdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 4367
	        start_va = 0xe0000
	          end_va = 0xe3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 4368
	        start_va = 0xf0000
	          end_va = 0xf0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 4369
	        start_va = 0x100000
	          end_va = 0x101fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 4370
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 4371
	        start_va = 0x13b0000
	          end_va = 0x13c5fff
	       monitored = 0
	     entry_point = 0x13bde80
	     region_type = mapped_file
	            name = "taskkill.exe"
	        filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe")

Region:
	              id = 4372
	        start_va = 0x13d0000
	          end_va = 0x53cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000013d0000"
	        filename = ""

Region:
	              id = 4373
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 4374
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 4375
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 4376
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 4377
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 4378
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 4379
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 4380
	        start_va = 0x540000
	          end_va = 0x54ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000540000"
	        filename = ""

Region:
	              id = 4381
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 4382
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 4383
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 4384
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 4385
	        start_va = 0x550000
	          end_va = 0x71ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000550000"
	        filename = ""

Region:
	              id = 4386
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 4387
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 4388
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 4389
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 4390
	        start_va = 0x110000
	          end_va = 0x1cdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 4391
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 4392
	        start_va = 0x74650000
	          end_va = 0x746cafff
	       monitored = 0
	     entry_point = 0x7466e970
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 4393
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 4394
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 4395
	        start_va = 0x440000
	          end_va = 0x47ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000440000"
	        filename = ""

Region:
	              id = 4396
	        start_va = 0x76ae0000
	          end_va = 0x76b23fff
	       monitored = 0
	     entry_point = 0x76af9d80
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 4397
	        start_va = 0x75260000
	          end_va = 0x7530cfff
	       monitored = 0
	     entry_point = 0x75274f00
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 4398
	        start_va = 0x74450000
	          end_va = 0x7446dfff
	       monitored = 0
	     entry_point = 0x7445b640
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 4399
	        start_va = 0x74440000
	          end_va = 0x74449fff
	       monitored = 0
	     entry_point = 0x74442a00
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 4400
	        start_va = 0x74590000
	          end_va = 0x745e7fff
	       monitored = 0
	     entry_point = 0x745d25c0
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 4401
	        start_va = 0x77450000
	          end_va = 0x77596fff
	       monitored = 0
	     entry_point = 0x77461cf0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 4402
	        start_va = 0x76b30000
	          end_va = 0x76c7efff
	       monitored = 0
	     entry_point = 0x76be6820
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 4403
	        start_va = 0x753c0000
	          end_va = 0x75451fff
	       monitored = 0
	     entry_point = 0x753f8cf0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 4404
	        start_va = 0x77290000
	          end_va = 0x7744cfff
	       monitored = 0
	     entry_point = 0x77372a10
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")

Region:
	              id = 4405
	        start_va = 0x75310000
	          end_va = 0x7536efff
	       monitored = 0
	     entry_point = 0x75314af0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 4406
	        start_va = 0x77240000
	          end_va = 0x77284fff
	       monitored = 0
	     entry_point = 0x7725de90
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 4407
	        start_va = 0x6cc90000
	          end_va = 0x6cc97fff
	       monitored = 0
	     entry_point = 0x6cc917b0
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 4408
	        start_va = 0x6cc70000
	          end_va = 0x6cc85fff
	       monitored = 0
	     entry_point = 0x6cc721d0
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")

Region:
	              id = 4409
	        start_va = 0x6cc30000
	          end_va = 0x6cc6efff
	       monitored = 0
	     entry_point = 0x6cc446c0
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll")

Region:
	              id = 4410
	        start_va = 0x6caf0000
	          end_va = 0x6cc2efff
	       monitored = 0
	     entry_point = 0x6cb1d880
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll")

Region:
	              id = 4411
	        start_va = 0x6cad0000
	          end_va = 0x6caebfff
	       monitored = 0
	     entry_point = 0x6cad4720
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")

Region:
	              id = 4412
	        start_va = 0x6cac0000
	          end_va = 0x6cac9fff
	       monitored = 0
	     entry_point = 0x6cac28d0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")

Region:
	              id = 4413
	        start_va = 0x720000
	          end_va = 0x8affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000720000"
	        filename = ""

Region:
	              id = 4414
	        start_va = 0x1d0000
	          end_va = 0x1f9fff
	       monitored = 0
	     entry_point = 0x1d5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 4415
	        start_va = 0x8b0000
	          end_va = 0xa37fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000008b0000"
	        filename = ""

Region:
	              id = 4416
	        start_va = 0x74ea0000
	          end_va = 0x74ecafff
	       monitored = 0
	     entry_point = 0x74ea5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 4417
	        start_va = 0xa40000
	          end_va = 0xbc0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000a40000"
	        filename = ""

Region:
	              id = 4418
	        start_va = 0x53d0000
	          end_va = 0x67cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000053d0000"
	        filename = ""

Region:
	              id = 4419
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 4420
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001d0000"
	        filename = ""

Region:
	              id = 4421
	        start_va = 0x1e0000
	          end_va = 0x1e4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taskkill.exe.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui")

Region:
	              id = 4422
	        start_va = 0x1f0000
	          end_va = 0x1f0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001f0000"
	        filename = ""

Region:
	              id = 4423
	        start_va = 0x480000
	          end_va = 0x480fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 4424
	        start_va = 0xbd0000
	          end_va = 0xf06fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 4425
	        start_va = 0x720000
	          end_va = 0x809fff
	       monitored = 0
	     entry_point = 0x75d650
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 4426
	        start_va = 0x8a0000
	          end_va = 0x8affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000008a0000"
	        filename = ""

Region:
	              id = 4427
	        start_va = 0x490000
	          end_va = 0x493fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000490000"
	        filename = ""

Region:
	              id = 4428
	        start_va = 0x720000
	          end_va = 0x7fffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 4429
	        start_va = 0x76e20000
	          end_va = 0x76e2bfff
	       monitored = 0
	     entry_point = 0x76e23930
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")

Region:
	              id = 4430
	        start_va = 0x4a0000
	          end_va = 0x4a0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004a0000"
	        filename = ""

Region:
	              id = 4431
	        start_va = 0x76c80000
	          end_va = 0x76d03fff
	       monitored = 0
	     entry_point = 0x76ca6220
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 4432
	        start_va = 0x4b0000
	          end_va = 0x4b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004b0000"
	        filename = ""

Region:
	              id = 4433
	        start_va = 0x6cab0000
	          end_va = 0x6cabcfff
	       monitored = 0
	     entry_point = 0x6cab3520
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 4434
	        start_va = 0x6ca40000
	          end_va = 0x6caa6fff
	       monitored = 0
	     entry_point = 0x6ca5b610
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 4435
	        start_va = 0x740f0000
	          end_va = 0x7410afff
	       monitored = 0
	     entry_point = 0x740f9050
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 4436
	        start_va = 0x6c9f0000
	          end_va = 0x6ca33fff
	       monitored = 0
	     entry_point = 0x6ca0aaf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")

Region:
	              id = 4437
	        start_va = 0x4c0000
	          end_va = 0x4fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004c0000"
	        filename = ""

Region:
	              id = 4438
	        start_va = 0x500000
	          end_va = 0x53ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000500000"
	        filename = ""

Region:
	              id = 4439
	        start_va = 0x550000
	          end_va = 0x58ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000550000"
	        filename = ""

Region:
	              id = 4440
	        start_va = 0x590000
	          end_va = 0x5cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000590000"
	        filename = ""

Region:
	              id = 4441
	        start_va = 0x5d0000
	          end_va = 0x60ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005d0000"
	        filename = ""

Region:
	              id = 4442
	        start_va = 0x620000
	          end_va = 0x71ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000620000"
	        filename = ""

Region:
	              id = 4443
	        start_va = 0x800000
	          end_va = 0x83ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000800000"
	        filename = ""

Region:
	              id = 4444
	        start_va = 0x6c9d0000
	          end_va = 0x6c9e0fff
	       monitored = 0
	     entry_point = 0x6c9d8fa0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 4445
	        start_va = 0x6c910000
	          end_va = 0x6c9cefff
	       monitored = 0
	     entry_point = 0x6c941e80
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 4447
	        start_va = 0x610000
	          end_va = 0x615fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000610000"
	        filename = ""


Thread:
	id = 316
	os_tid = 0x10ec


Thread:
	id = 317
	os_tid = 0x1058


Thread:
	id = 318
	os_tid = 0x1048


Thread:
	id = 319
	os_tid = 0x1044


Thread:
	id = 320
	os_tid = 0x1030


Process:
	id = "61"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x31103000"
	os_pid = "0x101c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x614"
	cmd_line = "cmd.exe /c \"taskkill /f /im onenote.exe \""
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 4450
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 4451
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 4452
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 4453
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 4454
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 4455
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 4456
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 4457
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 4458
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 4459
	        start_va = 0x13a0000
	          end_va = 0x13f1fff
	       monitored = 1
	     entry_point = 0x13b4fd0
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")

Region:
	              id = 4460
	        start_va = 0x1400000
	          end_va = 0x53fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001400000"
	        filename = ""

Region:
	              id = 4461
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 4462
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 4463
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 4464
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 4465
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 4466
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 4467
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 4468
	        start_va = 0x530000
	          end_va = 0x53ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000530000"
	        filename = ""

Region:
	              id = 4469
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 4470
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 4471
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 4472
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 4473
	        start_va = 0x540000
	          end_va = 0x7affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000540000"
	        filename = ""

Region:
	              id = 4474
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 4475
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 4476
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 4477
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 4478
	        start_va = 0x400000
	          end_va = 0x4bdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 4479
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 4480
	        start_va = 0x4c0000
	          end_va = 0x4fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004c0000"
	        filename = ""

Region:
	              id = 4481
	        start_va = 0x540000
	          end_va = 0x63ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000540000"
	        filename = ""

Region:
	              id = 4482
	        start_va = 0x6b0000
	          end_va = 0x7affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006b0000"
	        filename = ""

Region:
	              id = 4483
	        start_va = 0x7b0000
	          end_va = 0x9affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000007b0000"
	        filename = ""

Region:
	              id = 4484
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 4485
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 4486
	        start_va = 0x9b0000
	          end_va = 0xce6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 321
	os_tid = 0x908

	[0178.187] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000
	[0178.187] __set_app_type (_Type=0x1) 
	[0178.187] __p__fmode () returned 0x74974d6c
	[0178.187] __p__commode () returned 0x74975b1c
	[0178.189] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13b5200) returned 0x0
	[0178.189] __getmainargs (in: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0, _DoWildCard=0, _StartInfo=0x13c60fc | out: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0) returned 0
	[0178.189] GetCurrentThreadId () returned 0x908
	[0178.189] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x908) returned 0x78
	[0178.189] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0178.190] GetProcAddress (hModule=0x75600000, lpProcName="SetThreadUILanguage") returned 0x75642510
	[0178.190] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0178.199] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0178.199] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2
	[0178.199] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0178.199] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0178.199] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0178.199] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0178.199] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0178.199] GetConsoleOutputCP () returned 0x1b5
	[0178.201] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0178.201] SetConsoleCtrlHandler (HandlerRoutine=0x13c0e40, Add=1) returned 1
	[0178.201] _get_osfhandle (_FileHandle=1) returned 0x150
	[0178.201] SetConsoleMode (hConsoleHandle=0x150, dwMode=0x0) returned 0
	[0178.201] _get_osfhandle (_FileHandle=1) returned 0x150
	[0178.201] GetConsoleMode (in: hConsoleHandle=0x150, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0178.201] _get_osfhandle (_FileHandle=0) returned 0x144
	[0178.201] GetConsoleMode (in: hConsoleHandle=0x144, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0178.201] GetEnvironmentStringsW () returned 0x6b7cc0*
	[0178.201] GetProcessHeap () returned 0x6b0000
	[0178.202] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xa1a) returned 0x6b86e8
	[0178.202] FreeEnvironmentStringsA (penv="A") returned 1
	[0178.202] GetProcessHeap () returned 0x6b0000
	[0178.202] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x4) returned 0x6b0550
	[0178.202] GetEnvironmentStringsW () returned 0x6b7cc0*
	[0178.202] GetProcessHeap () returned 0x6b0000
	[0178.202] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xa1a) returned 0x6b9110
	[0178.202] FreeEnvironmentStringsA (penv="A") returned 1
	[0178.202] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0178.203] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0178.203] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0178.203] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0178.203] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0178.203] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0178.203] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0178.203] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0178.203] RegCloseKey (hKey=0x88) returned 0x0
	[0178.203] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0178.203] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0178.203] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0178.203] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0178.204] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0178.204] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0178.204] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0178.204] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0178.204] RegCloseKey (hKey=0x88) returned 0x0
	[0178.204] time (in: timer=0x0 | out: timer=0x0) returned 0x6234423c
	[0178.204] srand (_Seed=0x6234423c) 
	[0178.204] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im onenote.exe \""
	[0178.204] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im onenote.exe \""
	[0178.204] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0178.204] GetProcessHeap () returned 0x6b0000
	[0178.204] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x210) returned 0x6b9b38
	[0178.204] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6b9b40, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0178.205] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0178.205] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0178.205] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0178.205] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0178.205] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0178.205] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0178.205] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0178.205] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0178.205] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0178.205] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0178.205] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0178.205] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0178.206] GetProcessHeap () returned 0x6b0000
	[0178.206] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6b86e8) returned 1
	[0178.206] GetEnvironmentStringsW () returned 0x6b7cc0*
	[0178.206] GetProcessHeap () returned 0x6b0000
	[0178.206] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xa32) returned 0x6ba790
	[0178.206] FreeEnvironmentStringsA (penv="A") returned 1
	[0178.206] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b
	[0178.206] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0178.206] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0178.207] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0178.207] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0178.207] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0178.207] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0178.207] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0178.207] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0178.207] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0178.207] GetProcessHeap () returned 0x6b0000
	[0178.207] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x44) returned 0x6b05c8
	[0178.207] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0178.207] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19fc4c*="Desktop") returned 0x1d
	[0178.207] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0178.207] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x6b0618
	[0178.208] FindClose (in: hFindFile=0x6b0618 | out: hFindFile=0x6b0618) returned 1
	[0178.208] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x6b0618
	[0178.208] FindClose (in: hFindFile=0x6b0618 | out: hFindFile=0x6b0618) returned 1
	[0178.208] _wcsnicmp (_String1="RDHJ0C~1", _String2="RDhJ0CNFevzX", _MaxCount=0xc) returned 16
	[0178.208] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x6b0618
	[0178.208] FindClose (in: hFindFile=0x6b0618 | out: hFindFile=0x6b0618) returned 1
	[0178.208] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0178.209] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1
	[0178.209] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 1
	[0178.209] GetProcessHeap () returned 0x6b0000
	[0178.209] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6ba790) returned 1
	[0178.209] GetEnvironmentStringsW () returned 0x6b7cc0*
	[0178.209] GetProcessHeap () returned 0x6b0000
	[0178.209] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xa76) returned 0x6b9d50
	[0178.209] FreeEnvironmentStringsA (penv="=") returned 1
	[0178.209] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0178.209] GetProcessHeap () returned 0x6b0000
	[0178.210] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6b05c8) returned 1
	[0178.211] GetProcessHeap () returned 0x6b0000
	[0178.211] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x400e) returned 0x6bbc50
	[0178.211] GetProcessHeap () returned 0x6b0000
	[0178.211] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x4a) returned 0x6ba7d0
	[0178.211] GetProcessHeap () returned 0x6b0000
	[0178.212] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x4008) returned 0x6bfc68
	[0178.212] GetProcessHeap () returned 0x6b0000
	[0178.212] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x4008) returned 0x6c3c78
	[0178.214] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0178.214] GetProcessHeap () returned 0x6b0000
	[0178.214] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x418) returned 0x6ba828
	[0178.214] SetErrorMode (uMode=0x0) returned 0x8003
	[0178.215] SetErrorMode (uMode=0x1) returned 0x0
	[0178.215] GetFullPathNameW (in: lpFileName="taskkill \\f \\.", nBufferLength=0x208, lpBuffer=0x6ba830, lpFilePart=0x19fbac | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f", lpFilePart=0x19fbac*="f") returned 0x29
	[0178.215] SetErrorMode (uMode=0x8003) returned 0x1
	[0178.215] GetProcessHeap () returned 0x6b0000
	[0178.215] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6ba828, Size=0x7c) returned 0x6ba828
	[0178.215] GetProcessHeap () returned 0x6b0000
	[0178.215] RtlSizeHeap (HeapHandle=0x6b0000, Flags=0x0, MemoryPointer=0x6ba828) returned 0x7c
	[0178.215] NeedCurrentDirectoryForExePathW (ExeName="taskkill \\f \\.") returned 1
	[0178.215] GetProcessHeap () returned 0x6b0000
	[0178.215] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x62) returned 0x6ba8b0
	[0178.215] GetProcessHeap () returned 0x6b0000
	[0178.215] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xb8) returned 0x6ba920
	[0178.215] GetProcessHeap () returned 0x6b0000
	[0178.215] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6ba920, Size=0x62) returned 0x6ba920
	[0178.215] GetProcessHeap () returned 0x6b0000
	[0178.216] RtlSizeHeap (HeapHandle=0x6b0000, Flags=0x0, MemoryPointer=0x6ba920) returned 0x62
	[0178.216] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0178.216] GetProcessHeap () returned 0x6b0000
	[0178.216] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xe0) returned 0x6ba990
	[0178.221] GetProcessHeap () returned 0x6b0000
	[0178.221] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6ba990, Size=0x76) returned 0x6ba990
	[0178.221] GetProcessHeap () returned 0x6b0000
	[0178.221] RtlSizeHeap (HeapHandle=0x6b0000, Flags=0x0, MemoryPointer=0x6ba990) returned 0x76
	[0178.221] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0178.222] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f\\im onenote.exe ", fInfoLevelId=0x1, lpFindFileData=0x19f958, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f958) returned 0xffffffff
	[0178.222] GetLastError () returned 0x3
	[0178.222] GetProcessHeap () returned 0x6b0000
	[0178.222] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6bfc68) returned 1
	[0178.225] GetProcessHeap () returned 0x6b0000
	[0178.225] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c3c78) returned 1
	[0178.225] GetProcessHeap () returned 0x6b0000
	[0178.225] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6bbc50) returned 1
	[0178.225] GetConsoleOutputCP () returned 0x1b5
	[0178.227] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0178.227] GetUserDefaultLCID () returned 0x409
	[0178.227] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x13d34a0, cchData=8 | out: lpLCData=":") returned 2
	[0178.227] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0178.227] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0178.228] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2
	[0178.228] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x13d34b0, cchData=8 | out: lpLCData="/") returned 2
	[0178.228] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x13d3500, cchData=32 | out: lpLCData="Mon") returned 4
	[0178.228] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x13d3540, cchData=32 | out: lpLCData="Tue") returned 4
	[0178.228] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x13d3580, cchData=32 | out: lpLCData="Wed") returned 4
	[0178.228] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x13d35c0, cchData=32 | out: lpLCData="Thu") returned 4
	[0178.228] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x13d3600, cchData=32 | out: lpLCData="Fri") returned 4
	[0178.228] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x13d3640, cchData=32 | out: lpLCData="Sat") returned 4
	[0178.228] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x13d3680, cchData=32 | out: lpLCData="Sun") returned 4
	[0178.228] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x13d34c0, cchData=8 | out: lpLCData=".") returned 2
	[0178.228] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x13d34e0, cchData=8 | out: lpLCData=",") returned 2
	[0178.228] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0178.230] GetProcessHeap () returned 0x6b0000
	[0178.230] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x20c) returned 0x6baa58
	[0178.230] GetConsoleTitleW (in: lpConsoleTitle=0x6baa58, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0178.231] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0178.231] GetProcAddress (hModule=0x75600000, lpProcName="CopyFileExW") returned 0x7561ffc0
	[0178.231] GetProcAddress (hModule=0x75600000, lpProcName="IsDebuggerPresent") returned 0x7561b0b0
	[0178.231] GetProcAddress (hModule=0x75600000, lpProcName="SetConsoleInputExeNameW") returned 0x7559b440
	[0178.232] GetProcessHeap () returned 0x6b0000
	[0178.232] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x400a) returned 0x6bbc50
	[0178.232] GetProcessHeap () returned 0x6b0000
	[0178.232] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6bbc50) returned 1
	[0178.233] _wcsicmp (_String1="taskkill", _String2=")") returned 75
	[0178.233] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14
	[0178.233] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14
	[0178.234] _wcsicmp (_String1="IF", _String2="taskkill") returned -11
	[0178.234] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11
	[0178.234] _wcsicmp (_String1="REM", _String2="taskkill") returned -2
	[0178.234] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2
	[0178.234] GetProcessHeap () returned 0x6b0000
	[0178.234] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x58) returned 0x6bac70
	[0178.234] GetProcessHeap () returned 0x6b0000
	[0178.234] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6b0578
	[0178.235] GetProcessHeap () returned 0x6b0000
	[0178.235] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x32) returned 0x6bacd0
	[0178.236] GetConsoleTitleW (in: lpConsoleTitle=0x19fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0178.238] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0178.238] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0178.238] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0178.239] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0178.239] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0178.239] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0178.239] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0178.239] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0178.239] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0178.239] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0178.239] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0178.239] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0178.239] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0178.239] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0178.239] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0178.239] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0178.239] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0178.239] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0178.239] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0178.239] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0178.239] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0178.239] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0178.239] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0178.239] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0178.239] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0178.239] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0178.239] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0178.240] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0178.240] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0178.240] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0178.240] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0178.240] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0178.240] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0178.240] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0178.240] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0178.240] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0178.240] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0178.240] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0178.240] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0178.240] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0178.240] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0178.240] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0178.240] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0178.240] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0178.240] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0178.240] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0178.240] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0178.240] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0178.240] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0178.240] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0178.240] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0178.241] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0178.241] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0178.241] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0178.241] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0178.241] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0178.241] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0178.241] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0178.241] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0178.241] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0178.241] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0178.241] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0178.241] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0178.241] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0178.241] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0178.241] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0178.241] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0178.241] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0178.241] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0178.241] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0178.241] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0178.241] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0178.241] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0178.241] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0178.241] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0178.241] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0178.241] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0178.242] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0178.242] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0178.242] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0178.242] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0178.242] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0178.242] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0178.242] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0178.242] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14
	[0178.242] _wcsicmp (_String1="taskkill", _String2="IF") returned 11
	[0178.242] _wcsicmp (_String1="taskkill", _String2="REM") returned 2
	[0178.243] GetProcessHeap () returned 0x6b0000
	[0178.243] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x210) returned 0x6bad10
	[0178.243] GetProcessHeap () returned 0x6b0000
	[0178.243] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x44) returned 0x6baf28
	[0178.243] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0178.244] GetProcessHeap () returned 0x6b0000
	[0178.244] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x418) returned 0x6b05c8
	[0178.244] SetErrorMode (uMode=0x0) returned 0x8003
	[0178.244] SetErrorMode (uMode=0x1) returned 0x0
	[0178.244] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x6b05d0, lpFilePart=0x19f57c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19f57c*="Desktop") returned 0x1d
	[0178.244] SetErrorMode (uMode=0x8003) returned 0x1
	[0178.244] GetProcessHeap () returned 0x6b0000
	[0178.244] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6b05c8, Size=0x56) returned 0x6b05c8
	[0178.244] GetProcessHeap () returned 0x6b0000
	[0178.244] RtlSizeHeap (HeapHandle=0x6b0000, Flags=0x0, MemoryPointer=0x6b05c8) returned 0x56
	[0178.244] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0178.244] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0178.244] GetProcessHeap () returned 0x6b0000
	[0178.245] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x110) returned 0x6baf78
	[0178.245] GetProcessHeap () returned 0x6b0000
	[0178.245] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x218) returned 0x6b0628
	[0178.251] GetProcessHeap () returned 0x6b0000
	[0178.251] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6b0628, Size=0x112) returned 0x6b0628
	[0178.251] GetProcessHeap () returned 0x6b0000
	[0178.251] RtlSizeHeap (HeapHandle=0x6b0000, Flags=0x0, MemoryPointer=0x6b0628) returned 0x112
	[0178.251] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0178.251] GetProcessHeap () returned 0x6b0000
	[0178.251] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xe0) returned 0x6bb090
	[0178.253] GetProcessHeap () returned 0x6b0000
	[0178.253] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6bb090, Size=0x76) returned 0x6bb090
	[0178.253] GetProcessHeap () returned 0x6b0000
	[0178.253] RtlSizeHeap (HeapHandle=0x6b0000, Flags=0x0, MemoryPointer=0x6bb090) returned 0x76
	[0178.254] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0178.254] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0178.254] GetLastError () returned 0x2
	[0178.254] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0178.255] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x6bb110
	[0178.255] GetProcessHeap () returned 0x6b0000
	[0178.255] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x14) returned 0x6b7568
	[0178.255] FindClose (in: hFindFile=0x6bb110 | out: hFindFile=0x6bb110) returned 1
	[0178.255] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0178.255] GetLastError () returned 0x2
	[0178.255] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x6bb110
	[0178.256] GetProcessHeap () returned 0x6b0000
	[0178.256] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6b7568, Size=0x4) returned 0x6bb150
	[0178.256] FindClose (in: hFindFile=0x6bb110 | out: hFindFile=0x6bb110) returned 1
	[0178.256] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0178.256] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0178.256] GetConsoleTitleW (in: lpConsoleTitle=0x19f7fc, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0178.259] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f728, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f70c | out: lpAttributeList=0x19f728, lpSize=0x19f70c) returned 1
	[0178.259] UpdateProcThreadAttribute (in: lpAttributeList=0x19f728, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f714, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f728, lpPreviousValue=0x0) returned 1
	[0178.259] GetStartupInfoW (in: lpStartupInfo=0x19f760 | out: lpStartupInfo=0x19f760*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x144, hStdOutput=0x150, hStdError=0x154)) 
	[0178.259] GetProcessHeap () returned 0x6b0000
	[0178.259] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6b7688
	[0178.259] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0178.259] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0178.259] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0178.259] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0178.259] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0178.260] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0178.260] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0178.260] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0178.260] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0178.260] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0178.260] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0178.260] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0178.260] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0178.260] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0178.260] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0178.260] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0178.260] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0178.260] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0178.260] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0178.260] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0178.260] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0178.260] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0178.260] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0178.260] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0178.260] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0178.260] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0178.260] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0178.260] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0178.260] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0178.260] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0178.260] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0178.261] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0178.261] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0178.261] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0178.261] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0178.261] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0178.261] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0178.261] GetProcessHeap () returned 0x6b0000
	[0178.261] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6b7688) returned 1
	[0178.261] GetProcessHeap () returned 0x6b0000
	[0178.261] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xa) returned 0x6bb110
	[0178.261] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1
	[0178.264] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill  /f /im onenote.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x19f6b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill  /f /im onenote.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f6fc | out: lpCommandLine="taskkill  /f /im onenote.exe ", lpProcessInformation=0x19f6fc*(hProcess=0x9c, hThread=0x98, dwProcessId=0xe10, dwThreadId=0x6c4)) returned 1
	[0178.286] CloseHandle (hObject=0x98) returned 1
	[0178.287] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0178.287] GetProcessHeap () returned 0x6b0000
	[0178.287] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6b9d50) returned 1
	[0178.288] GetEnvironmentStringsW () returned 0x6b9d50*
	[0178.289] GetProcessHeap () returned 0x6b0000
	[0178.289] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xa76) returned 0x6b7cc0
	[0178.289] FreeEnvironmentStringsA (penv="=") returned 1
	[0178.289] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0
	[0179.207] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x19f694 | out: lpExitCode=0x19f694*=0x80) returned 1
	[0179.207] CloseHandle (hObject=0x9c) returned 1
	[0179.207] _vsnwprintf (in: _Buffer=0x19f77c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f69c | out: _Buffer="00000080") returned 8
	[0179.208] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1
	[0179.208] GetProcessHeap () returned 0x6b0000
	[0179.208] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6b7cc0) returned 1
	[0179.208] GetEnvironmentStringsW () returned 0x6bb160*
	[0179.209] GetProcessHeap () returned 0x6b0000
	[0179.209] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xa9c) returned 0x6b7cc0
	[0179.209] FreeEnvironmentStringsA (penv="=") returned 1
	[0179.209] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0179.209] GetProcessHeap () returned 0x6b0000
	[0179.209] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6b7cc0) returned 1
	[0179.209] GetEnvironmentStringsW () returned 0x6bb160*
	[0179.209] GetProcessHeap () returned 0x6b0000
	[0179.209] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xa9c) returned 0x6b7cc0
	[0179.209] FreeEnvironmentStringsA (penv="=") returned 1
	[0179.209] GetProcessHeap () returned 0x6b0000
	[0179.209] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6bb110) returned 1
	[0179.209] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f728 | out: lpAttributeList=0x19f728) 
	[0179.209] _get_osfhandle (_FileHandle=1) returned 0x150
	[0179.209] SetConsoleMode (hConsoleHandle=0x150, dwMode=0x0) returned 0
	[0179.209] _get_osfhandle (_FileHandle=1) returned 0x150
	[0179.209] GetConsoleMode (in: hConsoleHandle=0x150, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0179.209] _get_osfhandle (_FileHandle=0) returned 0x144
	[0179.209] GetConsoleMode (in: hConsoleHandle=0x144, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0179.209] GetConsoleOutputCP () returned 0x1b5
	[0179.211] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0179.211] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0179.213] exit (_Code=128) 

Thread:
	id = 322
	os_tid = 0x668


Process:
	id = "62"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\syswow64\\taskkill.exe"
	page_root = "0x30ef5000"
	os_pid = "0xe10"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "61"
	os_parent_pid = "0x101c"
	cmd_line = "taskkill  /f /im onenote.exe "
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 4487
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 4488
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 4489
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 4490
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 4491
	        start_va = 0xa0000
	          end_va = 0xdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 4492
	        start_va = 0xe0000
	          end_va = 0xe3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 4493
	        start_va = 0xf0000
	          end_va = 0xf0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 4494
	        start_va = 0x100000
	          end_va = 0x101fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 4495
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 4496
	        start_va = 0x13b0000
	          end_va = 0x13c5fff
	       monitored = 0
	     entry_point = 0x13bde80
	     region_type = mapped_file
	            name = "taskkill.exe"
	        filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe")

Region:
	              id = 4497
	        start_va = 0x13d0000
	          end_va = 0x53cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000013d0000"
	        filename = ""

Region:
	              id = 4498
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 4499
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 4500
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 4501
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 4502
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 4503
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 4504
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 4505
	        start_va = 0x1c0000
	          end_va = 0x1cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 4506
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 4507
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 4508
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 4509
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 4510
	        start_va = 0x400000
	          end_va = 0x69ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 4511
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 4512
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 4513
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 4514
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 4515
	        start_va = 0x400000
	          end_va = 0x4bdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 4516
	        start_va = 0x5a0000
	          end_va = 0x69ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005a0000"
	        filename = ""

Region:
	              id = 4517
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 4518
	        start_va = 0x74650000
	          end_va = 0x746cafff
	       monitored = 0
	     entry_point = 0x7466e970
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 4519
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 4520
	        start_va = 0x110000
	          end_va = 0x14ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000110000"
	        filename = ""

Region:
	              id = 4521
	        start_va = 0x150000
	          end_va = 0x18ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000150000"
	        filename = ""

Region:
	              id = 4522
	        start_va = 0x76ae0000
	          end_va = 0x76b23fff
	       monitored = 0
	     entry_point = 0x76af9d80
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 4523
	        start_va = 0x75260000
	          end_va = 0x7530cfff
	       monitored = 0
	     entry_point = 0x75274f00
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 4524
	        start_va = 0x74450000
	          end_va = 0x7446dfff
	       monitored = 0
	     entry_point = 0x7445b640
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 4525
	        start_va = 0x74440000
	          end_va = 0x74449fff
	       monitored = 0
	     entry_point = 0x74442a00
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 4526
	        start_va = 0x74590000
	          end_va = 0x745e7fff
	       monitored = 0
	     entry_point = 0x745d25c0
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 4527
	        start_va = 0x77450000
	          end_va = 0x77596fff
	       monitored = 0
	     entry_point = 0x77461cf0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 4528
	        start_va = 0x76b30000
	          end_va = 0x76c7efff
	       monitored = 0
	     entry_point = 0x76be6820
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 4529
	        start_va = 0x753c0000
	          end_va = 0x75451fff
	       monitored = 0
	     entry_point = 0x753f8cf0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 4530
	        start_va = 0x77290000
	          end_va = 0x7744cfff
	       monitored = 0
	     entry_point = 0x77372a10
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")

Region:
	              id = 4531
	        start_va = 0x75310000
	          end_va = 0x7536efff
	       monitored = 0
	     entry_point = 0x75314af0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 4532
	        start_va = 0x77240000
	          end_va = 0x77284fff
	       monitored = 0
	     entry_point = 0x7725de90
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 4533
	        start_va = 0x6cc90000
	          end_va = 0x6cc97fff
	       monitored = 0
	     entry_point = 0x6cc917b0
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 4534
	        start_va = 0x6cc70000
	          end_va = 0x6cc85fff
	       monitored = 0
	     entry_point = 0x6cc721d0
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")

Region:
	              id = 4535
	        start_va = 0x6cc30000
	          end_va = 0x6cc6efff
	       monitored = 0
	     entry_point = 0x6cc446c0
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll")

Region:
	              id = 4536
	        start_va = 0x6caf0000
	          end_va = 0x6cc2efff
	       monitored = 0
	     entry_point = 0x6cb1d880
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll")

Region:
	              id = 4537
	        start_va = 0x6cad0000
	          end_va = 0x6caebfff
	       monitored = 0
	     entry_point = 0x6cad4720
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")

Region:
	              id = 4538
	        start_va = 0x6cac0000
	          end_va = 0x6cac9fff
	       monitored = 0
	     entry_point = 0x6cac28d0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")

Region:
	              id = 4539
	        start_va = 0x4c0000
	          end_va = 0x56ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004c0000"
	        filename = ""

Region:
	              id = 4540
	        start_va = 0x190000
	          end_va = 0x1b9fff
	       monitored = 0
	     entry_point = 0x195680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 4541
	        start_va = 0x6a0000
	          end_va = 0x827fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000006a0000"
	        filename = ""

Region:
	              id = 4542
	        start_va = 0x74ea0000
	          end_va = 0x74ecafff
	       monitored = 0
	     entry_point = 0x74ea5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 4543
	        start_va = 0x830000
	          end_va = 0x9b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000830000"
	        filename = ""

Region:
	              id = 4544
	        start_va = 0x53d0000
	          end_va = 0x67cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000053d0000"
	        filename = ""

Region:
	              id = 4545
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 4546
	        start_va = 0x190000
	          end_va = 0x190fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000190000"
	        filename = ""

Region:
	              id = 4547
	        start_va = 0x1a0000
	          end_va = 0x1a4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taskkill.exe.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui")

Region:
	              id = 4548
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001b0000"
	        filename = ""

Region:
	              id = 4549
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001d0000"
	        filename = ""

Region:
	              id = 4550
	        start_va = 0x9c0000
	          end_va = 0xcf6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 4551
	        start_va = 0xd00000
	          end_va = 0xde9fff
	       monitored = 0
	     entry_point = 0xd3d650
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 4552
	        start_va = 0x1e0000
	          end_va = 0x1e3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001e0000"
	        filename = ""

Region:
	              id = 4553
	        start_va = 0xd00000
	          end_va = 0xddffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 4554
	        start_va = 0x76e20000
	          end_va = 0x76e2bfff
	       monitored = 0
	     entry_point = 0x76e23930
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")

Region:
	              id = 4555
	        start_va = 0x1f0000
	          end_va = 0x1f0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001f0000"
	        filename = ""

Region:
	              id = 4556
	        start_va = 0x76c80000
	          end_va = 0x76d03fff
	       monitored = 0
	     entry_point = 0x76ca6220
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 4557
	        start_va = 0x4c0000
	          end_va = 0x4c0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004c0000"
	        filename = ""

Region:
	              id = 4558
	        start_va = 0x560000
	          end_va = 0x56ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000560000"
	        filename = ""

Region:
	              id = 4559
	        start_va = 0x6cab0000
	          end_va = 0x6cabcfff
	       monitored = 0
	     entry_point = 0x6cab3520
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 4560
	        start_va = 0x6ca40000
	          end_va = 0x6caa6fff
	       monitored = 0
	     entry_point = 0x6ca5b610
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 4561
	        start_va = 0x740f0000
	          end_va = 0x7410afff
	       monitored = 0
	     entry_point = 0x740f9050
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 4562
	        start_va = 0x6c9f0000
	          end_va = 0x6ca33fff
	       monitored = 0
	     entry_point = 0x6ca0aaf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")

Region:
	              id = 4563
	        start_va = 0x4d0000
	          end_va = 0x50ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004d0000"
	        filename = ""

Region:
	              id = 4564
	        start_va = 0x510000
	          end_va = 0x54ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000510000"
	        filename = ""

Region:
	              id = 4565
	        start_va = 0xde0000
	          end_va = 0xe1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000de0000"
	        filename = ""

Region:
	              id = 4566
	        start_va = 0xe20000
	          end_va = 0xe5ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e20000"
	        filename = ""

Region:
	              id = 4567
	        start_va = 0xe60000
	          end_va = 0xe9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e60000"
	        filename = ""

Region:
	              id = 4568
	        start_va = 0xea0000
	          end_va = 0xedffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ea0000"
	        filename = ""

Region:
	              id = 4569
	        start_va = 0x6c9d0000
	          end_va = 0x6c9e0fff
	       monitored = 0
	     entry_point = 0x6c9d8fa0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 4570
	        start_va = 0x6c910000
	          end_va = 0x6c9cefff
	       monitored = 0
	     entry_point = 0x6c941e80
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 4572
	        start_va = 0x550000
	          end_va = 0x555fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000550000"
	        filename = ""


Thread:
	id = 323
	os_tid = 0x6c4


Thread:
	id = 324
	os_tid = 0x6dc


Thread:
	id = 325
	os_tid = 0x694


Thread:
	id = 326
	os_tid = 0x1124


Thread:
	id = 327
	os_tid = 0x1110


Process:
	id = "63"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x30d11000"
	os_pid = "0x1120"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x614"
	cmd_line = "cmd.exe /c \"taskkill /f /im outlook.exe \""
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 4575
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 4576
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 4577
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 4578
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 4579
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 4580
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 4581
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 4582
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 4583
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 4584
	        start_va = 0x13a0000
	          end_va = 0x13f1fff
	       monitored = 1
	     entry_point = 0x13b4fd0
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")

Region:
	              id = 4585
	        start_va = 0x1400000
	          end_va = 0x53fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001400000"
	        filename = ""

Region:
	              id = 4586
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 4587
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 4588
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 4589
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 4590
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 4591
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 4592
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 4593
	        start_va = 0x490000
	          end_va = 0x49ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000490000"
	        filename = ""

Region:
	              id = 4594
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 4595
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 4596
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 4597
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 4598
	        start_va = 0x4a0000
	          end_va = 0x60ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004a0000"
	        filename = ""

Region:
	              id = 4599
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 4600
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 4601
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 4602
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 4603
	        start_va = 0x610000
	          end_va = 0x6cdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 4604
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 4605
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 4606
	        start_va = 0x6d0000
	          end_va = 0x7cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006d0000"
	        filename = ""

Region:
	              id = 4607
	        start_va = 0x4a0000
	          end_va = 0x50ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004a0000"
	        filename = ""

Region:
	              id = 4608
	        start_va = 0x510000
	          end_va = 0x60ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000510000"
	        filename = ""

Region:
	              id = 4609
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 4610
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 4611
	        start_va = 0x7d0000
	          end_va = 0xb06fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 328
	os_tid = 0x110c

	[0179.392] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000
	[0179.392] __set_app_type (_Type=0x1) 
	[0179.392] __p__fmode () returned 0x74974d6c
	[0179.393] __p__commode () returned 0x74975b1c
	[0179.393] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13b5200) returned 0x0
	[0179.393] __getmainargs (in: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0, _DoWildCard=0, _StartInfo=0x13c60fc | out: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0) returned 0
	[0179.393] GetCurrentThreadId () returned 0x110c
	[0179.393] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x110c) returned 0x78
	[0179.393] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0179.393] GetProcAddress (hModule=0x75600000, lpProcName="SetThreadUILanguage") returned 0x75642510
	[0179.393] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0179.401] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0179.401] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2
	[0179.401] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0179.401] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0179.401] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0179.401] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0179.401] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0179.402] GetConsoleOutputCP () returned 0x1b5
	[0179.403] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0179.403] SetConsoleCtrlHandler (HandlerRoutine=0x13c0e40, Add=1) returned 1
	[0179.403] _get_osfhandle (_FileHandle=1) returned 0x144
	[0179.403] SetConsoleMode (hConsoleHandle=0x144, dwMode=0x0) returned 0
	[0179.403] _get_osfhandle (_FileHandle=1) returned 0x144
	[0179.403] GetConsoleMode (in: hConsoleHandle=0x144, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0179.403] _get_osfhandle (_FileHandle=0) returned 0x140
	[0179.403] GetConsoleMode (in: hConsoleHandle=0x140, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0179.404] GetEnvironmentStringsW () returned 0x517cc0*
	[0179.404] GetProcessHeap () returned 0x510000
	[0179.404] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xa1a) returned 0x5186e8
	[0179.404] FreeEnvironmentStringsA (penv="A") returned 1
	[0179.404] GetProcessHeap () returned 0x510000
	[0179.404] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x4) returned 0x510550
	[0179.404] GetEnvironmentStringsW () returned 0x517cc0*
	[0179.404] GetProcessHeap () returned 0x510000
	[0179.404] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xa1a) returned 0x519110
	[0179.404] FreeEnvironmentStringsA (penv="A") returned 1
	[0179.404] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0179.405] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0179.405] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0179.405] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0179.405] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0179.405] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0179.405] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0179.406] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0179.406] RegCloseKey (hKey=0x88) returned 0x0
	[0179.406] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0179.407] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0179.407] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0179.407] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0179.407] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0179.407] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0179.407] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0179.407] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0179.407] RegCloseKey (hKey=0x88) returned 0x0
	[0179.407] time (in: timer=0x0 | out: timer=0x0) returned 0x6234423d
	[0179.407] srand (_Seed=0x6234423d) 
	[0179.407] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im outlook.exe \""
	[0179.407] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im outlook.exe \""
	[0179.407] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0179.407] GetProcessHeap () returned 0x510000
	[0179.407] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x210) returned 0x519b38
	[0179.407] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x519b40, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0179.408] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0179.408] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0179.408] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0179.408] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0179.408] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0179.408] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0179.408] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0179.408] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0179.408] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0179.408] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0179.408] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0179.408] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0179.409] GetProcessHeap () returned 0x510000
	[0179.409] RtlFreeHeap (HeapHandle=0x510000, Flags=0x0, BaseAddress=0x5186e8) returned 1
	[0179.409] GetEnvironmentStringsW () returned 0x517cc0*
	[0179.409] GetProcessHeap () returned 0x510000
	[0179.409] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xa32) returned 0x51a790
	[0179.410] FreeEnvironmentStringsA (penv="A") returned 1
	[0179.410] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b
	[0179.410] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0179.410] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0179.410] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0179.410] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0179.410] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0179.410] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0179.410] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0179.410] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0179.410] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0179.410] GetProcessHeap () returned 0x510000
	[0179.410] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x44) returned 0x5105c8
	[0179.410] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0179.410] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19fc4c*="Desktop") returned 0x1d
	[0179.411] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0179.411] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x510618
	[0179.411] FindClose (in: hFindFile=0x510618 | out: hFindFile=0x510618) returned 1
	[0179.411] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x510618
	[0179.411] FindClose (in: hFindFile=0x510618 | out: hFindFile=0x510618) returned 1
	[0179.411] _wcsnicmp (_String1="RDHJ0C~1", _String2="RDhJ0CNFevzX", _MaxCount=0xc) returned 16
	[0179.411] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x510618
	[0179.411] FindClose (in: hFindFile=0x510618 | out: hFindFile=0x510618) returned 1
	[0179.412] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0179.412] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1
	[0179.412] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 1
	[0179.412] GetProcessHeap () returned 0x510000
	[0179.412] RtlFreeHeap (HeapHandle=0x510000, Flags=0x0, BaseAddress=0x51a790) returned 1
	[0179.412] GetEnvironmentStringsW () returned 0x517cc0*
	[0179.412] GetProcessHeap () returned 0x510000
	[0179.413] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xa76) returned 0x519d50
	[0179.413] FreeEnvironmentStringsA (penv="=") returned 1
	[0179.413] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0179.413] GetProcessHeap () returned 0x510000
	[0179.413] RtlFreeHeap (HeapHandle=0x510000, Flags=0x0, BaseAddress=0x5105c8) returned 1
	[0179.413] GetProcessHeap () returned 0x510000
	[0179.413] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x400e) returned 0x51bc50
	[0179.414] GetProcessHeap () returned 0x510000
	[0179.414] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x4a) returned 0x51a7d0
	[0179.414] GetProcessHeap () returned 0x510000
	[0179.414] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x4008) returned 0x51fc68
	[0179.414] GetProcessHeap () returned 0x510000
	[0179.414] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x4008) returned 0x523c78
	[0179.416] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0179.416] GetProcessHeap () returned 0x510000
	[0179.417] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x418) returned 0x51a828
	[0179.417] SetErrorMode (uMode=0x0) returned 0x8003
	[0179.417] SetErrorMode (uMode=0x1) returned 0x0
	[0179.417] GetFullPathNameW (in: lpFileName="taskkill \\f \\.", nBufferLength=0x208, lpBuffer=0x51a830, lpFilePart=0x19fbac | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f", lpFilePart=0x19fbac*="f") returned 0x29
	[0179.417] SetErrorMode (uMode=0x8003) returned 0x1
	[0179.417] GetProcessHeap () returned 0x510000
	[0179.417] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x51a828, Size=0x7c) returned 0x51a828
	[0179.417] GetProcessHeap () returned 0x510000
	[0179.417] RtlSizeHeap (HeapHandle=0x510000, Flags=0x0, MemoryPointer=0x51a828) returned 0x7c
	[0179.417] NeedCurrentDirectoryForExePathW (ExeName="taskkill \\f \\.") returned 1
	[0179.417] GetProcessHeap () returned 0x510000
	[0179.417] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x62) returned 0x51a8b0
	[0179.417] GetProcessHeap () returned 0x510000
	[0179.418] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xb8) returned 0x51a920
	[0179.418] GetProcessHeap () returned 0x510000
	[0179.418] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x51a920, Size=0x62) returned 0x51a920
	[0179.418] GetProcessHeap () returned 0x510000
	[0179.418] RtlSizeHeap (HeapHandle=0x510000, Flags=0x0, MemoryPointer=0x51a920) returned 0x62
	[0179.418] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0179.418] GetProcessHeap () returned 0x510000
	[0179.418] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xe0) returned 0x51a990
	[0179.424] GetProcessHeap () returned 0x510000
	[0179.424] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x51a990, Size=0x76) returned 0x51a990
	[0179.424] GetProcessHeap () returned 0x510000
	[0179.424] RtlSizeHeap (HeapHandle=0x510000, Flags=0x0, MemoryPointer=0x51a990) returned 0x76
	[0179.424] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0179.425] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f\\im outlook.exe ", fInfoLevelId=0x1, lpFindFileData=0x19f958, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f958) returned 0xffffffff
	[0179.425] GetLastError () returned 0x3
	[0179.425] GetProcessHeap () returned 0x510000
	[0179.426] RtlFreeHeap (HeapHandle=0x510000, Flags=0x0, BaseAddress=0x51fc68) returned 1
	[0179.426] GetProcessHeap () returned 0x510000
	[0179.426] RtlFreeHeap (HeapHandle=0x510000, Flags=0x0, BaseAddress=0x523c78) returned 1
	[0179.426] GetProcessHeap () returned 0x510000
	[0179.427] RtlFreeHeap (HeapHandle=0x510000, Flags=0x0, BaseAddress=0x51bc50) returned 1
	[0179.427] GetConsoleOutputCP () returned 0x1b5
	[0179.428] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0179.428] GetUserDefaultLCID () returned 0x409
	[0179.429] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x13d34a0, cchData=8 | out: lpLCData=":") returned 2
	[0179.429] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0179.429] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0179.429] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2
	[0179.429] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x13d34b0, cchData=8 | out: lpLCData="/") returned 2
	[0179.429] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x13d3500, cchData=32 | out: lpLCData="Mon") returned 4
	[0179.429] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x13d3540, cchData=32 | out: lpLCData="Tue") returned 4
	[0179.429] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x13d3580, cchData=32 | out: lpLCData="Wed") returned 4
	[0179.430] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x13d35c0, cchData=32 | out: lpLCData="Thu") returned 4
	[0179.430] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x13d3600, cchData=32 | out: lpLCData="Fri") returned 4
	[0179.430] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x13d3640, cchData=32 | out: lpLCData="Sat") returned 4
	[0179.430] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x13d3680, cchData=32 | out: lpLCData="Sun") returned 4
	[0179.430] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x13d34c0, cchData=8 | out: lpLCData=".") returned 2
	[0179.430] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x13d34e0, cchData=8 | out: lpLCData=",") returned 2
	[0179.430] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0179.432] GetProcessHeap () returned 0x510000
	[0179.432] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20c) returned 0x51aa58
	[0179.432] GetConsoleTitleW (in: lpConsoleTitle=0x51aa58, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0179.434] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0179.435] GetProcAddress (hModule=0x75600000, lpProcName="CopyFileExW") returned 0x7561ffc0
	[0179.435] GetProcAddress (hModule=0x75600000, lpProcName="IsDebuggerPresent") returned 0x7561b0b0
	[0179.436] GetProcAddress (hModule=0x75600000, lpProcName="SetConsoleInputExeNameW") returned 0x7559b440
	[0179.436] GetProcessHeap () returned 0x510000
	[0179.436] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x400a) returned 0x51bc50
	[0179.436] GetProcessHeap () returned 0x510000
	[0179.437] RtlFreeHeap (HeapHandle=0x510000, Flags=0x0, BaseAddress=0x51bc50) returned 1
	[0179.438] _wcsicmp (_String1="taskkill", _String2=")") returned 75
	[0179.438] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14
	[0179.438] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14
	[0179.438] _wcsicmp (_String1="IF", _String2="taskkill") returned -11
	[0179.438] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11
	[0179.438] _wcsicmp (_String1="REM", _String2="taskkill") returned -2
	[0179.438] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2
	[0179.438] GetProcessHeap () returned 0x510000
	[0179.438] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x58) returned 0x51ac70
	[0179.438] GetProcessHeap () returned 0x510000
	[0179.438] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x1a) returned 0x510578
	[0179.439] GetProcessHeap () returned 0x510000
	[0179.439] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x32) returned 0x51acd0
	[0179.440] GetConsoleTitleW (in: lpConsoleTitle=0x19fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0179.442] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0179.442] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0179.442] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0179.442] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0179.442] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0179.442] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0179.442] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0179.442] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0179.442] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0179.442] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0179.443] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0179.443] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0179.443] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0179.443] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0179.443] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0179.443] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0179.443] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0179.443] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0179.443] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0179.443] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0179.443] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0179.443] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0179.443] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0179.443] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0179.443] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0179.443] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0179.443] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0179.443] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0179.443] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0179.443] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0179.443] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0179.443] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0179.444] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0179.444] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0179.444] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0179.444] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0179.444] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0179.444] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0179.444] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0179.444] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0179.444] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0179.444] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0179.444] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0179.444] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0179.444] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0179.444] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0179.444] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0179.444] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0179.444] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0179.444] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0179.444] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0179.444] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0179.444] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0179.444] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0179.444] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0179.444] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0179.444] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0179.445] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0179.445] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0179.445] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0179.445] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0179.445] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0179.445] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0179.445] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0179.445] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0179.445] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0179.445] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0179.445] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0179.445] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0179.445] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0179.445] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0179.445] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0179.445] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0179.445] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0179.445] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0179.445] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0179.445] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0179.445] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0179.445] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0179.446] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0179.446] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0179.446] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0179.446] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0179.446] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0179.446] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14
	[0179.446] _wcsicmp (_String1="taskkill", _String2="IF") returned 11
	[0179.446] _wcsicmp (_String1="taskkill", _String2="REM") returned 2
	[0179.446] GetProcessHeap () returned 0x510000
	[0179.446] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x210) returned 0x51ad10
	[0179.447] GetProcessHeap () returned 0x510000
	[0179.447] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x44) returned 0x51af28
	[0179.447] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0179.447] GetProcessHeap () returned 0x510000
	[0179.447] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x418) returned 0x5105c8
	[0179.448] SetErrorMode (uMode=0x0) returned 0x8003
	[0179.448] SetErrorMode (uMode=0x1) returned 0x0
	[0179.448] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x5105d0, lpFilePart=0x19f57c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19f57c*="Desktop") returned 0x1d
	[0179.448] SetErrorMode (uMode=0x8003) returned 0x1
	[0179.448] GetProcessHeap () returned 0x510000
	[0179.448] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5105c8, Size=0x56) returned 0x5105c8
	[0179.448] GetProcessHeap () returned 0x510000
	[0179.448] RtlSizeHeap (HeapHandle=0x510000, Flags=0x0, MemoryPointer=0x5105c8) returned 0x56
	[0179.448] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0179.448] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0179.448] GetProcessHeap () returned 0x510000
	[0179.448] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x110) returned 0x51af78
	[0179.448] GetProcessHeap () returned 0x510000
	[0179.448] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x218) returned 0x510628
	[0179.453] GetProcessHeap () returned 0x510000
	[0179.454] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x510628, Size=0x112) returned 0x510628
	[0179.454] GetProcessHeap () returned 0x510000
	[0179.454] RtlSizeHeap (HeapHandle=0x510000, Flags=0x0, MemoryPointer=0x510628) returned 0x112
	[0179.454] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0179.454] GetProcessHeap () returned 0x510000
	[0179.454] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xe0) returned 0x51b090
	[0179.456] GetProcessHeap () returned 0x510000
	[0179.456] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x51b090, Size=0x76) returned 0x51b090
	[0179.456] GetProcessHeap () returned 0x510000
	[0179.456] RtlSizeHeap (HeapHandle=0x510000, Flags=0x0, MemoryPointer=0x51b090) returned 0x76
	[0179.456] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0179.456] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0179.456] GetLastError () returned 0x2
	[0179.457] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0179.457] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x51b110
	[0179.457] GetProcessHeap () returned 0x510000
	[0179.457] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x14) returned 0x5177a8
	[0179.457] FindClose (in: hFindFile=0x51b110 | out: hFindFile=0x51b110) returned 1
	[0179.457] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0179.457] GetLastError () returned 0x2
	[0179.457] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x51b110
	[0179.458] GetProcessHeap () returned 0x510000
	[0179.458] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5177a8, Size=0x4) returned 0x51b150
	[0179.458] FindClose (in: hFindFile=0x51b110 | out: hFindFile=0x51b110) returned 1
	[0179.458] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0179.458] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0179.458] GetConsoleTitleW (in: lpConsoleTitle=0x19f7fc, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0179.459] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f728, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f70c | out: lpAttributeList=0x19f728, lpSize=0x19f70c) returned 1
	[0179.459] UpdateProcThreadAttribute (in: lpAttributeList=0x19f728, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f714, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f728, lpPreviousValue=0x0) returned 1
	[0179.459] GetStartupInfoW (in: lpStartupInfo=0x19f760 | out: lpStartupInfo=0x19f760*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x140, hStdOutput=0x144, hStdError=0x150)) 
	[0179.460] GetProcessHeap () returned 0x510000
	[0179.460] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x18) returned 0x517448
	[0179.460] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0179.460] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0179.460] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0179.460] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0179.460] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0179.460] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0179.460] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0179.460] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0179.460] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0179.460] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0179.460] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0179.460] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0179.460] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0179.460] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0179.460] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0179.460] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0179.460] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0179.460] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0179.460] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0179.460] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0179.460] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0179.460] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0179.461] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0179.461] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0179.461] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0179.461] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0179.461] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0179.461] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0179.461] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0179.461] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0179.461] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0179.461] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0179.461] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0179.461] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0179.461] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0179.461] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0179.461] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0179.461] GetProcessHeap () returned 0x510000
	[0179.461] RtlFreeHeap (HeapHandle=0x510000, Flags=0x0, BaseAddress=0x517448) returned 1
	[0179.461] GetProcessHeap () returned 0x510000
	[0179.461] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xa) returned 0x51b110
	[0179.461] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1
	[0179.464] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill  /f /im outlook.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x19f6b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill  /f /im outlook.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f6fc | out: lpCommandLine="taskkill  /f /im outlook.exe ", lpProcessInformation=0x19f6fc*(hProcess=0x9c, hThread=0x98, dwProcessId=0x1118, dwThreadId=0x1108)) returned 1
	[0179.489] CloseHandle (hObject=0x98) returned 1
	[0179.490] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0179.490] GetProcessHeap () returned 0x510000
	[0179.490] RtlFreeHeap (HeapHandle=0x510000, Flags=0x0, BaseAddress=0x519d50) returned 1
	[0179.490] GetEnvironmentStringsW () returned 0x519d50*
	[0179.490] GetProcessHeap () returned 0x510000
	[0179.490] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xa76) returned 0x517cc0
	[0179.490] FreeEnvironmentStringsA (penv="=") returned 1
	[0179.490] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0
	[0180.480] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x19f694 | out: lpExitCode=0x19f694*=0x0) returned 1
	[0180.481] CloseHandle (hObject=0x9c) returned 1
	[0180.481] _vsnwprintf (in: _Buffer=0x19f77c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f69c | out: _Buffer="00000000") returned 8
	[0180.481] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1
	[0180.482] GetProcessHeap () returned 0x510000
	[0180.482] RtlFreeHeap (HeapHandle=0x510000, Flags=0x0, BaseAddress=0x517cc0) returned 1
	[0180.482] GetEnvironmentStringsW () returned 0x51b160*
	[0180.482] GetProcessHeap () returned 0x510000
	[0180.482] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xa9c) returned 0x517cc0
	[0180.483] FreeEnvironmentStringsA (penv="=") returned 1
	[0180.483] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0180.483] GetProcessHeap () returned 0x510000
	[0180.483] RtlFreeHeap (HeapHandle=0x510000, Flags=0x0, BaseAddress=0x517cc0) returned 1
	[0180.483] GetEnvironmentStringsW () returned 0x51b160*
	[0180.483] GetProcessHeap () returned 0x510000
	[0180.483] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xa9c) returned 0x517cc0
	[0180.483] FreeEnvironmentStringsA (penv="=") returned 1
	[0180.483] GetProcessHeap () returned 0x510000
	[0180.483] RtlFreeHeap (HeapHandle=0x510000, Flags=0x0, BaseAddress=0x51b110) returned 1
	[0180.483] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f728 | out: lpAttributeList=0x19f728) 
	[0180.483] _get_osfhandle (_FileHandle=1) returned 0x144
	[0180.483] SetConsoleMode (hConsoleHandle=0x144, dwMode=0x0) returned 0
	[0180.483] _get_osfhandle (_FileHandle=1) returned 0x144
	[0180.483] GetConsoleMode (in: hConsoleHandle=0x144, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0180.483] _get_osfhandle (_FileHandle=0) returned 0x140
	[0180.483] GetConsoleMode (in: hConsoleHandle=0x140, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0180.484] GetConsoleOutputCP () returned 0x1b5
	[0180.485] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0180.485] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0180.487] exit (_Code=0) 

Thread:
	id = 329
	os_tid = 0x111c


Process:
	id = "64"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\syswow64\\taskkill.exe"
	page_root = "0x30f2c000"
	os_pid = "0x1118"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "63"
	os_parent_pid = "0x1120"
	cmd_line = "taskkill  /f /im outlook.exe "
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 4612
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 4613
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 4614
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 4615
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 4616
	        start_va = 0xa0000
	          end_va = 0xdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 4617
	        start_va = 0xe0000
	          end_va = 0xe3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 4618
	        start_va = 0xf0000
	          end_va = 0xf0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 4619
	        start_va = 0x100000
	          end_va = 0x101fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 4620
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 4621
	        start_va = 0x13b0000
	          end_va = 0x13c5fff
	       monitored = 0
	     entry_point = 0x13bde80
	     region_type = mapped_file
	            name = "taskkill.exe"
	        filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe")

Region:
	              id = 4622
	        start_va = 0x13d0000
	          end_va = 0x53cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000013d0000"
	        filename = ""

Region:
	              id = 4623
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 4624
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 4625
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 4626
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 4627
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 4628
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 4629
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 4630
	        start_va = 0x550000
	          end_va = 0x55ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000550000"
	        filename = ""

Region:
	              id = 4631
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 4632
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 4633
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 4634
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 4635
	        start_va = 0x560000
	          end_va = 0x82ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000560000"
	        filename = ""

Region:
	              id = 4636
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 4637
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 4638
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 4639
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 4640
	        start_va = 0x110000
	          end_va = 0x1cdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 4641
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 4642
	        start_va = 0x74650000
	          end_va = 0x746cafff
	       monitored = 0
	     entry_point = 0x7466e970
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 4643
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 4644
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 4645
	        start_va = 0x440000
	          end_va = 0x47ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000440000"
	        filename = ""

Region:
	              id = 4646
	        start_va = 0x76ae0000
	          end_va = 0x76b23fff
	       monitored = 0
	     entry_point = 0x76af9d80
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 4647
	        start_va = 0x75260000
	          end_va = 0x7530cfff
	       monitored = 0
	     entry_point = 0x75274f00
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 4648
	        start_va = 0x74450000
	          end_va = 0x7446dfff
	       monitored = 0
	     entry_point = 0x7445b640
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 4649
	        start_va = 0x74440000
	          end_va = 0x74449fff
	       monitored = 0
	     entry_point = 0x74442a00
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 4650
	        start_va = 0x74590000
	          end_va = 0x745e7fff
	       monitored = 0
	     entry_point = 0x745d25c0
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 4651
	        start_va = 0x77450000
	          end_va = 0x77596fff
	       monitored = 0
	     entry_point = 0x77461cf0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 4652
	        start_va = 0x76b30000
	          end_va = 0x76c7efff
	       monitored = 0
	     entry_point = 0x76be6820
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 4653
	        start_va = 0x753c0000
	          end_va = 0x75451fff
	       monitored = 0
	     entry_point = 0x753f8cf0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 4654
	        start_va = 0x77290000
	          end_va = 0x7744cfff
	       monitored = 0
	     entry_point = 0x77372a10
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")

Region:
	              id = 4655
	        start_va = 0x75310000
	          end_va = 0x7536efff
	       monitored = 0
	     entry_point = 0x75314af0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 4656
	        start_va = 0x77240000
	          end_va = 0x77284fff
	       monitored = 0
	     entry_point = 0x7725de90
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 4657
	        start_va = 0x6cc90000
	          end_va = 0x6cc97fff
	       monitored = 0
	     entry_point = 0x6cc917b0
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 4658
	        start_va = 0x6cc70000
	          end_va = 0x6cc85fff
	       monitored = 0
	     entry_point = 0x6cc721d0
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")

Region:
	              id = 4659
	        start_va = 0x6caf0000
	          end_va = 0x6cc2efff
	       monitored = 0
	     entry_point = 0x6cb1d880
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll")

Region:
	              id = 4660
	        start_va = 0x6cad0000
	          end_va = 0x6caebfff
	       monitored = 0
	     entry_point = 0x6cad4720
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")

Region:
	              id = 4661
	        start_va = 0x6cac0000
	          end_va = 0x6cac9fff
	       monitored = 0
	     entry_point = 0x6cac28d0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")

Region:
	              id = 4662
	        start_va = 0x6cc30000
	          end_va = 0x6cc6efff
	       monitored = 0
	     entry_point = 0x6cc446c0
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll")

Region:
	              id = 4663
	        start_va = 0x480000
	          end_va = 0x4effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 4664
	        start_va = 0x1d0000
	          end_va = 0x1f9fff
	       monitored = 0
	     entry_point = 0x1d5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 4665
	        start_va = 0x560000
	          end_va = 0x6e7fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000560000"
	        filename = ""

Region:
	              id = 4666
	        start_va = 0x730000
	          end_va = 0x82ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000730000"
	        filename = ""

Region:
	              id = 4667
	        start_va = 0x74ea0000
	          end_va = 0x74ecafff
	       monitored = 0
	     entry_point = 0x74ea5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 4668
	        start_va = 0x830000
	          end_va = 0x9b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000830000"
	        filename = ""

Region:
	              id = 4669
	        start_va = 0x53d0000
	          end_va = 0x67cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000053d0000"
	        filename = ""

Region:
	              id = 4670
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 4671
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001d0000"
	        filename = ""

Region:
	              id = 4672
	        start_va = 0x1e0000
	          end_va = 0x1e4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taskkill.exe.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui")

Region:
	              id = 4673
	        start_va = 0x1f0000
	          end_va = 0x1f0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001f0000"
	        filename = ""

Region:
	              id = 4674
	        start_va = 0x480000
	          end_va = 0x480fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 4675
	        start_va = 0x4e0000
	          end_va = 0x4effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004e0000"
	        filename = ""

Region:
	              id = 4676
	        start_va = 0x9c0000
	          end_va = 0xcf6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 4677
	        start_va = 0xd00000
	          end_va = 0xde9fff
	       monitored = 0
	     entry_point = 0xd3d650
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 4678
	        start_va = 0x490000
	          end_va = 0x493fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000490000"
	        filename = ""

Region:
	              id = 4679
	        start_va = 0xd00000
	          end_va = 0xddffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 4680
	        start_va = 0x76e20000
	          end_va = 0x76e2bfff
	       monitored = 0
	     entry_point = 0x76e23930
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")

Region:
	              id = 4681
	        start_va = 0x4a0000
	          end_va = 0x4a0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004a0000"
	        filename = ""

Region:
	              id = 4682
	        start_va = 0x76c80000
	          end_va = 0x76d03fff
	       monitored = 0
	     entry_point = 0x76ca6220
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 4683
	        start_va = 0x4b0000
	          end_va = 0x4b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004b0000"
	        filename = ""

Region:
	              id = 4684
	        start_va = 0x6cab0000
	          end_va = 0x6cabcfff
	       monitored = 0
	     entry_point = 0x6cab3520
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 4685
	        start_va = 0x6ca40000
	          end_va = 0x6caa6fff
	       monitored = 0
	     entry_point = 0x6ca5b610
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 4686
	        start_va = 0x740f0000
	          end_va = 0x7410afff
	       monitored = 0
	     entry_point = 0x740f9050
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 4687
	        start_va = 0x6c9f0000
	          end_va = 0x6ca33fff
	       monitored = 0
	     entry_point = 0x6ca0aaf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")

Region:
	              id = 4688
	        start_va = 0x4f0000
	          end_va = 0x52ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004f0000"
	        filename = ""

Region:
	              id = 4689
	        start_va = 0x6f0000
	          end_va = 0x72ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006f0000"
	        filename = ""

Region:
	              id = 4690
	        start_va = 0xde0000
	          end_va = 0xe1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000de0000"
	        filename = ""

Region:
	              id = 4691
	        start_va = 0xe20000
	          end_va = 0xe5ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e20000"
	        filename = ""

Region:
	              id = 4692
	        start_va = 0xe60000
	          end_va = 0xe9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e60000"
	        filename = ""

Region:
	              id = 4693
	        start_va = 0xea0000
	          end_va = 0xedffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ea0000"
	        filename = ""

Region:
	              id = 4694
	        start_va = 0x6c9d0000
	          end_va = 0x6c9e0fff
	       monitored = 0
	     entry_point = 0x6c9d8fa0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 4695
	        start_va = 0x6c910000
	          end_va = 0x6c9cefff
	       monitored = 0
	     entry_point = 0x6c941e80
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 4697
	        start_va = 0x4c0000
	          end_va = 0x4c5fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004c0000"
	        filename = ""


Thread:
	id = 330
	os_tid = 0x1108


Thread:
	id = 331
	os_tid = 0x64c


Thread:
	id = 332
	os_tid = 0x1140


Thread:
	id = 333
	os_tid = 0x7a4


Thread:
	id = 334
	os_tid = 0x900


Process:
	id = "65"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x3061e000"
	os_pid = "0x1104"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x614"
	cmd_line = "cmd.exe /c \"taskkill /f /im powerpnt.exe \""
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 4700
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 4701
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 4702
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 4703
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 4704
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 4705
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 4706
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 4707
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 4708
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 4709
	        start_va = 0x13a0000
	          end_va = 0x13f1fff
	       monitored = 1
	     entry_point = 0x13b4fd0
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")

Region:
	              id = 4710
	        start_va = 0x1400000
	          end_va = 0x53fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001400000"
	        filename = ""

Region:
	              id = 4711
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 4712
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 4713
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 4714
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 4715
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 4716
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 4717
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 4718
	        start_va = 0x5f0000
	          end_va = 0x5fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005f0000"
	        filename = ""

Region:
	              id = 4719
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 4720
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 4721
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 4722
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 4723
	        start_va = 0x600000
	          end_va = 0x85ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000600000"
	        filename = ""

Region:
	              id = 4724
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 4725
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 4726
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 4727
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 4728
	        start_va = 0x400000
	          end_va = 0x4bdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 4729
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 4730
	        start_va = 0x4c0000
	          end_va = 0x4fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004c0000"
	        filename = ""

Region:
	              id = 4731
	        start_va = 0x600000
	          end_va = 0x6fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000600000"
	        filename = ""

Region:
	              id = 4732
	        start_va = 0x760000
	          end_va = 0x85ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000760000"
	        filename = ""

Region:
	              id = 4733
	        start_va = 0x860000
	          end_va = 0xa4ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000860000"
	        filename = ""

Region:
	              id = 4734
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 4735
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 4736
	        start_va = 0xa50000
	          end_va = 0xd86fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 335
	os_tid = 0x1100

	[0180.801] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000
	[0180.802] __set_app_type (_Type=0x1) 
	[0180.802] __p__fmode () returned 0x74974d6c
	[0180.802] __p__commode () returned 0x74975b1c
	[0180.802] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13b5200) returned 0x0
	[0180.802] __getmainargs (in: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0, _DoWildCard=0, _StartInfo=0x13c60fc | out: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0) returned 0
	[0180.802] GetCurrentThreadId () returned 0x1100
	[0180.802] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x1100) returned 0x78
	[0180.802] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0180.803] GetProcAddress (hModule=0x75600000, lpProcName="SetThreadUILanguage") returned 0x75642510
	[0180.803] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0180.811] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0180.812] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2
	[0180.812] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0180.812] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0180.812] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0180.812] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0180.812] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0180.812] GetConsoleOutputCP () returned 0x1b5
	[0180.814] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0180.815] SetConsoleCtrlHandler (HandlerRoutine=0x13c0e40, Add=1) returned 1
	[0180.818] _get_osfhandle (_FileHandle=1) returned 0x140
	[0180.818] SetConsoleMode (hConsoleHandle=0x140, dwMode=0x0) returned 0
	[0180.818] _get_osfhandle (_FileHandle=1) returned 0x140
	[0180.818] GetConsoleMode (in: hConsoleHandle=0x140, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0180.818] _get_osfhandle (_FileHandle=0) returned 0x13c
	[0180.818] GetConsoleMode (in: hConsoleHandle=0x13c, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0180.819] GetEnvironmentStringsW () returned 0x767cc0*
	[0180.819] GetProcessHeap () returned 0x760000
	[0180.819] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0xa1a) returned 0x7686e8
	[0180.819] FreeEnvironmentStringsA (penv="A") returned 1
	[0180.819] GetProcessHeap () returned 0x760000
	[0180.819] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x4) returned 0x760550
	[0180.819] GetEnvironmentStringsW () returned 0x767cc0*
	[0180.819] GetProcessHeap () returned 0x760000
	[0180.819] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0xa1a) returned 0x769110
	[0180.819] FreeEnvironmentStringsA (penv="A") returned 1
	[0180.819] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0180.819] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0180.819] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0180.819] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0180.820] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0180.820] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0180.820] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0180.820] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0180.820] RegCloseKey (hKey=0x88) returned 0x0
	[0180.820] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0180.820] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0180.820] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0180.820] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0180.820] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0180.820] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0180.820] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0180.820] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0180.820] RegCloseKey (hKey=0x88) returned 0x0
	[0180.820] time (in: timer=0x0 | out: timer=0x0) returned 0x6234423f
	[0180.821] srand (_Seed=0x6234423f) 
	[0180.821] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im powerpnt.exe \""
	[0180.821] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im powerpnt.exe \""
	[0180.821] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0180.821] GetProcessHeap () returned 0x760000
	[0180.821] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x210) returned 0x769b38
	[0180.821] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x769b40, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0180.821] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0180.821] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0180.821] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0180.821] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0180.821] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0180.821] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0180.821] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0180.821] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0180.821] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0180.821] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0180.821] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0180.822] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0180.822] GetProcessHeap () returned 0x760000
	[0180.822] RtlFreeHeap (HeapHandle=0x760000, Flags=0x0, BaseAddress=0x7686e8) returned 1
	[0180.822] GetEnvironmentStringsW () returned 0x767cc0*
	[0180.822] GetProcessHeap () returned 0x760000
	[0180.822] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0xa32) returned 0x76a790
	[0180.823] FreeEnvironmentStringsA (penv="A") returned 1
	[0180.823] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b
	[0180.823] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0180.823] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0180.823] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0180.823] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0180.823] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0180.823] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0180.823] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0180.823] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0180.823] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0180.823] GetProcessHeap () returned 0x760000
	[0180.823] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x44) returned 0x7605c8
	[0180.823] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0180.823] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19fc4c*="Desktop") returned 0x1d
	[0180.823] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0180.824] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x760618
	[0180.824] FindClose (in: hFindFile=0x760618 | out: hFindFile=0x760618) returned 1
	[0180.824] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x760618
	[0180.824] FindClose (in: hFindFile=0x760618 | out: hFindFile=0x760618) returned 1
	[0180.824] _wcsnicmp (_String1="RDHJ0C~1", _String2="RDhJ0CNFevzX", _MaxCount=0xc) returned 16
	[0180.824] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x760618
	[0180.824] FindClose (in: hFindFile=0x760618 | out: hFindFile=0x760618) returned 1
	[0180.824] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0180.824] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1
	[0180.825] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 1
	[0180.825] GetProcessHeap () returned 0x760000
	[0180.825] RtlFreeHeap (HeapHandle=0x760000, Flags=0x0, BaseAddress=0x76a790) returned 1
	[0180.825] GetEnvironmentStringsW () returned 0x767cc0*
	[0180.825] GetProcessHeap () returned 0x760000
	[0180.825] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0xa76) returned 0x769d50
	[0180.825] FreeEnvironmentStringsA (penv="=") returned 1
	[0180.825] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0180.825] GetProcessHeap () returned 0x760000
	[0180.826] RtlFreeHeap (HeapHandle=0x760000, Flags=0x0, BaseAddress=0x7605c8) returned 1
	[0180.826] GetProcessHeap () returned 0x760000
	[0180.826] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x400e) returned 0x76bc50
	[0180.826] GetProcessHeap () returned 0x760000
	[0180.826] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x4c) returned 0x76a7d0
	[0180.826] GetProcessHeap () returned 0x760000
	[0180.826] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x4008) returned 0x76fc68
	[0180.827] GetProcessHeap () returned 0x760000
	[0180.827] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x4008) returned 0x773c78
	[0180.828] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0180.829] GetProcessHeap () returned 0x760000
	[0180.829] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x418) returned 0x76a828
	[0180.829] SetErrorMode (uMode=0x0) returned 0x8003
	[0180.829] SetErrorMode (uMode=0x1) returned 0x0
	[0180.829] GetFullPathNameW (in: lpFileName="taskkill \\f \\.", nBufferLength=0x208, lpBuffer=0x76a830, lpFilePart=0x19fbac | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f", lpFilePart=0x19fbac*="f") returned 0x29
	[0180.829] SetErrorMode (uMode=0x8003) returned 0x1
	[0180.830] GetProcessHeap () returned 0x760000
	[0180.830] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x76a828, Size=0x7e) returned 0x76a828
	[0180.830] GetProcessHeap () returned 0x760000
	[0180.830] RtlSizeHeap (HeapHandle=0x760000, Flags=0x0, MemoryPointer=0x76a828) returned 0x7e
	[0180.830] NeedCurrentDirectoryForExePathW (ExeName="taskkill \\f \\.") returned 1
	[0180.830] GetProcessHeap () returned 0x760000
	[0180.830] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x62) returned 0x76a8b0
	[0180.830] GetProcessHeap () returned 0x760000
	[0180.830] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0xb8) returned 0x76a920
	[0180.830] GetProcessHeap () returned 0x760000
	[0180.830] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x76a920, Size=0x62) returned 0x76a920
	[0180.830] GetProcessHeap () returned 0x760000
	[0180.830] RtlSizeHeap (HeapHandle=0x760000, Flags=0x0, MemoryPointer=0x76a920) returned 0x62
	[0180.830] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0180.830] GetProcessHeap () returned 0x760000
	[0180.830] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0xe0) returned 0x76a990
	[0180.835] GetProcessHeap () returned 0x760000
	[0180.835] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x76a990, Size=0x76) returned 0x76a990
	[0180.835] GetProcessHeap () returned 0x760000
	[0180.835] RtlSizeHeap (HeapHandle=0x760000, Flags=0x0, MemoryPointer=0x76a990) returned 0x76
	[0180.835] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0180.835] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f\\im powerpnt.exe ", fInfoLevelId=0x1, lpFindFileData=0x19f958, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f958) returned 0xffffffff
	[0180.835] GetLastError () returned 0x3
	[0180.835] GetProcessHeap () returned 0x760000
	[0180.836] RtlFreeHeap (HeapHandle=0x760000, Flags=0x0, BaseAddress=0x76fc68) returned 1
	[0180.836] GetProcessHeap () returned 0x760000
	[0180.836] RtlFreeHeap (HeapHandle=0x760000, Flags=0x0, BaseAddress=0x773c78) returned 1
	[0180.836] GetProcessHeap () returned 0x760000
	[0180.836] RtlFreeHeap (HeapHandle=0x760000, Flags=0x0, BaseAddress=0x76bc50) returned 1
	[0180.836] GetConsoleOutputCP () returned 0x1b5
	[0180.840] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0180.840] GetUserDefaultLCID () returned 0x409
	[0180.840] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x13d34a0, cchData=8 | out: lpLCData=":") returned 2
	[0180.840] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0180.840] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0180.840] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2
	[0180.840] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x13d34b0, cchData=8 | out: lpLCData="/") returned 2
	[0180.840] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x13d3500, cchData=32 | out: lpLCData="Mon") returned 4
	[0180.841] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x13d3540, cchData=32 | out: lpLCData="Tue") returned 4
	[0180.841] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x13d3580, cchData=32 | out: lpLCData="Wed") returned 4
	[0180.841] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x13d35c0, cchData=32 | out: lpLCData="Thu") returned 4
	[0180.841] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x13d3600, cchData=32 | out: lpLCData="Fri") returned 4
	[0180.841] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x13d3640, cchData=32 | out: lpLCData="Sat") returned 4
	[0180.841] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x13d3680, cchData=32 | out: lpLCData="Sun") returned 4
	[0180.841] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x13d34c0, cchData=8 | out: lpLCData=".") returned 2
	[0180.841] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x13d34e0, cchData=8 | out: lpLCData=",") returned 2
	[0180.841] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0180.842] GetProcessHeap () returned 0x760000
	[0180.843] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x20c) returned 0x76aa58
	[0180.843] GetConsoleTitleW (in: lpConsoleTitle=0x76aa58, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0180.845] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0180.845] GetProcAddress (hModule=0x75600000, lpProcName="CopyFileExW") returned 0x7561ffc0
	[0180.845] GetProcAddress (hModule=0x75600000, lpProcName="IsDebuggerPresent") returned 0x7561b0b0
	[0180.845] GetProcAddress (hModule=0x75600000, lpProcName="SetConsoleInputExeNameW") returned 0x7559b440
	[0180.846] GetProcessHeap () returned 0x760000
	[0180.846] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x400a) returned 0x76bc50
	[0180.846] GetProcessHeap () returned 0x760000
	[0180.846] RtlFreeHeap (HeapHandle=0x760000, Flags=0x0, BaseAddress=0x76bc50) returned 1
	[0180.847] _wcsicmp (_String1="taskkill", _String2=")") returned 75
	[0180.847] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14
	[0180.847] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14
	[0180.847] _wcsicmp (_String1="IF", _String2="taskkill") returned -11
	[0180.847] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11
	[0180.847] _wcsicmp (_String1="REM", _String2="taskkill") returned -2
	[0180.847] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2
	[0180.847] GetProcessHeap () returned 0x760000
	[0180.847] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x58) returned 0x76ac70
	[0180.848] GetProcessHeap () returned 0x760000
	[0180.848] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x1a) returned 0x760578
	[0180.848] GetProcessHeap () returned 0x760000
	[0180.848] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x34) returned 0x76acd0
	[0180.849] GetConsoleTitleW (in: lpConsoleTitle=0x19fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0180.853] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0180.853] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0180.853] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0180.853] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0180.853] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0180.853] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0180.853] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0180.853] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0180.853] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0180.853] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0180.853] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0180.853] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0180.853] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0180.853] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0180.853] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0180.853] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0180.853] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0180.853] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0180.853] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0180.853] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0180.853] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0180.854] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0180.854] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0180.854] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0180.854] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0180.854] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0180.854] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0180.854] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0180.854] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0180.854] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0180.854] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0180.854] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0180.854] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0180.854] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0180.854] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0180.854] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0180.854] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0180.854] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0180.854] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0180.854] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0180.854] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0180.854] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0180.854] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0180.854] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0180.855] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0180.855] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0180.855] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0180.855] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0180.855] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0180.855] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0180.855] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0180.855] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0180.855] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0180.855] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0180.855] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0180.855] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0180.865] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0180.865] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0180.865] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0180.865] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0180.865] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0180.865] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0180.865] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0180.865] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0180.865] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0180.865] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0180.865] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0180.866] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0180.866] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0180.866] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0180.866] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0180.866] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0180.866] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0180.866] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0180.866] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0180.866] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0180.867] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0180.867] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0180.867] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0180.867] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0180.867] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0180.867] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0180.867] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0180.867] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0180.867] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14
	[0180.867] _wcsicmp (_String1="taskkill", _String2="IF") returned 11
	[0180.867] _wcsicmp (_String1="taskkill", _String2="REM") returned 2
	[0180.868] GetProcessHeap () returned 0x760000
	[0180.869] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x210) returned 0x76ad10
	[0180.869] GetProcessHeap () returned 0x760000
	[0180.869] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x46) returned 0x76af28
	[0180.869] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0180.870] GetProcessHeap () returned 0x760000
	[0180.870] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x418) returned 0x7605c8
	[0180.870] SetErrorMode (uMode=0x0) returned 0x8003
	[0180.870] SetErrorMode (uMode=0x1) returned 0x0
	[0180.870] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x7605d0, lpFilePart=0x19f57c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19f57c*="Desktop") returned 0x1d
	[0180.870] SetErrorMode (uMode=0x8003) returned 0x1
	[0180.871] GetProcessHeap () returned 0x760000
	[0180.871] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x7605c8, Size=0x56) returned 0x7605c8
	[0180.872] GetProcessHeap () returned 0x760000
	[0180.872] RtlSizeHeap (HeapHandle=0x760000, Flags=0x0, MemoryPointer=0x7605c8) returned 0x56
	[0180.873] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0180.873] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0180.873] GetProcessHeap () returned 0x760000
	[0180.873] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x110) returned 0x76af78
	[0180.873] GetProcessHeap () returned 0x760000
	[0180.873] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x218) returned 0x760628
	[0180.877] GetProcessHeap () returned 0x760000
	[0180.878] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x760628, Size=0x112) returned 0x760628
	[0180.878] GetProcessHeap () returned 0x760000
	[0180.878] RtlSizeHeap (HeapHandle=0x760000, Flags=0x0, MemoryPointer=0x760628) returned 0x112
	[0180.878] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0180.878] GetProcessHeap () returned 0x760000
	[0180.878] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0xe0) returned 0x76b090
	[0180.880] GetProcessHeap () returned 0x760000
	[0180.880] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x76b090, Size=0x76) returned 0x76b090
	[0180.880] GetProcessHeap () returned 0x760000
	[0180.880] RtlSizeHeap (HeapHandle=0x760000, Flags=0x0, MemoryPointer=0x76b090) returned 0x76
	[0180.880] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0180.880] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0180.880] GetLastError () returned 0x2
	[0180.880] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0180.880] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x76b110
	[0180.880] GetProcessHeap () returned 0x760000
	[0180.880] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x14) returned 0x767708
	[0180.881] FindClose (in: hFindFile=0x76b110 | out: hFindFile=0x76b110) returned 1
	[0180.881] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0180.881] GetLastError () returned 0x2
	[0180.881] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x76b110
	[0180.881] GetProcessHeap () returned 0x760000
	[0180.881] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x767708, Size=0x4) returned 0x76b150
	[0180.881] FindClose (in: hFindFile=0x76b110 | out: hFindFile=0x76b110) returned 1
	[0180.881] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0180.881] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0180.881] GetConsoleTitleW (in: lpConsoleTitle=0x19f7fc, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0180.882] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f728, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f70c | out: lpAttributeList=0x19f728, lpSize=0x19f70c) returned 1
	[0180.882] UpdateProcThreadAttribute (in: lpAttributeList=0x19f728, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f714, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f728, lpPreviousValue=0x0) returned 1
	[0180.883] GetStartupInfoW (in: lpStartupInfo=0x19f760 | out: lpStartupInfo=0x19f760*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x13c, hStdOutput=0x140, hStdError=0x144)) 
	[0180.883] GetProcessHeap () returned 0x760000
	[0180.883] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x18) returned 0x767768
	[0180.883] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0180.883] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0180.883] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0180.883] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0180.883] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0180.883] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0180.883] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0180.883] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0180.883] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0180.883] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0180.883] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0180.883] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0180.883] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0180.883] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0180.883] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0180.883] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0180.883] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0180.883] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0180.883] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0180.884] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0180.884] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0180.884] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0180.884] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0180.884] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0180.884] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0180.884] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0180.884] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0180.884] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0180.884] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0180.884] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0180.884] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0180.884] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0180.884] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0180.884] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0180.884] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0180.884] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0180.884] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0180.884] GetProcessHeap () returned 0x760000
	[0180.884] RtlFreeHeap (HeapHandle=0x760000, Flags=0x0, BaseAddress=0x767768) returned 1
	[0180.884] GetProcessHeap () returned 0x760000
	[0180.884] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0xa) returned 0x76b110
	[0180.884] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1
	[0180.888] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill  /f /im powerpnt.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x19f6b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill  /f /im powerpnt.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f6fc | out: lpCommandLine="taskkill  /f /im powerpnt.exe ", lpProcessInformation=0x19f6fc*(hProcess=0x9c, hThread=0x98, dwProcessId=0x1138, dwThreadId=0x1114)) returned 1
	[0180.907] CloseHandle (hObject=0x98) returned 1
	[0180.907] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0180.907] GetProcessHeap () returned 0x760000
	[0180.908] RtlFreeHeap (HeapHandle=0x760000, Flags=0x0, BaseAddress=0x769d50) returned 1
	[0180.908] GetEnvironmentStringsW () returned 0x769d50*
	[0180.908] GetProcessHeap () returned 0x760000
	[0180.908] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0xa76) returned 0x767cc0
	[0180.908] FreeEnvironmentStringsA (penv="=") returned 1
	[0180.908] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0
	[0181.931] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x19f694 | out: lpExitCode=0x19f694*=0x80) returned 1
	[0181.932] CloseHandle (hObject=0x9c) returned 1
	[0181.932] _vsnwprintf (in: _Buffer=0x19f77c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f69c | out: _Buffer="00000080") returned 8
	[0181.932] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1
	[0181.933] GetProcessHeap () returned 0x760000
	[0181.933] RtlFreeHeap (HeapHandle=0x760000, Flags=0x0, BaseAddress=0x767cc0) returned 1
	[0181.933] GetEnvironmentStringsW () returned 0x76b160*
	[0181.933] GetProcessHeap () returned 0x760000
	[0181.934] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0xa9c) returned 0x767cc0
	[0181.934] FreeEnvironmentStringsA (penv="=") returned 1
	[0181.934] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0181.934] GetProcessHeap () returned 0x760000
	[0181.934] RtlFreeHeap (HeapHandle=0x760000, Flags=0x0, BaseAddress=0x767cc0) returned 1
	[0181.934] GetEnvironmentStringsW () returned 0x76b160*
	[0181.934] GetProcessHeap () returned 0x760000
	[0181.934] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0xa9c) returned 0x767cc0
	[0181.934] FreeEnvironmentStringsA (penv="=") returned 1
	[0181.934] GetProcessHeap () returned 0x760000
	[0181.934] RtlFreeHeap (HeapHandle=0x760000, Flags=0x0, BaseAddress=0x76b110) returned 1
	[0181.934] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f728 | out: lpAttributeList=0x19f728) 
	[0181.934] _get_osfhandle (_FileHandle=1) returned 0x140
	[0181.934] SetConsoleMode (hConsoleHandle=0x140, dwMode=0x0) returned 0
	[0181.934] _get_osfhandle (_FileHandle=1) returned 0x140
	[0181.935] GetConsoleMode (in: hConsoleHandle=0x140, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0181.935] _get_osfhandle (_FileHandle=0) returned 0x13c
	[0181.935] GetConsoleMode (in: hConsoleHandle=0x13c, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0181.935] GetConsoleOutputCP () returned 0x1b5
	[0181.942] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0181.942] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0181.945] exit (_Code=128) 

Thread:
	id = 336
	os_tid = 0x10fc


Process:
	id = "66"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\syswow64\\taskkill.exe"
	page_root = "0x71e63000"
	os_pid = "0x1138"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "65"
	os_parent_pid = "0x1104"
	cmd_line = "taskkill  /f /im powerpnt.exe "
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 4737
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 4738
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 4739
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 4740
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 4741
	        start_va = 0xa0000
	          end_va = 0xdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 4742
	        start_va = 0xe0000
	          end_va = 0xe3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 4743
	        start_va = 0xf0000
	          end_va = 0xf0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 4744
	        start_va = 0x100000
	          end_va = 0x101fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 4745
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 4746
	        start_va = 0x13b0000
	          end_va = 0x13c5fff
	       monitored = 0
	     entry_point = 0x13bde80
	     region_type = mapped_file
	            name = "taskkill.exe"
	        filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe")

Region:
	              id = 4747
	        start_va = 0x13d0000
	          end_va = 0x53cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000013d0000"
	        filename = ""

Region:
	              id = 4748
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 4749
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 4750
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 4751
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 4752
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 4753
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 4754
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 4755
	        start_va = 0x180000
	          end_va = 0x18ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000180000"
	        filename = ""

Region:
	              id = 4756
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 4757
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 4758
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 4759
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 4760
	        start_va = 0x400000
	          end_va = 0x68ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 4761
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 4762
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 4763
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 4764
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 4765
	        start_va = 0x400000
	          end_va = 0x4bdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 4766
	        start_va = 0x590000
	          end_va = 0x68ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000590000"
	        filename = ""

Region:
	              id = 4767
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 4768
	        start_va = 0x74650000
	          end_va = 0x746cafff
	       monitored = 0
	     entry_point = 0x7466e970
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 4769
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 4770
	        start_va = 0x110000
	          end_va = 0x14ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000110000"
	        filename = ""

Region:
	              id = 4771
	        start_va = 0x190000
	          end_va = 0x1cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000190000"
	        filename = ""

Region:
	              id = 4772
	        start_va = 0x76ae0000
	          end_va = 0x76b23fff
	       monitored = 0
	     entry_point = 0x76af9d80
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 4773
	        start_va = 0x75260000
	          end_va = 0x7530cfff
	       monitored = 0
	     entry_point = 0x75274f00
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 4774
	        start_va = 0x74450000
	          end_va = 0x7446dfff
	       monitored = 0
	     entry_point = 0x7445b640
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 4775
	        start_va = 0x74440000
	          end_va = 0x74449fff
	       monitored = 0
	     entry_point = 0x74442a00
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 4776
	        start_va = 0x74590000
	          end_va = 0x745e7fff
	       monitored = 0
	     entry_point = 0x745d25c0
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 4777
	        start_va = 0x77450000
	          end_va = 0x77596fff
	       monitored = 0
	     entry_point = 0x77461cf0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 4778
	        start_va = 0x76b30000
	          end_va = 0x76c7efff
	       monitored = 0
	     entry_point = 0x76be6820
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 4779
	        start_va = 0x753c0000
	          end_va = 0x75451fff
	       monitored = 0
	     entry_point = 0x753f8cf0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 4780
	        start_va = 0x77290000
	          end_va = 0x7744cfff
	       monitored = 0
	     entry_point = 0x77372a10
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")

Region:
	              id = 4781
	        start_va = 0x75310000
	          end_va = 0x7536efff
	       monitored = 0
	     entry_point = 0x75314af0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 4782
	        start_va = 0x77240000
	          end_va = 0x77284fff
	       monitored = 0
	     entry_point = 0x7725de90
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 4783
	        start_va = 0x6cc90000
	          end_va = 0x6cc97fff
	       monitored = 0
	     entry_point = 0x6cc917b0
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 4784
	        start_va = 0x6cc70000
	          end_va = 0x6cc85fff
	       monitored = 0
	     entry_point = 0x6cc721d0
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")

Region:
	              id = 4785
	        start_va = 0x6cc30000
	          end_va = 0x6cc6efff
	       monitored = 0
	     entry_point = 0x6cc446c0
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll")

Region:
	              id = 4786
	        start_va = 0x6caf0000
	          end_va = 0x6cc2efff
	       monitored = 0
	     entry_point = 0x6cb1d880
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll")

Region:
	              id = 4787
	        start_va = 0x6cad0000
	          end_va = 0x6caebfff
	       monitored = 0
	     entry_point = 0x6cad4720
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")

Region:
	              id = 4788
	        start_va = 0x6cac0000
	          end_va = 0x6cac9fff
	       monitored = 0
	     entry_point = 0x6cac28d0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")

Region:
	              id = 4789
	        start_va = 0x4c0000
	          end_va = 0x4fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004c0000"
	        filename = ""

Region:
	              id = 4790
	        start_va = 0x500000
	          end_va = 0x53ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000500000"
	        filename = ""

Region:
	              id = 4791
	        start_va = 0x690000
	          end_va = 0x76ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000690000"
	        filename = ""

Region:
	              id = 4792
	        start_va = 0x150000
	          end_va = 0x179fff
	       monitored = 0
	     entry_point = 0x155680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 4793
	        start_va = 0x770000
	          end_va = 0x8f7fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000770000"
	        filename = ""

Region:
	              id = 4794
	        start_va = 0x74ea0000
	          end_va = 0x74ecafff
	       monitored = 0
	     entry_point = 0x74ea5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 4795
	        start_va = 0x900000
	          end_va = 0xa80fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000900000"
	        filename = ""

Region:
	              id = 4796
	        start_va = 0x53d0000
	          end_va = 0x67cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000053d0000"
	        filename = ""

Region:
	              id = 4797
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 4798
	        start_va = 0x150000
	          end_va = 0x150fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000150000"
	        filename = ""

Region:
	              id = 4799
	        start_va = 0x160000
	          end_va = 0x164fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taskkill.exe.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui")

Region:
	              id = 4800
	        start_va = 0x170000
	          end_va = 0x170fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000170000"
	        filename = ""

Region:
	              id = 4801
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001d0000"
	        filename = ""

Region:
	              id = 4802
	        start_va = 0xa90000
	          end_va = 0xdc6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 4803
	        start_va = 0xdd0000
	          end_va = 0xeb9fff
	       monitored = 0
	     entry_point = 0xe0d650
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 4804
	        start_va = 0x1e0000
	          end_va = 0x1e3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001e0000"
	        filename = ""

Region:
	              id = 4805
	        start_va = 0xdd0000
	          end_va = 0xeaffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 4806
	        start_va = 0x76e20000
	          end_va = 0x76e2bfff
	       monitored = 0
	     entry_point = 0x76e23930
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")

Region:
	              id = 4807
	        start_va = 0x1f0000
	          end_va = 0x1f0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001f0000"
	        filename = ""

Region:
	              id = 4808
	        start_va = 0x76c80000
	          end_va = 0x76d03fff
	       monitored = 0
	     entry_point = 0x76ca6220
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 4809
	        start_va = 0x540000
	          end_va = 0x540fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000540000"
	        filename = ""

Region:
	              id = 4810
	        start_va = 0x6cab0000
	          end_va = 0x6cabcfff
	       monitored = 0
	     entry_point = 0x6cab3520
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 4811
	        start_va = 0x6ca40000
	          end_va = 0x6caa6fff
	       monitored = 0
	     entry_point = 0x6ca5b610
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 4812
	        start_va = 0x740f0000
	          end_va = 0x7410afff
	       monitored = 0
	     entry_point = 0x740f9050
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 4813
	        start_va = 0x6c9f0000
	          end_va = 0x6ca33fff
	       monitored = 0
	     entry_point = 0x6ca0aaf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")

Region:
	              id = 4814
	        start_va = 0x550000
	          end_va = 0x58ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000550000"
	        filename = ""

Region:
	              id = 4815
	        start_va = 0x690000
	          end_va = 0x6cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000690000"
	        filename = ""

Region:
	              id = 4816
	        start_va = 0x760000
	          end_va = 0x76ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000760000"
	        filename = ""

Region:
	              id = 4817
	        start_va = 0x6d0000
	          end_va = 0x70ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006d0000"
	        filename = ""

Region:
	              id = 4818
	        start_va = 0x710000
	          end_va = 0x74ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000710000"
	        filename = ""

Region:
	              id = 4819
	        start_va = 0xeb0000
	          end_va = 0xeeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000eb0000"
	        filename = ""

Region:
	              id = 4820
	        start_va = 0xef0000
	          end_va = 0xf2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000ef0000"
	        filename = ""

Region:
	              id = 4821
	        start_va = 0x6c9d0000
	          end_va = 0x6c9e0fff
	       monitored = 0
	     entry_point = 0x6c9d8fa0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 4822
	        start_va = 0x6c910000
	          end_va = 0x6c9cefff
	       monitored = 0
	     entry_point = 0x6c941e80
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 4824
	        start_va = 0x750000
	          end_va = 0x755fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000750000"
	        filename = ""


Thread:
	id = 337
	os_tid = 0x1114


Thread:
	id = 338
	os_tid = 0x690


Thread:
	id = 339
	os_tid = 0x66c


Thread:
	id = 340
	os_tid = 0x648


Thread:
	id = 341
	os_tid = 0x11d0


Thread:
	id = 342
	os_tid = 0x11bc


Process:
	id = "67"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x2ff29000"
	os_pid = "0x11b8"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x614"
	cmd_line = "cmd.exe /c \"taskkill /f /im steam.exe \""
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 4827
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 4828
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 4829
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 4830
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 4831
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 4832
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 4833
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 4834
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 4835
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 4836
	        start_va = 0x13a0000
	          end_va = 0x13f1fff
	       monitored = 1
	     entry_point = 0x13b4fd0
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")

Region:
	              id = 4837
	        start_va = 0x1400000
	          end_va = 0x53fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001400000"
	        filename = ""

Region:
	              id = 4838
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 4839
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 4840
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 4841
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 4842
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 4843
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 4844
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 4845
	        start_va = 0x440000
	          end_va = 0x44ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000440000"
	        filename = ""

Region:
	              id = 4846
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 4847
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 4848
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 4849
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 4850
	        start_va = 0x450000
	          end_va = 0x6dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000450000"
	        filename = ""

Region:
	              id = 4851
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 4852
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 4853
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 4854
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 4855
	        start_va = 0x450000
	          end_va = 0x50dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 4856
	        start_va = 0x5e0000
	          end_va = 0x6dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005e0000"
	        filename = ""

Region:
	              id = 4857
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 4858
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 4859
	        start_va = 0x6e0000
	          end_va = 0x7dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006e0000"
	        filename = ""

Region:
	              id = 4860
	        start_va = 0x1d0000
	          end_va = 0x1fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001d0000"
	        filename = ""

Region:
	              id = 4861
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 4862
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 4863
	        start_va = 0x7e0000
	          end_va = 0xb16fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 343
	os_tid = 0x118c

	[0182.229] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000
	[0182.229] __set_app_type (_Type=0x1) 
	[0182.229] __p__fmode () returned 0x74974d6c
	[0182.229] __p__commode () returned 0x74975b1c
	[0182.229] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13b5200) returned 0x0
	[0182.230] __getmainargs (in: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0, _DoWildCard=0, _StartInfo=0x13c60fc | out: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0) returned 0
	[0182.230] GetCurrentThreadId () returned 0x118c
	[0182.230] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x118c) returned 0x78
	[0182.230] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0182.230] GetProcAddress (hModule=0x75600000, lpProcName="SetThreadUILanguage") returned 0x75642510
	[0182.230] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0182.243] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0182.243] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2
	[0182.243] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0182.243] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0182.243] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0182.243] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0182.243] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0182.243] GetConsoleOutputCP () returned 0x1b5
	[0182.246] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0182.246] SetConsoleCtrlHandler (HandlerRoutine=0x13c0e40, Add=1) returned 1
	[0182.246] _get_osfhandle (_FileHandle=1) returned 0x13c
	[0182.246] SetConsoleMode (hConsoleHandle=0x13c, dwMode=0x0) returned 0
	[0182.246] _get_osfhandle (_FileHandle=1) returned 0x13c
	[0182.246] GetConsoleMode (in: hConsoleHandle=0x13c, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0182.246] _get_osfhandle (_FileHandle=0) returned 0x130
	[0182.246] GetConsoleMode (in: hConsoleHandle=0x130, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0182.246] GetEnvironmentStringsW () returned 0x5e7fd0*
	[0182.247] GetProcessHeap () returned 0x5e0000
	[0182.247] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xa1a) returned 0x5e89f8
	[0182.247] FreeEnvironmentStringsA (penv="A") returned 1
	[0182.247] GetProcessHeap () returned 0x5e0000
	[0182.247] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x4) returned 0x5e7e58
	[0182.247] GetEnvironmentStringsW () returned 0x5e7fd0*
	[0182.247] GetProcessHeap () returned 0x5e0000
	[0182.247] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xa1a) returned 0x5e9420
	[0182.247] FreeEnvironmentStringsA (penv="A") returned 1
	[0182.247] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0182.247] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0182.247] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0182.247] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0182.247] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0182.247] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0182.247] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0182.248] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0182.248] RegCloseKey (hKey=0x88) returned 0x0
	[0182.248] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0182.248] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0182.248] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0182.248] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0182.248] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0182.248] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0182.248] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0182.248] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0182.248] RegCloseKey (hKey=0x88) returned 0x0
	[0182.248] time (in: timer=0x0 | out: timer=0x0) returned 0x62344240
	[0182.248] srand (_Seed=0x62344240) 
	[0182.248] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im steam.exe \""
	[0182.248] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im steam.exe \""
	[0182.248] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0182.249] GetProcessHeap () returned 0x5e0000
	[0182.249] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x210) returned 0x5e6f88
	[0182.249] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5e6f90, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0182.249] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0182.249] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0182.249] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0182.249] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0182.249] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0182.249] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0182.249] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0182.249] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0182.249] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0182.249] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0182.249] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0182.249] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0182.249] GetProcessHeap () returned 0x5e0000
	[0182.250] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5e89f8) returned 1
	[0182.251] GetEnvironmentStringsW () returned 0x5e7fd0*
	[0182.251] GetProcessHeap () returned 0x5e0000
	[0182.251] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xa32) returned 0x5ea888
	[0182.251] FreeEnvironmentStringsA (penv="A") returned 1
	[0182.251] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b
	[0182.251] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0182.251] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0182.251] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0182.251] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0182.251] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0182.251] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0182.251] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0182.251] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0182.252] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0182.252] GetProcessHeap () returned 0x5e0000
	[0182.252] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x44) returned 0x5e71a0
	[0182.252] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0182.252] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19fc4c*="Desktop") returned 0x1d
	[0182.252] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0182.252] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x5e71f0
	[0182.252] FindClose (in: hFindFile=0x5e71f0 | out: hFindFile=0x5e71f0) returned 1
	[0182.252] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x5e71f0
	[0182.252] FindClose (in: hFindFile=0x5e71f0 | out: hFindFile=0x5e71f0) returned 1
	[0182.252] _wcsnicmp (_String1="RDHJ0C~1", _String2="RDhJ0CNFevzX", _MaxCount=0xc) returned 16
	[0182.253] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x5e71f0
	[0182.253] FindClose (in: hFindFile=0x5e71f0 | out: hFindFile=0x5e71f0) returned 1
	[0182.253] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0182.253] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1
	[0182.253] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 1
	[0182.253] GetProcessHeap () returned 0x5e0000
	[0182.253] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5ea888) returned 1
	[0182.253] GetEnvironmentStringsW () returned 0x5e7fd0*
	[0182.253] GetProcessHeap () returned 0x5e0000
	[0182.254] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xa76) returned 0x5e9e48
	[0182.254] FreeEnvironmentStringsA (penv="=") returned 1
	[0182.254] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0182.254] GetProcessHeap () returned 0x5e0000
	[0182.254] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5e71a0) returned 1
	[0182.254] GetProcessHeap () returned 0x5e0000
	[0182.254] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x400e) returned 0x5ebd48
	[0182.254] GetProcessHeap () returned 0x5e0000
	[0182.255] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x46) returned 0x5e71a0
	[0182.255] GetProcessHeap () returned 0x5e0000
	[0182.255] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x4008) returned 0x5efd60
	[0182.255] GetProcessHeap () returned 0x5e0000
	[0182.255] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x4008) returned 0x5f3d70
	[0182.256] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0182.257] GetProcessHeap () returned 0x5e0000
	[0182.257] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x418) returned 0x5ea8c8
	[0182.257] SetErrorMode (uMode=0x0) returned 0x8003
	[0182.257] SetErrorMode (uMode=0x1) returned 0x0
	[0182.257] GetFullPathNameW (in: lpFileName="taskkill \\f \\.", nBufferLength=0x208, lpBuffer=0x5ea8d0, lpFilePart=0x19fbac | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f", lpFilePart=0x19fbac*="f") returned 0x29
	[0182.257] SetErrorMode (uMode=0x8003) returned 0x1
	[0182.257] GetProcessHeap () returned 0x5e0000
	[0182.257] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5ea8c8, Size=0x78) returned 0x5ea8c8
	[0182.257] GetProcessHeap () returned 0x5e0000
	[0182.257] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x5ea8c8) returned 0x78
	[0182.258] NeedCurrentDirectoryForExePathW (ExeName="taskkill \\f \\.") returned 1
	[0182.258] GetProcessHeap () returned 0x5e0000
	[0182.258] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x62) returned 0x5e71f0
	[0182.258] GetProcessHeap () returned 0x5e0000
	[0182.258] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xb8) returned 0x5ea948
	[0182.258] GetProcessHeap () returned 0x5e0000
	[0182.258] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5ea948, Size=0x62) returned 0x5ea948
	[0182.258] GetProcessHeap () returned 0x5e0000
	[0182.258] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x5ea948) returned 0x62
	[0182.258] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0182.258] GetProcessHeap () returned 0x5e0000
	[0182.258] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xe0) returned 0x5ea9b8
	[0182.262] GetProcessHeap () returned 0x5e0000
	[0182.262] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5ea9b8, Size=0x76) returned 0x5ea9b8
	[0182.262] GetProcessHeap () returned 0x5e0000
	[0182.262] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x5ea9b8) returned 0x76
	[0182.262] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0182.262] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f\\im steam.exe ", fInfoLevelId=0x1, lpFindFileData=0x19f958, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f958) returned 0xffffffff
	[0182.263] GetLastError () returned 0x3
	[0182.263] GetProcessHeap () returned 0x5e0000
	[0182.263] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5efd60) returned 1
	[0182.263] GetProcessHeap () returned 0x5e0000
	[0182.264] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5f3d70) returned 1
	[0182.264] GetProcessHeap () returned 0x5e0000
	[0182.264] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5ebd48) returned 1
	[0182.264] GetConsoleOutputCP () returned 0x1b5
	[0182.266] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0182.266] GetUserDefaultLCID () returned 0x409
	[0182.267] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x13d34a0, cchData=8 | out: lpLCData=":") returned 2
	[0182.267] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0182.267] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0182.267] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2
	[0182.267] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x13d34b0, cchData=8 | out: lpLCData="/") returned 2
	[0182.267] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x13d3500, cchData=32 | out: lpLCData="Mon") returned 4
	[0182.267] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x13d3540, cchData=32 | out: lpLCData="Tue") returned 4
	[0182.267] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x13d3580, cchData=32 | out: lpLCData="Wed") returned 4
	[0182.267] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x13d35c0, cchData=32 | out: lpLCData="Thu") returned 4
	[0182.267] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x13d3600, cchData=32 | out: lpLCData="Fri") returned 4
	[0182.267] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x13d3640, cchData=32 | out: lpLCData="Sat") returned 4
	[0182.267] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x13d3680, cchData=32 | out: lpLCData="Sun") returned 4
	[0182.267] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x13d34c0, cchData=8 | out: lpLCData=".") returned 2
	[0182.267] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x13d34e0, cchData=8 | out: lpLCData=",") returned 2
	[0182.267] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0182.269] GetProcessHeap () returned 0x5e0000
	[0182.269] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x20c) returned 0x5eaa80
	[0182.269] GetConsoleTitleW (in: lpConsoleTitle=0x5eaa80, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0182.271] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0182.271] GetProcAddress (hModule=0x75600000, lpProcName="CopyFileExW") returned 0x7561ffc0
	[0182.271] GetProcAddress (hModule=0x75600000, lpProcName="IsDebuggerPresent") returned 0x7561b0b0
	[0182.271] GetProcAddress (hModule=0x75600000, lpProcName="SetConsoleInputExeNameW") returned 0x7559b440
	[0182.271] GetProcessHeap () returned 0x5e0000
	[0182.271] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x400a) returned 0x5ebd48
	[0182.271] GetProcessHeap () returned 0x5e0000
	[0182.272] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5ebd48) returned 1
	[0182.274] _wcsicmp (_String1="taskkill", _String2=")") returned 75
	[0182.274] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14
	[0182.274] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14
	[0182.274] _wcsicmp (_String1="IF", _String2="taskkill") returned -11
	[0182.274] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11
	[0182.274] _wcsicmp (_String1="REM", _String2="taskkill") returned -2
	[0182.274] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2
	[0182.274] GetProcessHeap () returned 0x5e0000
	[0182.274] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x58) returned 0x5eac98
	[0182.274] GetProcessHeap () returned 0x5e0000
	[0182.274] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x1a) returned 0x5e7e80
	[0182.274] GetProcessHeap () returned 0x5e0000
	[0182.275] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x2e) returned 0x5e7260
	[0182.275] GetConsoleTitleW (in: lpConsoleTitle=0x19fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0182.277] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0182.278] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0182.278] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0182.278] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0182.278] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0182.278] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0182.278] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0182.278] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0182.278] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0182.278] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0182.278] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0182.278] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0182.278] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0182.278] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0182.278] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0182.278] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0182.278] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0182.278] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0182.278] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0182.278] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0182.278] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0182.278] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0182.278] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0182.278] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0182.278] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0182.278] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0182.278] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0182.278] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0182.278] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0182.278] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0182.279] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0182.279] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0182.279] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0182.279] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0182.279] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0182.279] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0182.279] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0182.279] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0182.279] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0182.279] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0182.279] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0182.279] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0182.279] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0182.279] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0182.279] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0182.279] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0182.279] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0182.279] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0182.279] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0182.279] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0182.279] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0182.279] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0182.279] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0182.279] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0182.279] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0182.279] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0182.279] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0182.279] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0182.279] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0182.279] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0182.279] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0182.280] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0182.280] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0182.280] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0182.280] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0182.280] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0182.280] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0182.280] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0182.280] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0182.280] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0182.280] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0182.280] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0182.280] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0182.280] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0182.280] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0182.280] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0182.280] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0182.280] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0182.280] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0182.280] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0182.280] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0182.280] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0182.280] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0182.280] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0182.280] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14
	[0182.280] _wcsicmp (_String1="taskkill", _String2="IF") returned 11
	[0182.280] _wcsicmp (_String1="taskkill", _String2="REM") returned 2
	[0182.281] GetProcessHeap () returned 0x5e0000
	[0182.281] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x210) returned 0x5eacf8
	[0182.281] GetProcessHeap () returned 0x5e0000
	[0182.281] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x40) returned 0x5eaf10
	[0182.281] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0182.281] GetProcessHeap () returned 0x5e0000
	[0182.281] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x418) returned 0x5e05c8
	[0182.281] SetErrorMode (uMode=0x0) returned 0x8003
	[0182.281] SetErrorMode (uMode=0x1) returned 0x0
	[0182.281] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x5e05d0, lpFilePart=0x19f57c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19f57c*="Desktop") returned 0x1d
	[0182.282] SetErrorMode (uMode=0x8003) returned 0x1
	[0182.282] GetProcessHeap () returned 0x5e0000
	[0182.282] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5e05c8, Size=0x56) returned 0x5e05c8
	[0182.282] GetProcessHeap () returned 0x5e0000
	[0182.282] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x5e05c8) returned 0x56
	[0182.282] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0182.282] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0182.282] GetProcessHeap () returned 0x5e0000
	[0182.282] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x110) returned 0x5eaf58
	[0182.282] GetProcessHeap () returned 0x5e0000
	[0182.282] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x218) returned 0x5eb070
	[0182.287] GetProcessHeap () returned 0x5e0000
	[0182.287] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5eb070, Size=0x112) returned 0x5eb070
	[0182.287] GetProcessHeap () returned 0x5e0000
	[0182.287] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x5eb070) returned 0x112
	[0182.287] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0182.287] GetProcessHeap () returned 0x5e0000
	[0182.287] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xe0) returned 0x5eb190
	[0182.289] GetProcessHeap () returned 0x5e0000
	[0182.289] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5eb190, Size=0x76) returned 0x5eb190
	[0182.289] GetProcessHeap () returned 0x5e0000
	[0182.289] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x5eb190) returned 0x76
	[0182.289] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0182.289] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0182.289] GetLastError () returned 0x2
	[0182.289] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0182.289] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x5eb210
	[0182.289] GetProcessHeap () returned 0x5e0000
	[0182.289] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x14) returned 0x5e7770
	[0182.290] FindClose (in: hFindFile=0x5eb210 | out: hFindFile=0x5eb210) returned 1
	[0182.290] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0182.290] GetLastError () returned 0x2
	[0182.290] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x5eb210
	[0182.290] GetProcessHeap () returned 0x5e0000
	[0182.290] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5e7770, Size=0x4) returned 0x5eb250
	[0182.290] FindClose (in: hFindFile=0x5eb210 | out: hFindFile=0x5eb210) returned 1
	[0182.290] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0182.290] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0182.290] GetConsoleTitleW (in: lpConsoleTitle=0x19f7fc, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0182.292] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f728, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f70c | out: lpAttributeList=0x19f728, lpSize=0x19f70c) returned 1
	[0182.292] UpdateProcThreadAttribute (in: lpAttributeList=0x19f728, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f714, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f728, lpPreviousValue=0x0) returned 1
	[0182.292] GetStartupInfoW (in: lpStartupInfo=0x19f760 | out: lpStartupInfo=0x19f760*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x130, hStdOutput=0x13c, hStdError=0x140)) 
	[0182.293] GetProcessHeap () returned 0x5e0000
	[0182.293] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x18) returned 0x5e7770
	[0182.293] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0182.293] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0182.293] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0182.293] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0182.293] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0182.293] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0182.293] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0182.293] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0182.293] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0182.293] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0182.293] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0182.293] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0182.293] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0182.293] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0182.293] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0182.293] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0182.293] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0182.294] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0182.294] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0182.294] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0182.294] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0182.294] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0182.294] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0182.294] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0182.294] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0182.294] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0182.294] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0182.294] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0182.294] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0182.294] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0182.294] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0182.294] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0182.294] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0182.294] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0182.294] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0182.294] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0182.294] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0182.294] GetProcessHeap () returned 0x5e0000
	[0182.294] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5e7770) returned 1
	[0182.294] GetProcessHeap () returned 0x5e0000
	[0182.294] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xa) returned 0x5eb210
	[0182.294] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1
	[0182.298] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill  /f /im steam.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x19f6b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill  /f /im steam.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f6fc | out: lpCommandLine="taskkill  /f /im steam.exe ", lpProcessInformation=0x19f6fc*(hProcess=0x9c, hThread=0x98, dwProcessId=0x11a0, dwThreadId=0x1178)) returned 1
	[0182.314] CloseHandle (hObject=0x98) returned 1
	[0182.314] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0182.314] GetProcessHeap () returned 0x5e0000
	[0182.315] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5e9e48) returned 1
	[0182.332] GetEnvironmentStringsW () returned 0x5e9e48*
	[0182.332] GetProcessHeap () returned 0x5e0000
	[0182.332] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xa76) returned 0x5ebd48
	[0182.332] FreeEnvironmentStringsA (penv="=") returned 1
	[0182.332] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0
	[0183.290] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x19f694 | out: lpExitCode=0x19f694*=0x80) returned 1
	[0183.291] CloseHandle (hObject=0x9c) returned 1
	[0183.291] _vsnwprintf (in: _Buffer=0x19f77c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f69c | out: _Buffer="00000080") returned 8
	[0183.291] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1
	[0183.291] GetProcessHeap () returned 0x5e0000
	[0183.292] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5ebd48) returned 1
	[0183.292] GetEnvironmentStringsW () returned 0x5eb260*
	[0183.292] GetProcessHeap () returned 0x5e0000
	[0183.292] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xa9c) returned 0x5ebd08
	[0183.292] FreeEnvironmentStringsA (penv="=") returned 1
	[0183.292] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0183.292] GetProcessHeap () returned 0x5e0000
	[0183.292] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5ebd08) returned 1
	[0183.292] GetEnvironmentStringsW () returned 0x5eb260*
	[0183.292] GetProcessHeap () returned 0x5e0000
	[0183.292] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xa9c) returned 0x5ebd08
	[0183.292] FreeEnvironmentStringsA (penv="=") returned 1
	[0183.293] GetProcessHeap () returned 0x5e0000
	[0183.293] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5eb210) returned 1
	[0183.293] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f728 | out: lpAttributeList=0x19f728) 
	[0183.293] _get_osfhandle (_FileHandle=1) returned 0x13c
	[0183.293] SetConsoleMode (hConsoleHandle=0x13c, dwMode=0x0) returned 0
	[0183.293] _get_osfhandle (_FileHandle=1) returned 0x13c
	[0183.293] GetConsoleMode (in: hConsoleHandle=0x13c, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0183.293] _get_osfhandle (_FileHandle=0) returned 0x130
	[0183.293] GetConsoleMode (in: hConsoleHandle=0x130, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0183.293] GetConsoleOutputCP () returned 0x1b5
	[0183.293] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0183.293] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0183.294] exit (_Code=128) 

Thread:
	id = 344
	os_tid = 0x11a4


Process:
	id = "68"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\syswow64\\taskkill.exe"
	page_root = "0x2ff4f000"
	os_pid = "0x11a0"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "67"
	os_parent_pid = "0x11b8"
	cmd_line = "taskkill  /f /im steam.exe "
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 4864
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 4865
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 4866
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 4867
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 4868
	        start_va = 0xa0000
	          end_va = 0xdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 4869
	        start_va = 0xe0000
	          end_va = 0xe3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 4870
	        start_va = 0xf0000
	          end_va = 0xf0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 4871
	        start_va = 0x100000
	          end_va = 0x101fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 4872
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 4873
	        start_va = 0x13b0000
	          end_va = 0x13c5fff
	       monitored = 0
	     entry_point = 0x13bde80
	     region_type = mapped_file
	            name = "taskkill.exe"
	        filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe")

Region:
	              id = 4874
	        start_va = 0x13d0000
	          end_va = 0x53cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000013d0000"
	        filename = ""

Region:
	              id = 4875
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 4876
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 4877
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 4878
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 4879
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 4880
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 4881
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 4882
	        start_va = 0x160000
	          end_va = 0x16ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000160000"
	        filename = ""

Region:
	              id = 4883
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 4884
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 4885
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 4886
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 4887
	        start_va = 0x400000
	          end_va = 0x68ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 4888
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 4889
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 4890
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 4891
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 4892
	        start_va = 0x400000
	          end_va = 0x4bdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 4893
	        start_va = 0x590000
	          end_va = 0x68ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000590000"
	        filename = ""

Region:
	              id = 4894
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 4895
	        start_va = 0x74650000
	          end_va = 0x746cafff
	       monitored = 0
	     entry_point = 0x7466e970
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 4896
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 4897
	        start_va = 0x110000
	          end_va = 0x14ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000110000"
	        filename = ""

Region:
	              id = 4898
	        start_va = 0x170000
	          end_va = 0x1affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000170000"
	        filename = ""

Region:
	              id = 4899
	        start_va = 0x76ae0000
	          end_va = 0x76b23fff
	       monitored = 0
	     entry_point = 0x76af9d80
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 4900
	        start_va = 0x75260000
	          end_va = 0x7530cfff
	       monitored = 0
	     entry_point = 0x75274f00
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 4901
	        start_va = 0x74450000
	          end_va = 0x7446dfff
	       monitored = 0
	     entry_point = 0x7445b640
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 4902
	        start_va = 0x74440000
	          end_va = 0x74449fff
	       monitored = 0
	     entry_point = 0x74442a00
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 4903
	        start_va = 0x74590000
	          end_va = 0x745e7fff
	       monitored = 0
	     entry_point = 0x745d25c0
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 4904
	        start_va = 0x77450000
	          end_va = 0x77596fff
	       monitored = 0
	     entry_point = 0x77461cf0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 4905
	        start_va = 0x6cc90000
	          end_va = 0x6cc97fff
	       monitored = 0
	     entry_point = 0x6cc917b0
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 4906
	        start_va = 0x76b30000
	          end_va = 0x76c7efff
	       monitored = 0
	     entry_point = 0x76be6820
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 4907
	        start_va = 0x753c0000
	          end_va = 0x75451fff
	       monitored = 0
	     entry_point = 0x753f8cf0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 4908
	        start_va = 0x77290000
	          end_va = 0x7744cfff
	       monitored = 0
	     entry_point = 0x77372a10
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")

Region:
	              id = 4909
	        start_va = 0x75310000
	          end_va = 0x7536efff
	       monitored = 0
	     entry_point = 0x75314af0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 4910
	        start_va = 0x77240000
	          end_va = 0x77284fff
	       monitored = 0
	     entry_point = 0x7725de90
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 4911
	        start_va = 0x6cc70000
	          end_va = 0x6cc85fff
	       monitored = 0
	     entry_point = 0x6cc721d0
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")

Region:
	              id = 4912
	        start_va = 0x6cc30000
	          end_va = 0x6cc6efff
	       monitored = 0
	     entry_point = 0x6cc446c0
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll")

Region:
	              id = 4913
	        start_va = 0x6caf0000
	          end_va = 0x6cc2efff
	       monitored = 0
	     entry_point = 0x6cb1d880
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll")

Region:
	              id = 4914
	        start_va = 0x6cad0000
	          end_va = 0x6caebfff
	       monitored = 0
	     entry_point = 0x6cad4720
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")

Region:
	              id = 4915
	        start_va = 0x6cac0000
	          end_va = 0x6cac9fff
	       monitored = 0
	     entry_point = 0x6cac28d0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")

Region:
	              id = 4916
	        start_va = 0x690000
	          end_va = 0x79ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000690000"
	        filename = ""

Region:
	              id = 4917
	        start_va = 0x1b0000
	          end_va = 0x1d9fff
	       monitored = 0
	     entry_point = 0x1b5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 4918
	        start_va = 0x7a0000
	          end_va = 0x927fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000007a0000"
	        filename = ""

Region:
	              id = 4919
	        start_va = 0x74ea0000
	          end_va = 0x74ecafff
	       monitored = 0
	     entry_point = 0x74ea5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 4920
	        start_va = 0x930000
	          end_va = 0xab0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000930000"
	        filename = ""

Region:
	              id = 4921
	        start_va = 0x53d0000
	          end_va = 0x67cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000053d0000"
	        filename = ""

Region:
	              id = 4922
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 4923
	        start_va = 0x150000
	          end_va = 0x150fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000150000"
	        filename = ""

Region:
	              id = 4924
	        start_va = 0x1b0000
	          end_va = 0x1b4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taskkill.exe.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui")

Region:
	              id = 4925
	        start_va = 0x1c0000
	          end_va = 0x1c0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 4926
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001d0000"
	        filename = ""

Region:
	              id = 4927
	        start_va = 0xac0000
	          end_va = 0xdf6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 4928
	        start_va = 0x690000
	          end_va = 0x779fff
	       monitored = 0
	     entry_point = 0x6cd650
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 4929
	        start_va = 0x790000
	          end_va = 0x79ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000790000"
	        filename = ""

Region:
	              id = 4930
	        start_va = 0x1e0000
	          end_va = 0x1e3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001e0000"
	        filename = ""

Region:
	              id = 4931
	        start_va = 0x690000
	          end_va = 0x76ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 4932
	        start_va = 0x76e20000
	          end_va = 0x76e2bfff
	       monitored = 0
	     entry_point = 0x76e23930
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")

Region:
	              id = 4933
	        start_va = 0x1f0000
	          end_va = 0x1f0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001f0000"
	        filename = ""

Region:
	              id = 4934
	        start_va = 0x76c80000
	          end_va = 0x76d03fff
	       monitored = 0
	     entry_point = 0x76ca6220
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 4935
	        start_va = 0x4c0000
	          end_va = 0x4c0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004c0000"
	        filename = ""

Region:
	              id = 4936
	        start_va = 0x6cab0000
	          end_va = 0x6cabcfff
	       monitored = 0
	     entry_point = 0x6cab3520
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 4937
	        start_va = 0x6ca40000
	          end_va = 0x6caa6fff
	       monitored = 0
	     entry_point = 0x6ca5b610
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 4938
	        start_va = 0x740f0000
	          end_va = 0x7410afff
	       monitored = 0
	     entry_point = 0x740f9050
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 4939
	        start_va = 0x6c9f0000
	          end_va = 0x6ca33fff
	       monitored = 0
	     entry_point = 0x6ca0aaf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")

Region:
	              id = 4940
	        start_va = 0x4d0000
	          end_va = 0x50ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004d0000"
	        filename = ""

Region:
	              id = 4941
	        start_va = 0x510000
	          end_va = 0x54ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000510000"
	        filename = ""

Region:
	              id = 4942
	        start_va = 0x550000
	          end_va = 0x58ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000550000"
	        filename = ""

Region:
	              id = 4943
	        start_va = 0xe00000
	          end_va = 0xe3ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e00000"
	        filename = ""

Region:
	              id = 4944
	        start_va = 0xe40000
	          end_va = 0xe7ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e40000"
	        filename = ""

Region:
	              id = 4945
	        start_va = 0xe80000
	          end_va = 0xebffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e80000"
	        filename = ""

Region:
	              id = 4946
	        start_va = 0x6c9d0000
	          end_va = 0x6c9e0fff
	       monitored = 0
	     entry_point = 0x6c9d8fa0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 4947
	        start_va = 0x6c910000
	          end_va = 0x6c9cefff
	       monitored = 0
	     entry_point = 0x6c941e80
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 4949
	        start_va = 0x770000
	          end_va = 0x775fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000770000"
	        filename = ""


Thread:
	id = 345
	os_tid = 0x1178


Thread:
	id = 346
	os_tid = 0x115c


Thread:
	id = 347
	os_tid = 0x1174


Thread:
	id = 348
	os_tid = 0x1158


Thread:
	id = 349
	os_tid = 0x768


Process:
	id = "69"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x2fd39000"
	os_pid = "0xc60"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x614"
	cmd_line = "cmd.exe /c \"taskkill /f /im sqlservr.exe \""
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 4952
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 4953
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 4954
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 4955
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 4956
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 4957
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 4958
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 4959
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 4960
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 4961
	        start_va = 0x13a0000
	          end_va = 0x13f1fff
	       monitored = 1
	     entry_point = 0x13b4fd0
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")

Region:
	              id = 4962
	        start_va = 0x1400000
	          end_va = 0x53fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001400000"
	        filename = ""

Region:
	              id = 4963
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 4964
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 4965
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 4966
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 4967
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 4968
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 4969
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 4970
	        start_va = 0x560000
	          end_va = 0x56ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000560000"
	        filename = ""

Region:
	              id = 4971
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 4972
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 4973
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 4974
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 4975
	        start_va = 0x570000
	          end_va = 0x7cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000570000"
	        filename = ""

Region:
	              id = 4976
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 4977
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 4978
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 4979
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 4980
	        start_va = 0x400000
	          end_va = 0x4bdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 4981
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 4982
	        start_va = 0x4c0000
	          end_va = 0x4fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004c0000"
	        filename = ""

Region:
	              id = 4983
	        start_va = 0x570000
	          end_va = 0x66ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000570000"
	        filename = ""

Region:
	              id = 4984
	        start_va = 0x6d0000
	          end_va = 0x7cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006d0000"
	        filename = ""

Region:
	              id = 4985
	        start_va = 0x7d0000
	          end_va = 0x8fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000007d0000"
	        filename = ""

Region:
	              id = 4986
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 4987
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 4988
	        start_va = 0x900000
	          end_va = 0xc36fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 350
	os_tid = 0x88c

	[0183.680] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000
	[0183.681] __set_app_type (_Type=0x1) 
	[0183.681] __p__fmode () returned 0x74974d6c
	[0183.681] __p__commode () returned 0x74975b1c
	[0183.681] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13b5200) returned 0x0
	[0183.681] __getmainargs (in: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0, _DoWildCard=0, _StartInfo=0x13c60fc | out: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0) returned 0
	[0183.681] GetCurrentThreadId () returned 0x88c
	[0183.681] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x88c) returned 0x78
	[0183.681] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0183.682] GetProcAddress (hModule=0x75600000, lpProcName="SetThreadUILanguage") returned 0x75642510
	[0183.682] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0183.688] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0183.689] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2
	[0183.689] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0183.689] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0183.689] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0183.689] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0183.689] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0183.689] GetConsoleOutputCP () returned 0x1b5
	[0183.690] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0183.690] SetConsoleCtrlHandler (HandlerRoutine=0x13c0e40, Add=1) returned 1
	[0183.691] _get_osfhandle (_FileHandle=1) returned 0x130
	[0183.691] SetConsoleMode (hConsoleHandle=0x130, dwMode=0x0) returned 0
	[0183.691] _get_osfhandle (_FileHandle=1) returned 0x130
	[0183.691] GetConsoleMode (in: hConsoleHandle=0x130, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0183.691] _get_osfhandle (_FileHandle=0) returned 0x154
	[0183.691] GetConsoleMode (in: hConsoleHandle=0x154, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0183.691] GetEnvironmentStringsW () returned 0x6d7d08*
	[0183.691] GetProcessHeap () returned 0x6d0000
	[0183.691] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0xa1a) returned 0x6d8730
	[0183.691] FreeEnvironmentStringsA (penv="A") returned 1
	[0183.691] GetProcessHeap () returned 0x6d0000
	[0183.691] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x4) returned 0x6d0578
	[0183.691] GetEnvironmentStringsW () returned 0x6d7d08*
	[0183.691] GetProcessHeap () returned 0x6d0000
	[0183.691] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0xa1a) returned 0x6d9158
	[0183.691] FreeEnvironmentStringsA (penv="A") returned 1
	[0183.691] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0183.694] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0183.694] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0183.694] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0183.694] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0183.694] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0183.694] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0183.694] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0183.694] RegCloseKey (hKey=0x88) returned 0x0
	[0183.694] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0183.694] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0183.694] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0183.694] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0183.694] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0183.694] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0183.695] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0183.695] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0183.695] RegCloseKey (hKey=0x88) returned 0x0
	[0183.695] time (in: timer=0x0 | out: timer=0x0) returned 0x62344241
	[0183.695] srand (_Seed=0x62344241) 
	[0183.695] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im sqlservr.exe \""
	[0183.695] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im sqlservr.exe \""
	[0183.695] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0183.695] GetProcessHeap () returned 0x6d0000
	[0183.695] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x210) returned 0x6d9b80
	[0183.695] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6d9b88, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0183.695] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0183.695] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0183.695] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0183.695] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0183.696] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0183.696] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0183.696] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0183.696] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0183.696] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0183.696] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0183.696] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0183.696] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0183.696] GetProcessHeap () returned 0x6d0000
	[0183.697] RtlFreeHeap (HeapHandle=0x6d0000, Flags=0x0, BaseAddress=0x6d8730) returned 1
	[0183.697] GetEnvironmentStringsW () returned 0x6d7d08*
	[0183.697] GetProcessHeap () returned 0x6d0000
	[0183.697] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0xa32) returned 0x6da7d8
	[0183.697] FreeEnvironmentStringsA (penv="A") returned 1
	[0183.697] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b
	[0183.697] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0183.697] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0183.697] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0183.697] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0183.697] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0183.697] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0183.697] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0183.697] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0183.697] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0183.698] GetProcessHeap () returned 0x6d0000
	[0183.698] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x44) returned 0x6d04e8
	[0183.698] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0183.698] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19fc4c*="Desktop") returned 0x1d
	[0183.698] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0183.698] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x6d05c8
	[0183.699] FindClose (in: hFindFile=0x6d05c8 | out: hFindFile=0x6d05c8) returned 1
	[0183.699] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x6d05c8
	[0183.699] FindClose (in: hFindFile=0x6d05c8 | out: hFindFile=0x6d05c8) returned 1
	[0183.699] _wcsnicmp (_String1="RDHJ0C~1", _String2="RDhJ0CNFevzX", _MaxCount=0xc) returned 16
	[0183.699] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x6d05c8
	[0183.699] FindClose (in: hFindFile=0x6d05c8 | out: hFindFile=0x6d05c8) returned 1
	[0183.699] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0183.699] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1
	[0183.699] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 1
	[0183.700] GetProcessHeap () returned 0x6d0000
	[0183.700] RtlFreeHeap (HeapHandle=0x6d0000, Flags=0x0, BaseAddress=0x6da7d8) returned 1
	[0183.700] GetEnvironmentStringsW () returned 0x6d7d08*
	[0183.700] GetProcessHeap () returned 0x6d0000
	[0183.700] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0xa76) returned 0x6d9d98
	[0183.700] FreeEnvironmentStringsA (penv="=") returned 1
	[0183.700] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0183.700] GetProcessHeap () returned 0x6d0000
	[0183.700] RtlFreeHeap (HeapHandle=0x6d0000, Flags=0x0, BaseAddress=0x6d04e8) returned 1
	[0183.700] GetProcessHeap () returned 0x6d0000
	[0183.701] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x400e) returned 0x6dbc98
	[0183.701] GetProcessHeap () returned 0x6d0000
	[0183.701] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x4c) returned 0x6d04e8
	[0183.701] GetProcessHeap () returned 0x6d0000
	[0183.701] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x4008) returned 0x6dfcb0
	[0183.702] GetProcessHeap () returned 0x6d0000
	[0183.702] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x4008) returned 0x6e3cc0
	[0183.703] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0183.703] GetProcessHeap () returned 0x6d0000
	[0183.703] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x418) returned 0x6da818
	[0183.703] SetErrorMode (uMode=0x0) returned 0x8003
	[0183.703] SetErrorMode (uMode=0x1) returned 0x0
	[0183.703] GetFullPathNameW (in: lpFileName="taskkill \\f \\.", nBufferLength=0x208, lpBuffer=0x6da820, lpFilePart=0x19fbac | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f", lpFilePart=0x19fbac*="f") returned 0x29
	[0183.704] SetErrorMode (uMode=0x8003) returned 0x1
	[0183.704] GetProcessHeap () returned 0x6d0000
	[0183.704] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x6da818, Size=0x7e) returned 0x6da818
	[0183.704] GetProcessHeap () returned 0x6d0000
	[0183.704] RtlSizeHeap (HeapHandle=0x6d0000, Flags=0x0, MemoryPointer=0x6da818) returned 0x7e
	[0183.704] NeedCurrentDirectoryForExePathW (ExeName="taskkill \\f \\.") returned 1
	[0183.704] GetProcessHeap () returned 0x6d0000
	[0183.704] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x62) returned 0x6da8a0
	[0183.704] GetProcessHeap () returned 0x6d0000
	[0183.704] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0xb8) returned 0x6da910
	[0183.704] GetProcessHeap () returned 0x6d0000
	[0183.704] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x6da910, Size=0x62) returned 0x6da910
	[0183.704] GetProcessHeap () returned 0x6d0000
	[0183.705] RtlSizeHeap (HeapHandle=0x6d0000, Flags=0x0, MemoryPointer=0x6da910) returned 0x62
	[0183.705] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0183.705] GetProcessHeap () returned 0x6d0000
	[0183.705] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0xe0) returned 0x6da980
	[0183.709] GetProcessHeap () returned 0x6d0000
	[0183.709] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x6da980, Size=0x76) returned 0x6da980
	[0183.709] GetProcessHeap () returned 0x6d0000
	[0183.709] RtlSizeHeap (HeapHandle=0x6d0000, Flags=0x0, MemoryPointer=0x6da980) returned 0x76
	[0183.709] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0183.709] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f\\im sqlservr.exe ", fInfoLevelId=0x1, lpFindFileData=0x19f958, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f958) returned 0xffffffff
	[0183.710] GetLastError () returned 0x3
	[0183.710] GetProcessHeap () returned 0x6d0000
	[0183.710] RtlFreeHeap (HeapHandle=0x6d0000, Flags=0x0, BaseAddress=0x6dfcb0) returned 1
	[0183.710] GetProcessHeap () returned 0x6d0000
	[0183.711] RtlFreeHeap (HeapHandle=0x6d0000, Flags=0x0, BaseAddress=0x6e3cc0) returned 1
	[0183.711] GetProcessHeap () returned 0x6d0000
	[0183.711] RtlFreeHeap (HeapHandle=0x6d0000, Flags=0x0, BaseAddress=0x6dbc98) returned 1
	[0183.711] GetConsoleOutputCP () returned 0x1b5
	[0183.714] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0183.714] GetUserDefaultLCID () returned 0x409
	[0183.715] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x13d34a0, cchData=8 | out: lpLCData=":") returned 2
	[0183.715] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0183.715] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0183.715] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2
	[0183.715] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x13d34b0, cchData=8 | out: lpLCData="/") returned 2
	[0183.715] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x13d3500, cchData=32 | out: lpLCData="Mon") returned 4
	[0183.715] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x13d3540, cchData=32 | out: lpLCData="Tue") returned 4
	[0183.715] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x13d3580, cchData=32 | out: lpLCData="Wed") returned 4
	[0183.715] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x13d35c0, cchData=32 | out: lpLCData="Thu") returned 4
	[0183.715] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x13d3600, cchData=32 | out: lpLCData="Fri") returned 4
	[0183.715] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x13d3640, cchData=32 | out: lpLCData="Sat") returned 4
	[0183.715] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x13d3680, cchData=32 | out: lpLCData="Sun") returned 4
	[0183.715] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x13d34c0, cchData=8 | out: lpLCData=".") returned 2
	[0183.715] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x13d34e0, cchData=8 | out: lpLCData=",") returned 2
	[0183.715] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0183.717] GetProcessHeap () returned 0x6d0000
	[0183.717] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x20c) returned 0x6daa48
	[0183.717] GetConsoleTitleW (in: lpConsoleTitle=0x6daa48, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0183.719] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0183.719] GetProcAddress (hModule=0x75600000, lpProcName="CopyFileExW") returned 0x7561ffc0
	[0183.719] GetProcAddress (hModule=0x75600000, lpProcName="IsDebuggerPresent") returned 0x7561b0b0
	[0183.719] GetProcAddress (hModule=0x75600000, lpProcName="SetConsoleInputExeNameW") returned 0x7559b440
	[0183.720] GetProcessHeap () returned 0x6d0000
	[0183.720] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x400a) returned 0x6dbc98
	[0183.720] GetProcessHeap () returned 0x6d0000
	[0183.720] RtlFreeHeap (HeapHandle=0x6d0000, Flags=0x0, BaseAddress=0x6dbc98) returned 1
	[0183.721] _wcsicmp (_String1="taskkill", _String2=")") returned 75
	[0183.721] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14
	[0183.721] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14
	[0183.721] _wcsicmp (_String1="IF", _String2="taskkill") returned -11
	[0183.721] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11
	[0183.721] _wcsicmp (_String1="REM", _String2="taskkill") returned -2
	[0183.722] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2
	[0183.722] GetProcessHeap () returned 0x6d0000
	[0183.722] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x58) returned 0x6dac60
	[0183.722] GetProcessHeap () returned 0x6d0000
	[0183.722] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x1a) returned 0x6dacc0
	[0183.722] GetProcessHeap () returned 0x6d0000
	[0183.722] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x34) returned 0x6dace8
	[0183.723] GetConsoleTitleW (in: lpConsoleTitle=0x19fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0183.725] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0183.725] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0183.725] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0183.725] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0183.725] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0183.725] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0183.725] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0183.725] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0183.726] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0183.726] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0183.726] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0183.726] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0183.726] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0183.726] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0183.726] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0183.726] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0183.726] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0183.726] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0183.726] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0183.726] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0183.726] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0183.726] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0183.726] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0183.726] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0183.726] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0183.726] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0183.726] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0183.726] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0183.726] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0183.726] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0183.726] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0183.726] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0183.726] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0183.726] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0183.727] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0183.727] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0183.727] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0183.727] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0183.727] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0183.727] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0183.727] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0183.727] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0183.727] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0183.727] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0183.727] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0183.727] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0183.727] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0183.727] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0183.727] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0183.727] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0183.727] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0183.727] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0183.727] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0183.727] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0183.727] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0183.727] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0183.727] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0183.727] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0183.727] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0183.727] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0183.727] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0183.727] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0183.727] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0183.727] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0183.728] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0183.728] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0183.728] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0183.728] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0183.728] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0183.728] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0183.728] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0183.728] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0183.728] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0183.728] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0183.728] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0183.728] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0183.728] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0183.728] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0183.728] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0183.728] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0183.728] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0183.728] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0183.728] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0183.728] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0183.728] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14
	[0183.728] _wcsicmp (_String1="taskkill", _String2="IF") returned 11
	[0183.728] _wcsicmp (_String1="taskkill", _String2="REM") returned 2
	[0183.729] GetProcessHeap () returned 0x6d0000
	[0183.729] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x210) returned 0x6dad28
	[0183.729] GetProcessHeap () returned 0x6d0000
	[0183.729] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x46) returned 0x6daf40
	[0183.729] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0183.729] GetProcessHeap () returned 0x6d0000
	[0183.729] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x418) returned 0x6d05c8
	[0183.729] SetErrorMode (uMode=0x0) returned 0x8003
	[0183.730] SetErrorMode (uMode=0x1) returned 0x0
	[0183.730] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x6d05d0, lpFilePart=0x19f57c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19f57c*="Desktop") returned 0x1d
	[0183.730] SetErrorMode (uMode=0x8003) returned 0x1
	[0183.730] GetProcessHeap () returned 0x6d0000
	[0183.730] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x6d05c8, Size=0x56) returned 0x6d05c8
	[0183.730] GetProcessHeap () returned 0x6d0000
	[0183.730] RtlSizeHeap (HeapHandle=0x6d0000, Flags=0x0, MemoryPointer=0x6d05c8) returned 0x56
	[0183.730] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0183.730] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0183.730] GetProcessHeap () returned 0x6d0000
	[0183.730] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x110) returned 0x6daf90
	[0183.730] GetProcessHeap () returned 0x6d0000
	[0183.730] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x218) returned 0x6d0628
	[0183.735] GetProcessHeap () returned 0x6d0000
	[0183.735] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x6d0628, Size=0x112) returned 0x6d0628
	[0183.735] GetProcessHeap () returned 0x6d0000
	[0183.735] RtlSizeHeap (HeapHandle=0x6d0000, Flags=0x0, MemoryPointer=0x6d0628) returned 0x112
	[0183.735] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0183.735] GetProcessHeap () returned 0x6d0000
	[0183.735] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0xe0) returned 0x6db0a8
	[0183.737] GetProcessHeap () returned 0x6d0000
	[0183.737] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x6db0a8, Size=0x76) returned 0x6db0a8
	[0183.737] GetProcessHeap () returned 0x6d0000
	[0183.737] RtlSizeHeap (HeapHandle=0x6d0000, Flags=0x0, MemoryPointer=0x6db0a8) returned 0x76
	[0183.737] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0183.737] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0183.737] GetLastError () returned 0x2
	[0183.737] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0183.737] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x6db128
	[0183.738] GetProcessHeap () returned 0x6d0000
	[0183.738] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x0, Size=0x14) returned 0x6d7628
	[0183.738] FindClose (in: hFindFile=0x6db128 | out: hFindFile=0x6db128) returned 1
	[0183.738] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0183.738] GetLastError () returned 0x2
	[0183.738] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x6db128
	[0183.738] GetProcessHeap () returned 0x6d0000
	[0183.738] RtlReAllocateHeap (Heap=0x6d0000, Flags=0x0, Ptr=0x6d7628, Size=0x4) returned 0x6d0540
	[0183.738] FindClose (in: hFindFile=0x6db128 | out: hFindFile=0x6db128) returned 1
	[0183.738] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0183.738] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0183.738] GetConsoleTitleW (in: lpConsoleTitle=0x19f7fc, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0183.740] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f728, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f70c | out: lpAttributeList=0x19f728, lpSize=0x19f70c) returned 1
	[0183.740] UpdateProcThreadAttribute (in: lpAttributeList=0x19f728, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f714, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f728, lpPreviousValue=0x0) returned 1
	[0183.740] GetStartupInfoW (in: lpStartupInfo=0x19f760 | out: lpStartupInfo=0x19f760*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x154, hStdOutput=0x130, hStdError=0x13c)) 
	[0183.740] GetProcessHeap () returned 0x6d0000
	[0183.740] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0x18) returned 0x6d7748
	[0183.740] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0183.741] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0183.741] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0183.741] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0183.741] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0183.741] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0183.741] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0183.741] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0183.741] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0183.741] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0183.741] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0183.741] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0183.741] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0183.741] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0183.741] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0183.741] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0183.741] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0183.741] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0183.741] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0183.741] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0183.741] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0183.741] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0183.741] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0183.741] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0183.741] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0183.741] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0183.741] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0183.741] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0183.741] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0183.741] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0183.741] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0183.742] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0183.742] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0183.742] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0183.742] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0183.742] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0183.742] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0183.742] GetProcessHeap () returned 0x6d0000
	[0183.742] RtlFreeHeap (HeapHandle=0x6d0000, Flags=0x0, BaseAddress=0x6d7748) returned 1
	[0183.742] GetProcessHeap () returned 0x6d0000
	[0183.742] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0xa) returned 0x6db128
	[0183.742] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1
	[0183.745] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill  /f /im sqlservr.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x19f6b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill  /f /im sqlservr.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f6fc | out: lpCommandLine="taskkill  /f /im sqlservr.exe ", lpProcessInformation=0x19f6fc*(hProcess=0x9c, hThread=0x98, dwProcessId=0x1cc, dwThreadId=0xd58)) returned 1
	[0183.763] CloseHandle (hObject=0x98) returned 1
	[0183.763] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0183.763] GetProcessHeap () returned 0x6d0000
	[0183.764] RtlFreeHeap (HeapHandle=0x6d0000, Flags=0x0, BaseAddress=0x6d9d98) returned 1
	[0183.766] GetEnvironmentStringsW () returned 0x6d9d98*
	[0183.766] GetProcessHeap () returned 0x6d0000
	[0183.766] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0xa76) returned 0x6d7d08
	[0183.766] FreeEnvironmentStringsA (penv="=") returned 1
	[0183.766] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0
	[0184.710] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x19f694 | out: lpExitCode=0x19f694*=0x80) returned 1
	[0184.711] CloseHandle (hObject=0x9c) returned 1
	[0184.711] _vsnwprintf (in: _Buffer=0x19f77c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f69c | out: _Buffer="00000080") returned 8
	[0184.711] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1
	[0184.711] GetProcessHeap () returned 0x6d0000
	[0184.712] RtlFreeHeap (HeapHandle=0x6d0000, Flags=0x0, BaseAddress=0x6d7d08) returned 1
	[0184.712] GetEnvironmentStringsW () returned 0x6db158*
	[0184.712] GetProcessHeap () returned 0x6d0000
	[0184.712] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0xa9c) returned 0x6d7d08
	[0184.712] FreeEnvironmentStringsA (penv="=") returned 1
	[0184.712] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0184.712] GetProcessHeap () returned 0x6d0000
	[0184.713] RtlFreeHeap (HeapHandle=0x6d0000, Flags=0x0, BaseAddress=0x6d7d08) returned 1
	[0184.713] GetEnvironmentStringsW () returned 0x6db158*
	[0184.713] GetProcessHeap () returned 0x6d0000
	[0184.713] RtlAllocateHeap (HeapHandle=0x6d0000, Flags=0x8, Size=0xa9c) returned 0x6d7d08
	[0184.713] FreeEnvironmentStringsA (penv="=") returned 1
	[0184.713] GetProcessHeap () returned 0x6d0000
	[0184.713] RtlFreeHeap (HeapHandle=0x6d0000, Flags=0x0, BaseAddress=0x6db128) returned 1
	[0184.713] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f728 | out: lpAttributeList=0x19f728) 
	[0184.713] _get_osfhandle (_FileHandle=1) returned 0x130
	[0184.713] SetConsoleMode (hConsoleHandle=0x130, dwMode=0x0) returned 0
	[0184.713] _get_osfhandle (_FileHandle=1) returned 0x130
	[0184.713] GetConsoleMode (in: hConsoleHandle=0x130, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0184.713] _get_osfhandle (_FileHandle=0) returned 0x154
	[0184.713] GetConsoleMode (in: hConsoleHandle=0x154, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0184.713] GetConsoleOutputCP () returned 0x1b5
	[0184.717] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0184.717] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0184.719] exit (_Code=128) 

Thread:
	id = 351
	os_tid = 0x12d0


Process:
	id = "70"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\syswow64\\taskkill.exe"
	page_root = "0x2fd40000"
	os_pid = "0x1cc"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "69"
	os_parent_pid = "0xc60"
	cmd_line = "taskkill  /f /im sqlservr.exe "
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 4989
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 4990
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 4991
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 4992
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 4993
	        start_va = 0xa0000
	          end_va = 0xdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 4994
	        start_va = 0xe0000
	          end_va = 0xe3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 4995
	        start_va = 0xf0000
	          end_va = 0xf0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 4996
	        start_va = 0x100000
	          end_va = 0x101fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 4997
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 4998
	        start_va = 0x13b0000
	          end_va = 0x13c5fff
	       monitored = 0
	     entry_point = 0x13bde80
	     region_type = mapped_file
	            name = "taskkill.exe"
	        filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe")

Region:
	              id = 4999
	        start_va = 0x13d0000
	          end_va = 0x53cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000013d0000"
	        filename = ""

Region:
	              id = 5000
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 5001
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 5002
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 5003
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 5004
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 5005
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 5006
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 5007
	        start_va = 0x530000
	          end_va = 0x53ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000530000"
	        filename = ""

Region:
	              id = 5008
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 5009
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 5010
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 5011
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 5012
	        start_va = 0x540000
	          end_va = 0x6effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000540000"
	        filename = ""

Region:
	              id = 5013
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 5014
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 5015
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 5016
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 5017
	        start_va = 0x110000
	          end_va = 0x1cdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 5018
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 5019
	        start_va = 0x74650000
	          end_va = 0x746cafff
	       monitored = 0
	     entry_point = 0x7466e970
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 5020
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 5021
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 5022
	        start_va = 0x440000
	          end_va = 0x47ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000440000"
	        filename = ""

Region:
	              id = 5023
	        start_va = 0x76ae0000
	          end_va = 0x76b23fff
	       monitored = 0
	     entry_point = 0x76af9d80
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 5024
	        start_va = 0x75260000
	          end_va = 0x7530cfff
	       monitored = 0
	     entry_point = 0x75274f00
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 5025
	        start_va = 0x74450000
	          end_va = 0x7446dfff
	       monitored = 0
	     entry_point = 0x7445b640
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 5026
	        start_va = 0x74440000
	          end_va = 0x74449fff
	       monitored = 0
	     entry_point = 0x74442a00
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 5027
	        start_va = 0x74590000
	          end_va = 0x745e7fff
	       monitored = 0
	     entry_point = 0x745d25c0
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 5028
	        start_va = 0x77450000
	          end_va = 0x77596fff
	       monitored = 0
	     entry_point = 0x77461cf0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 5029
	        start_va = 0x76b30000
	          end_va = 0x76c7efff
	       monitored = 0
	     entry_point = 0x76be6820
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 5030
	        start_va = 0x753c0000
	          end_va = 0x75451fff
	       monitored = 0
	     entry_point = 0x753f8cf0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 5031
	        start_va = 0x77290000
	          end_va = 0x7744cfff
	       monitored = 0
	     entry_point = 0x77372a10
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")

Region:
	              id = 5032
	        start_va = 0x6cc90000
	          end_va = 0x6cc97fff
	       monitored = 0
	     entry_point = 0x6cc917b0
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 5033
	        start_va = 0x6cc70000
	          end_va = 0x6cc85fff
	       monitored = 0
	     entry_point = 0x6cc721d0
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")

Region:
	              id = 5034
	        start_va = 0x75310000
	          end_va = 0x7536efff
	       monitored = 0
	     entry_point = 0x75314af0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 5035
	        start_va = 0x77240000
	          end_va = 0x77284fff
	       monitored = 0
	     entry_point = 0x7725de90
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 5036
	        start_va = 0x6cc30000
	          end_va = 0x6cc6efff
	       monitored = 0
	     entry_point = 0x6cc446c0
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll")

Region:
	              id = 5037
	        start_va = 0x6caf0000
	          end_va = 0x6cc2efff
	       monitored = 0
	     entry_point = 0x6cb1d880
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll")

Region:
	              id = 5038
	        start_va = 0x6cad0000
	          end_va = 0x6caebfff
	       monitored = 0
	     entry_point = 0x6cad4720
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")

Region:
	              id = 5039
	        start_va = 0x6cac0000
	          end_va = 0x6cac9fff
	       monitored = 0
	     entry_point = 0x6cac28d0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")

Region:
	              id = 5040
	        start_va = 0x6f0000
	          end_va = 0x7cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006f0000"
	        filename = ""

Region:
	              id = 5041
	        start_va = 0x1d0000
	          end_va = 0x1f9fff
	       monitored = 0
	     entry_point = 0x1d5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 5042
	        start_va = 0x7d0000
	          end_va = 0x957fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000007d0000"
	        filename = ""

Region:
	              id = 5043
	        start_va = 0x74ea0000
	          end_va = 0x74ecafff
	       monitored = 0
	     entry_point = 0x74ea5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 5044
	        start_va = 0x960000
	          end_va = 0xae0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000960000"
	        filename = ""

Region:
	              id = 5045
	        start_va = 0x53d0000
	          end_va = 0x67cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000053d0000"
	        filename = ""

Region:
	              id = 5046
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 5047
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001d0000"
	        filename = ""

Region:
	              id = 5048
	        start_va = 0x1e0000
	          end_va = 0x1e4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taskkill.exe.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui")

Region:
	              id = 5049
	        start_va = 0x1f0000
	          end_va = 0x1f0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001f0000"
	        filename = ""

Region:
	              id = 5050
	        start_va = 0x480000
	          end_va = 0x480fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 5051
	        start_va = 0xaf0000
	          end_va = 0xe26fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 5052
	        start_va = 0xe30000
	          end_va = 0xf19fff
	       monitored = 0
	     entry_point = 0xe6d650
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 5053
	        start_va = 0x490000
	          end_va = 0x493fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000490000"
	        filename = ""

Region:
	              id = 5054
	        start_va = 0xe30000
	          end_va = 0xf0ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 5055
	        start_va = 0x76e20000
	          end_va = 0x76e2bfff
	       monitored = 0
	     entry_point = 0x76e23930
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")

Region:
	              id = 5056
	        start_va = 0x4a0000
	          end_va = 0x4a0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004a0000"
	        filename = ""

Region:
	              id = 5057
	        start_va = 0x76c80000
	          end_va = 0x76d03fff
	       monitored = 0
	     entry_point = 0x76ca6220
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 5058
	        start_va = 0x4b0000
	          end_va = 0x4b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004b0000"
	        filename = ""

Region:
	              id = 5059
	        start_va = 0x6cab0000
	          end_va = 0x6cabcfff
	       monitored = 0
	     entry_point = 0x6cab3520
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 5060
	        start_va = 0x6ca40000
	          end_va = 0x6caa6fff
	       monitored = 0
	     entry_point = 0x6ca5b610
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 5061
	        start_va = 0x740f0000
	          end_va = 0x7410afff
	       monitored = 0
	     entry_point = 0x740f9050
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 5062
	        start_va = 0x6c9f0000
	          end_va = 0x6ca33fff
	       monitored = 0
	     entry_point = 0x6ca0aaf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")

Region:
	              id = 5063
	        start_va = 0x4c0000
	          end_va = 0x4fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004c0000"
	        filename = ""

Region:
	              id = 5064
	        start_va = 0x540000
	          end_va = 0x57ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000540000"
	        filename = ""

Region:
	              id = 5065
	        start_va = 0x5f0000
	          end_va = 0x6effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005f0000"
	        filename = ""

Region:
	              id = 5066
	        start_va = 0x580000
	          end_va = 0x5bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000580000"
	        filename = ""

Region:
	              id = 5067
	        start_va = 0x6f0000
	          end_va = 0x72ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006f0000"
	        filename = ""

Region:
	              id = 5068
	        start_va = 0x730000
	          end_va = 0x76ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000730000"
	        filename = ""

Region:
	              id = 5069
	        start_va = 0x770000
	          end_va = 0x7affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000770000"
	        filename = ""

Region:
	              id = 5070
	        start_va = 0x7c0000
	          end_va = 0x7cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000007c0000"
	        filename = ""

Region:
	              id = 5071
	        start_va = 0x6c9d0000
	          end_va = 0x6c9e0fff
	       monitored = 0
	     entry_point = 0x6c9d8fa0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 5072
	        start_va = 0x6c910000
	          end_va = 0x6c9cefff
	       monitored = 0
	     entry_point = 0x6c941e80
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 5074
	        start_va = 0x500000
	          end_va = 0x505fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000500000"
	        filename = ""


Thread:
	id = 352
	os_tid = 0xd58


Thread:
	id = 353
	os_tid = 0x1384


Thread:
	id = 354
	os_tid = 0x11d8


Thread:
	id = 355
	os_tid = 0xf68


Thread:
	id = 356
	os_tid = 0x11d4


Process:
	id = "71"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x2fb44000"
	os_pid = "0x560"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x614"
	cmd_line = "cmd.exe /c \"taskkill /f /im thebat.exe \""
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 5077
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 5078
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 5079
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 5080
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 5081
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 5082
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 5083
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 5084
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 5085
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 5086
	        start_va = 0x13a0000
	          end_va = 0x13f1fff
	       monitored = 1
	     entry_point = 0x13b4fd0
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")

Region:
	              id = 5087
	        start_va = 0x1400000
	          end_va = 0x53fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001400000"
	        filename = ""

Region:
	              id = 5088
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 5089
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 5090
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 5091
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 5092
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 5093
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 5094
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 5095
	        start_va = 0x5b0000
	          end_va = 0x5bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005b0000"
	        filename = ""

Region:
	              id = 5096
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 5097
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 5098
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 5099
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 5100
	        start_va = 0x5c0000
	          end_va = 0x7affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005c0000"
	        filename = ""

Region:
	              id = 5101
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 5102
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 5103
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 5104
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 5105
	        start_va = 0x400000
	          end_va = 0x4bdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 5106
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 5107
	        start_va = 0x4c0000
	          end_va = 0x4fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004c0000"
	        filename = ""

Region:
	              id = 5108
	        start_va = 0x7b0000
	          end_va = 0x8affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000007b0000"
	        filename = ""

Region:
	              id = 5109
	        start_va = 0x500000
	          end_va = 0x53ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000500000"
	        filename = ""

Region:
	              id = 5110
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 5111
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 5112
	        start_va = 0x8b0000
	          end_va = 0xbe6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 357
	os_tid = 0x2e8

	[0184.996] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000
	[0184.996] __set_app_type (_Type=0x1) 
	[0184.996] __p__fmode () returned 0x74974d6c
	[0184.996] __p__commode () returned 0x74975b1c
	[0184.997] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13b5200) returned 0x0
	[0184.998] __getmainargs (in: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0, _DoWildCard=0, _StartInfo=0x13c60fc | out: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0) returned 0
	[0184.998] GetCurrentThreadId () returned 0x2e8
	[0184.998] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x2e8) returned 0x78
	[0184.998] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0184.998] GetProcAddress (hModule=0x75600000, lpProcName="SetThreadUILanguage") returned 0x75642510
	[0184.998] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0185.011] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0185.011] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2
	[0185.012] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0185.012] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0185.012] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0185.012] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0185.012] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0185.012] GetConsoleOutputCP () returned 0x1b5
	[0185.015] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0185.016] SetConsoleCtrlHandler (HandlerRoutine=0x13c0e40, Add=1) returned 1
	[0185.016] _get_osfhandle (_FileHandle=1) returned 0x154
	[0185.016] SetConsoleMode (hConsoleHandle=0x154, dwMode=0x0) returned 0
	[0185.016] _get_osfhandle (_FileHandle=1) returned 0x154
	[0185.016] GetConsoleMode (in: hConsoleHandle=0x154, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0185.016] _get_osfhandle (_FileHandle=0) returned 0x150
	[0185.016] GetConsoleMode (in: hConsoleHandle=0x150, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0185.016] GetEnvironmentStringsW () returned 0x6b7cc0*
	[0185.016] GetProcessHeap () returned 0x6b0000
	[0185.016] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xa1a) returned 0x6b86e8
	[0185.017] FreeEnvironmentStringsA (penv="A") returned 1
	[0185.017] GetProcessHeap () returned 0x6b0000
	[0185.017] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x4) returned 0x6b0550
	[0185.017] GetEnvironmentStringsW () returned 0x6b7cc0*
	[0185.017] GetProcessHeap () returned 0x6b0000
	[0185.017] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xa1a) returned 0x6b9110
	[0185.017] FreeEnvironmentStringsA (penv="A") returned 1
	[0185.017] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0185.017] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0185.017] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0185.017] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0185.017] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0185.017] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0185.017] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0185.017] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0185.018] RegCloseKey (hKey=0x88) returned 0x0
	[0185.018] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0185.018] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0185.018] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0185.018] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0185.018] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0185.018] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0185.018] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0185.018] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0185.018] RegCloseKey (hKey=0x88) returned 0x0
	[0185.018] time (in: timer=0x0 | out: timer=0x0) returned 0x62344243
	[0185.018] srand (_Seed=0x62344243) 
	[0185.018] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im thebat.exe \""
	[0185.018] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im thebat.exe \""
	[0185.018] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0185.018] GetProcessHeap () returned 0x6b0000
	[0185.018] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x210) returned 0x6b9b38
	[0185.019] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6b9b40, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0185.019] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0185.019] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0185.019] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0185.019] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0185.019] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0185.019] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0185.019] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0185.019] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0185.019] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0185.019] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0185.019] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0185.019] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0185.019] GetProcessHeap () returned 0x6b0000
	[0185.020] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6b86e8) returned 1
	[0185.020] GetEnvironmentStringsW () returned 0x6b7cc0*
	[0185.020] GetProcessHeap () returned 0x6b0000
	[0185.020] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xa32) returned 0x6ba790
	[0185.020] FreeEnvironmentStringsA (penv="A") returned 1
	[0185.020] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b
	[0185.020] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0185.020] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0185.020] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0185.020] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0185.020] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0185.020] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0185.020] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0185.021] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0185.021] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0185.021] GetProcessHeap () returned 0x6b0000
	[0185.021] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x44) returned 0x6b05c8
	[0185.021] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0185.021] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19fc4c*="Desktop") returned 0x1d
	[0185.021] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0185.021] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x6b0618
	[0185.021] FindClose (in: hFindFile=0x6b0618 | out: hFindFile=0x6b0618) returned 1
	[0185.021] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x6b0618
	[0185.021] FindClose (in: hFindFile=0x6b0618 | out: hFindFile=0x6b0618) returned 1
	[0185.022] _wcsnicmp (_String1="RDHJ0C~1", _String2="RDhJ0CNFevzX", _MaxCount=0xc) returned 16
	[0185.022] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x6b0618
	[0185.022] FindClose (in: hFindFile=0x6b0618 | out: hFindFile=0x6b0618) returned 1
	[0185.022] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0185.022] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1
	[0185.022] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 1
	[0185.022] GetProcessHeap () returned 0x6b0000
	[0185.023] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6ba790) returned 1
	[0185.023] GetEnvironmentStringsW () returned 0x6b7cc0*
	[0185.023] GetProcessHeap () returned 0x6b0000
	[0185.023] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xa76) returned 0x6b9d50
	[0185.023] FreeEnvironmentStringsA (penv="=") returned 1
	[0185.023] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0185.023] GetProcessHeap () returned 0x6b0000
	[0185.023] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6b05c8) returned 1
	[0185.023] GetProcessHeap () returned 0x6b0000
	[0185.023] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x400e) returned 0x6bbc50
	[0185.024] GetProcessHeap () returned 0x6b0000
	[0185.024] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x48) returned 0x6ba7d0
	[0185.024] GetProcessHeap () returned 0x6b0000
	[0185.024] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x4008) returned 0x6bfc68
	[0185.024] GetProcessHeap () returned 0x6b0000
	[0185.024] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x4008) returned 0x6c3c78
	[0185.025] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0185.026] GetProcessHeap () returned 0x6b0000
	[0185.026] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x418) returned 0x6ba820
	[0185.026] SetErrorMode (uMode=0x0) returned 0x8003
	[0185.026] SetErrorMode (uMode=0x1) returned 0x0
	[0185.026] GetFullPathNameW (in: lpFileName="taskkill \\f \\.", nBufferLength=0x208, lpBuffer=0x6ba828, lpFilePart=0x19fbac | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f", lpFilePart=0x19fbac*="f") returned 0x29
	[0185.026] SetErrorMode (uMode=0x8003) returned 0x1
	[0185.026] GetProcessHeap () returned 0x6b0000
	[0185.026] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6ba820, Size=0x7a) returned 0x6ba820
	[0185.026] GetProcessHeap () returned 0x6b0000
	[0185.027] RtlSizeHeap (HeapHandle=0x6b0000, Flags=0x0, MemoryPointer=0x6ba820) returned 0x7a
	[0185.027] NeedCurrentDirectoryForExePathW (ExeName="taskkill \\f \\.") returned 1
	[0185.027] GetProcessHeap () returned 0x6b0000
	[0185.027] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x62) returned 0x6ba8a8
	[0185.027] GetProcessHeap () returned 0x6b0000
	[0185.027] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xb8) returned 0x6ba918
	[0185.027] GetProcessHeap () returned 0x6b0000
	[0185.027] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6ba918, Size=0x62) returned 0x6ba918
	[0185.027] GetProcessHeap () returned 0x6b0000
	[0185.027] RtlSizeHeap (HeapHandle=0x6b0000, Flags=0x0, MemoryPointer=0x6ba918) returned 0x62
	[0185.027] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0185.027] GetProcessHeap () returned 0x6b0000
	[0185.027] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xe0) returned 0x6ba988
	[0185.031] GetProcessHeap () returned 0x6b0000
	[0185.031] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6ba988, Size=0x76) returned 0x6ba988
	[0185.031] GetProcessHeap () returned 0x6b0000
	[0185.031] RtlSizeHeap (HeapHandle=0x6b0000, Flags=0x0, MemoryPointer=0x6ba988) returned 0x76
	[0185.031] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0185.031] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f\\im thebat.exe ", fInfoLevelId=0x1, lpFindFileData=0x19f958, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f958) returned 0xffffffff
	[0185.032] GetLastError () returned 0x3
	[0185.032] GetProcessHeap () returned 0x6b0000
	[0185.032] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6bfc68) returned 1
	[0185.032] GetProcessHeap () returned 0x6b0000
	[0185.033] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c3c78) returned 1
	[0185.033] GetProcessHeap () returned 0x6b0000
	[0185.033] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6bbc50) returned 1
	[0185.046] GetConsoleOutputCP () returned 0x1b5
	[0185.047] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0185.047] GetUserDefaultLCID () returned 0x409
	[0185.047] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x13d34a0, cchData=8 | out: lpLCData=":") returned 2
	[0185.047] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0185.047] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0185.047] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2
	[0185.047] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x13d34b0, cchData=8 | out: lpLCData="/") returned 2
	[0185.047] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x13d3500, cchData=32 | out: lpLCData="Mon") returned 4
	[0185.047] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x13d3540, cchData=32 | out: lpLCData="Tue") returned 4
	[0185.048] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x13d3580, cchData=32 | out: lpLCData="Wed") returned 4
	[0185.048] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x13d35c0, cchData=32 | out: lpLCData="Thu") returned 4
	[0185.048] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x13d3600, cchData=32 | out: lpLCData="Fri") returned 4
	[0185.048] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x13d3640, cchData=32 | out: lpLCData="Sat") returned 4
	[0185.048] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x13d3680, cchData=32 | out: lpLCData="Sun") returned 4
	[0185.048] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x13d34c0, cchData=8 | out: lpLCData=".") returned 2
	[0185.048] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x13d34e0, cchData=8 | out: lpLCData=",") returned 2
	[0185.048] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0185.049] GetProcessHeap () returned 0x6b0000
	[0185.049] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x20c) returned 0x6baa50
	[0185.049] GetConsoleTitleW (in: lpConsoleTitle=0x6baa50, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0185.050] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0185.051] GetProcAddress (hModule=0x75600000, lpProcName="CopyFileExW") returned 0x7561ffc0
	[0185.051] GetProcAddress (hModule=0x75600000, lpProcName="IsDebuggerPresent") returned 0x7561b0b0
	[0185.051] GetProcAddress (hModule=0x75600000, lpProcName="SetConsoleInputExeNameW") returned 0x7559b440
	[0185.051] GetProcessHeap () returned 0x6b0000
	[0185.051] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x400a) returned 0x6bbc50
	[0185.051] GetProcessHeap () returned 0x6b0000
	[0185.052] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6bbc50) returned 1
	[0185.052] _wcsicmp (_String1="taskkill", _String2=")") returned 75
	[0185.052] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14
	[0185.052] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14
	[0185.052] _wcsicmp (_String1="IF", _String2="taskkill") returned -11
	[0185.052] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11
	[0185.052] _wcsicmp (_String1="REM", _String2="taskkill") returned -2
	[0185.052] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2
	[0185.053] GetProcessHeap () returned 0x6b0000
	[0185.053] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x58) returned 0x6bac68
	[0185.053] GetProcessHeap () returned 0x6b0000
	[0185.053] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6b0578
	[0185.053] GetProcessHeap () returned 0x6b0000
	[0185.053] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x30) returned 0x6bacc8
	[0185.054] GetConsoleTitleW (in: lpConsoleTitle=0x19fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0185.057] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0185.057] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0185.057] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0185.057] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0185.057] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0185.057] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0185.057] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0185.057] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0185.057] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0185.057] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0185.057] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0185.057] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0185.057] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0185.057] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0185.057] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0185.057] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0185.057] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0185.057] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0185.057] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0185.058] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0185.058] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0185.058] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0185.058] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0185.058] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0185.058] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0185.058] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0185.058] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0185.058] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0185.058] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0185.058] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0185.058] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0185.058] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0185.058] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0185.058] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0185.058] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0185.058] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0185.058] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0185.058] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0185.058] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0185.058] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0185.058] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0185.058] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0185.058] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0185.058] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0185.058] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0185.059] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0185.059] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0185.059] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0185.059] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0185.059] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0185.059] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0185.059] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0185.059] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0185.059] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0185.059] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0185.059] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0185.059] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0185.059] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0185.059] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0185.059] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0185.059] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0185.059] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0185.059] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0185.059] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0185.059] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0185.059] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0185.059] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0185.059] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0185.059] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0185.059] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0185.060] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0185.060] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0185.060] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0185.060] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0185.060] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0185.060] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0185.060] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0185.060] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0185.060] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0185.060] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0185.060] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0185.060] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0185.060] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0185.060] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0185.060] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14
	[0185.060] _wcsicmp (_String1="taskkill", _String2="IF") returned 11
	[0185.060] _wcsicmp (_String1="taskkill", _String2="REM") returned 2
	[0185.061] GetProcessHeap () returned 0x6b0000
	[0185.061] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x210) returned 0x6bad00
	[0185.061] GetProcessHeap () returned 0x6b0000
	[0185.061] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6baf18
	[0185.061] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0185.061] GetProcessHeap () returned 0x6b0000
	[0185.061] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x418) returned 0x6b05c8
	[0185.061] SetErrorMode (uMode=0x0) returned 0x8003
	[0185.061] SetErrorMode (uMode=0x1) returned 0x0
	[0185.061] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x6b05d0, lpFilePart=0x19f57c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19f57c*="Desktop") returned 0x1d
	[0185.061] SetErrorMode (uMode=0x8003) returned 0x1
	[0185.061] GetProcessHeap () returned 0x6b0000
	[0185.061] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6b05c8, Size=0x56) returned 0x6b05c8
	[0185.062] GetProcessHeap () returned 0x6b0000
	[0185.062] RtlSizeHeap (HeapHandle=0x6b0000, Flags=0x0, MemoryPointer=0x6b05c8) returned 0x56
	[0185.062] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0185.062] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0185.062] GetProcessHeap () returned 0x6b0000
	[0185.062] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x110) returned 0x6baf68
	[0185.062] GetProcessHeap () returned 0x6b0000
	[0185.062] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x218) returned 0x6b0628
	[0185.067] GetProcessHeap () returned 0x6b0000
	[0185.067] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6b0628, Size=0x112) returned 0x6b0628
	[0185.067] GetProcessHeap () returned 0x6b0000
	[0185.067] RtlSizeHeap (HeapHandle=0x6b0000, Flags=0x0, MemoryPointer=0x6b0628) returned 0x112
	[0185.067] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0185.067] GetProcessHeap () returned 0x6b0000
	[0185.067] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xe0) returned 0x6bb080
	[0185.069] GetProcessHeap () returned 0x6b0000
	[0185.069] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6bb080, Size=0x76) returned 0x6bb080
	[0185.069] GetProcessHeap () returned 0x6b0000
	[0185.069] RtlSizeHeap (HeapHandle=0x6b0000, Flags=0x0, MemoryPointer=0x6bb080) returned 0x76
	[0185.069] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0185.069] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0185.069] GetLastError () returned 0x2
	[0185.069] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0185.069] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x6bb100
	[0185.069] GetProcessHeap () returned 0x6b0000
	[0185.069] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x0, Size=0x14) returned 0x6b7608
	[0185.070] FindClose (in: hFindFile=0x6bb100 | out: hFindFile=0x6bb100) returned 1
	[0185.070] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0185.070] GetLastError () returned 0x2
	[0185.070] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x6bb100
	[0185.070] GetProcessHeap () returned 0x6b0000
	[0185.070] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x0, Ptr=0x6b7608, Size=0x4) returned 0x6bb140
	[0185.070] FindClose (in: hFindFile=0x6bb100 | out: hFindFile=0x6bb100) returned 1
	[0185.070] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0185.070] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0185.070] GetConsoleTitleW (in: lpConsoleTitle=0x19f7fc, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0185.083] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f728, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f70c | out: lpAttributeList=0x19f728, lpSize=0x19f70c) returned 1
	[0185.083] UpdateProcThreadAttribute (in: lpAttributeList=0x19f728, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f714, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f728, lpPreviousValue=0x0) returned 1
	[0185.083] GetStartupInfoW (in: lpStartupInfo=0x19f760 | out: lpStartupInfo=0x19f760*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x150, hStdOutput=0x154, hStdError=0x130)) 
	[0185.084] GetProcessHeap () returned 0x6b0000
	[0185.084] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6b7788
	[0185.084] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0185.084] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0185.084] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0185.084] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0185.084] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0185.084] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0185.084] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0185.084] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0185.084] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0185.084] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0185.084] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0185.084] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0185.084] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0185.084] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0185.084] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0185.084] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0185.084] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0185.084] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0185.084] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0185.084] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0185.084] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0185.084] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0185.084] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0185.084] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0185.084] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0185.085] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0185.085] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0185.085] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0185.085] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0185.085] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0185.085] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0185.085] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0185.085] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0185.085] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0185.085] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0185.085] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0185.085] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0185.085] GetProcessHeap () returned 0x6b0000
	[0185.085] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6b7788) returned 1
	[0185.085] GetProcessHeap () returned 0x6b0000
	[0185.085] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xa) returned 0x6bb100
	[0185.085] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1
	[0185.088] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill  /f /im thebat.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x19f6b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill  /f /im thebat.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f6fc | out: lpCommandLine="taskkill  /f /im thebat.exe ", lpProcessInformation=0x19f6fc*(hProcess=0x9c, hThread=0x98, dwProcessId=0xf10, dwThreadId=0x1218)) returned 1
	[0185.108] CloseHandle (hObject=0x98) returned 1
	[0185.108] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0185.108] GetProcessHeap () returned 0x6b0000
	[0185.109] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6b9d50) returned 1
	[0185.109] GetEnvironmentStringsW () returned 0x6b9d50*
	[0185.109] GetProcessHeap () returned 0x6b0000
	[0185.109] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xa76) returned 0x6bbc50
	[0185.109] FreeEnvironmentStringsA (penv="=") returned 1
	[0185.109] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0
	[0186.036] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x19f694 | out: lpExitCode=0x19f694*=0x80) returned 1
	[0186.036] CloseHandle (hObject=0x9c) returned 1
	[0186.037] _vsnwprintf (in: _Buffer=0x19f77c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f69c | out: _Buffer="00000080") returned 8
	[0186.037] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1
	[0186.037] GetProcessHeap () returned 0x6b0000
	[0186.037] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6bbc50) returned 1
	[0186.038] GetEnvironmentStringsW () returned 0x6bb150*
	[0186.038] GetProcessHeap () returned 0x6b0000
	[0186.038] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xa9c) returned 0x6bbbf8
	[0186.038] FreeEnvironmentStringsA (penv="=") returned 1
	[0186.038] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0186.038] GetProcessHeap () returned 0x6b0000
	[0186.038] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6bbbf8) returned 1
	[0186.038] GetEnvironmentStringsW () returned 0x6bb150*
	[0186.038] GetProcessHeap () returned 0x6b0000
	[0186.038] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xa9c) returned 0x6bbbf8
	[0186.038] FreeEnvironmentStringsA (penv="=") returned 1
	[0186.038] GetProcessHeap () returned 0x6b0000
	[0186.038] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6bb100) returned 1
	[0186.039] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f728 | out: lpAttributeList=0x19f728) 
	[0186.039] _get_osfhandle (_FileHandle=1) returned 0x154
	[0186.039] SetConsoleMode (hConsoleHandle=0x154, dwMode=0x0) returned 0
	[0186.039] _get_osfhandle (_FileHandle=1) returned 0x154
	[0186.039] GetConsoleMode (in: hConsoleHandle=0x154, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0186.039] _get_osfhandle (_FileHandle=0) returned 0x150
	[0186.039] GetConsoleMode (in: hConsoleHandle=0x150, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0186.039] GetConsoleOutputCP () returned 0x1b5
	[0186.049] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0186.049] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0186.051] exit (_Code=128) 

Thread:
	id = 358
	os_tid = 0x13e4


Process:
	id = "72"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\syswow64\\taskkill.exe"
	page_root = "0x3cff1000"
	os_pid = "0xf10"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "71"
	os_parent_pid = "0x560"
	cmd_line = "taskkill  /f /im thebat.exe "
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 5113
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 5114
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 5115
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 5116
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 5117
	        start_va = 0xa0000
	          end_va = 0xdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 5118
	        start_va = 0xe0000
	          end_va = 0xe3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 5119
	        start_va = 0xf0000
	          end_va = 0xf0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 5120
	        start_va = 0x100000
	          end_va = 0x101fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 5121
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 5122
	        start_va = 0x13b0000
	          end_va = 0x13c5fff
	       monitored = 0
	     entry_point = 0x13bde80
	     region_type = mapped_file
	            name = "taskkill.exe"
	        filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe")

Region:
	              id = 5123
	        start_va = 0x13d0000
	          end_va = 0x53cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000013d0000"
	        filename = ""

Region:
	              id = 5124
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 5125
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 5126
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 5127
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 5128
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 5129
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 5130
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 5131
	        start_va = 0x1e0000
	          end_va = 0x1effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001e0000"
	        filename = ""

Region:
	              id = 5132
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 5133
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 5134
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 5135
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 5136
	        start_va = 0x400000
	          end_va = 0x64ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 5137
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 5138
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 5139
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 5140
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 5141
	        start_va = 0x110000
	          end_va = 0x1cdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 5142
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 5143
	        start_va = 0x74650000
	          end_va = 0x746cafff
	       monitored = 0
	     entry_point = 0x7466e970
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 5144
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 5145
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 5146
	        start_va = 0x440000
	          end_va = 0x47ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000440000"
	        filename = ""

Region:
	              id = 5147
	        start_va = 0x550000
	          end_va = 0x64ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000550000"
	        filename = ""

Region:
	              id = 5148
	        start_va = 0x76ae0000
	          end_va = 0x76b23fff
	       monitored = 0
	     entry_point = 0x76af9d80
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 5149
	        start_va = 0x75260000
	          end_va = 0x7530cfff
	       monitored = 0
	     entry_point = 0x75274f00
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 5150
	        start_va = 0x74450000
	          end_va = 0x7446dfff
	       monitored = 0
	     entry_point = 0x7445b640
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 5151
	        start_va = 0x74440000
	          end_va = 0x74449fff
	       monitored = 0
	     entry_point = 0x74442a00
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 5152
	        start_va = 0x74590000
	          end_va = 0x745e7fff
	       monitored = 0
	     entry_point = 0x745d25c0
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 5153
	        start_va = 0x77450000
	          end_va = 0x77596fff
	       monitored = 0
	     entry_point = 0x77461cf0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 5154
	        start_va = 0x76b30000
	          end_va = 0x76c7efff
	       monitored = 0
	     entry_point = 0x76be6820
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 5155
	        start_va = 0x6cc90000
	          end_va = 0x6cc97fff
	       monitored = 0
	     entry_point = 0x6cc917b0
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 5156
	        start_va = 0x6cc70000
	          end_va = 0x6cc85fff
	       monitored = 0
	     entry_point = 0x6cc721d0
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")

Region:
	              id = 5157
	        start_va = 0x753c0000
	          end_va = 0x75451fff
	       monitored = 0
	     entry_point = 0x753f8cf0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 5158
	        start_va = 0x77290000
	          end_va = 0x7744cfff
	       monitored = 0
	     entry_point = 0x77372a10
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")

Region:
	              id = 5159
	        start_va = 0x75310000
	          end_va = 0x7536efff
	       monitored = 0
	     entry_point = 0x75314af0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 5160
	        start_va = 0x6cc30000
	          end_va = 0x6cc6efff
	       monitored = 0
	     entry_point = 0x6cc446c0
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll")

Region:
	              id = 5161
	        start_va = 0x6caf0000
	          end_va = 0x6cc2efff
	       monitored = 0
	     entry_point = 0x6cb1d880
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll")

Region:
	              id = 5162
	        start_va = 0x77240000
	          end_va = 0x77284fff
	       monitored = 0
	     entry_point = 0x7725de90
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 5163
	        start_va = 0x6cad0000
	          end_va = 0x6caebfff
	       monitored = 0
	     entry_point = 0x6cad4720
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")

Region:
	              id = 5164
	        start_va = 0x6cac0000
	          end_va = 0x6cac9fff
	       monitored = 0
	     entry_point = 0x6cac28d0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")

Region:
	              id = 5165
	        start_va = 0x480000
	          end_va = 0x4affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 5166
	        start_va = 0x4b0000
	          end_va = 0x4d9fff
	       monitored = 0
	     entry_point = 0x4b5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 5167
	        start_va = 0x650000
	          end_va = 0x7d7fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000650000"
	        filename = ""

Region:
	              id = 5168
	        start_va = 0x74ea0000
	          end_va = 0x74ecafff
	       monitored = 0
	     entry_point = 0x74ea5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 5169
	        start_va = 0x7e0000
	          end_va = 0x960fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000007e0000"
	        filename = ""

Region:
	              id = 5170
	        start_va = 0x53d0000
	          end_va = 0x67cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000053d0000"
	        filename = ""

Region:
	              id = 5171
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 5172
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001d0000"
	        filename = ""

Region:
	              id = 5173
	        start_va = 0x1f0000
	          end_va = 0x1f4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taskkill.exe.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui")

Region:
	              id = 5174
	        start_va = 0x480000
	          end_va = 0x480fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 5175
	        start_va = 0x490000
	          end_va = 0x490fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000490000"
	        filename = ""

Region:
	              id = 5176
	        start_va = 0x4a0000
	          end_va = 0x4affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004a0000"
	        filename = ""

Region:
	              id = 5177
	        start_va = 0x970000
	          end_va = 0xca6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 5178
	        start_va = 0xcb0000
	          end_va = 0xd99fff
	       monitored = 0
	     entry_point = 0xced650
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 5179
	        start_va = 0x4b0000
	          end_va = 0x4b3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004b0000"
	        filename = ""

Region:
	              id = 5180
	        start_va = 0xcb0000
	          end_va = 0xd8ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 5181
	        start_va = 0x76e20000
	          end_va = 0x76e2bfff
	       monitored = 0
	     entry_point = 0x76e23930
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")

Region:
	              id = 5182
	        start_va = 0x4c0000
	          end_va = 0x4c0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004c0000"
	        filename = ""

Region:
	              id = 5183
	        start_va = 0x76c80000
	          end_va = 0x76d03fff
	       monitored = 0
	     entry_point = 0x76ca6220
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 5184
	        start_va = 0x4d0000
	          end_va = 0x4d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004d0000"
	        filename = ""

Region:
	              id = 5185
	        start_va = 0x6cab0000
	          end_va = 0x6cabcfff
	       monitored = 0
	     entry_point = 0x6cab3520
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 5186
	        start_va = 0x6ca40000
	          end_va = 0x6caa6fff
	       monitored = 0
	     entry_point = 0x6ca5b610
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 5187
	        start_va = 0x740f0000
	          end_va = 0x7410afff
	       monitored = 0
	     entry_point = 0x740f9050
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 5188
	        start_va = 0x6c9f0000
	          end_va = 0x6ca33fff
	       monitored = 0
	     entry_point = 0x6ca0aaf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")

Region:
	              id = 5189
	        start_va = 0x4e0000
	          end_va = 0x51ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004e0000"
	        filename = ""

Region:
	              id = 5190
	        start_va = 0xd90000
	          end_va = 0xdcffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d90000"
	        filename = ""

Region:
	              id = 5191
	        start_va = 0xdd0000
	          end_va = 0xe0ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000dd0000"
	        filename = ""

Region:
	              id = 5192
	        start_va = 0xe10000
	          end_va = 0xe4ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e10000"
	        filename = ""

Region:
	              id = 5193
	        start_va = 0xe50000
	          end_va = 0xe8ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e50000"
	        filename = ""

Region:
	              id = 5194
	        start_va = 0xe90000
	          end_va = 0xecffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e90000"
	        filename = ""

Region:
	              id = 5195
	        start_va = 0x6c9d0000
	          end_va = 0x6c9e0fff
	       monitored = 0
	     entry_point = 0x6c9d8fa0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 5196
	        start_va = 0x6c910000
	          end_va = 0x6c9cefff
	       monitored = 0
	     entry_point = 0x6c941e80
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 5198
	        start_va = 0x520000
	          end_va = 0x525fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000520000"
	        filename = ""


Thread:
	id = 359
	os_tid = 0x1218


Thread:
	id = 360
	os_tid = 0xfec


Thread:
	id = 361
	os_tid = 0xc78


Thread:
	id = 362
	os_tid = 0x13ac


Thread:
	id = 363
	os_tid = 0xffc


Process:
	id = "73"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x2f94f000"
	os_pid = "0xf0c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x614"
	cmd_line = "cmd.exe /c \"taskkill /f /im thebat64.exe \""
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 5201
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 5202
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 5203
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 5204
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 5205
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 5206
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 5207
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 5208
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 5209
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 5210
	        start_va = 0x13a0000
	          end_va = 0x13f1fff
	       monitored = 1
	     entry_point = 0x13b4fd0
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")

Region:
	              id = 5211
	        start_va = 0x1400000
	          end_va = 0x53fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001400000"
	        filename = ""

Region:
	              id = 5212
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 5213
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 5214
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 5215
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 5216
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 5217
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 5218
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 5219
	        start_va = 0x490000
	          end_va = 0x49ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000490000"
	        filename = ""

Region:
	              id = 5220
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 5221
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 5222
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 5223
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 5224
	        start_va = 0x4a0000
	          end_va = 0x71ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004a0000"
	        filename = ""

Region:
	              id = 5225
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 5226
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 5227
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 5228
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 5229
	        start_va = 0x4a0000
	          end_va = 0x55dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 5230
	        start_va = 0x620000
	          end_va = 0x71ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000620000"
	        filename = ""

Region:
	              id = 5231
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 5232
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 5233
	        start_va = 0x720000
	          end_va = 0x81ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000720000"
	        filename = ""

Region:
	              id = 5234
	        start_va = 0x820000
	          end_va = 0x91ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000820000"
	        filename = ""

Region:
	              id = 5235
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 5236
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 5237
	        start_va = 0x920000
	          end_va = 0xc56fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 364
	os_tid = 0xd94

	[0186.252] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000
	[0186.252] __set_app_type (_Type=0x1) 
	[0186.252] __p__fmode () returned 0x74974d6c
	[0186.252] __p__commode () returned 0x74975b1c
	[0186.253] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13b5200) returned 0x0
	[0186.253] __getmainargs (in: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0, _DoWildCard=0, _StartInfo=0x13c60fc | out: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0) returned 0
	[0186.253] GetCurrentThreadId () returned 0xd94
	[0186.253] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xd94) returned 0x78
	[0186.253] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0186.253] GetProcAddress (hModule=0x75600000, lpProcName="SetThreadUILanguage") returned 0x75642510
	[0186.254] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0186.260] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0186.260] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2
	[0186.261] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0186.261] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0186.261] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0186.261] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0186.261] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0186.261] GetConsoleOutputCP () returned 0x1b5
	[0186.262] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0186.262] SetConsoleCtrlHandler (HandlerRoutine=0x13c0e40, Add=1) returned 1
	[0186.262] _get_osfhandle (_FileHandle=1) returned 0x150
	[0186.262] SetConsoleMode (hConsoleHandle=0x150, dwMode=0x0) returned 0
	[0186.262] _get_osfhandle (_FileHandle=1) returned 0x150
	[0186.262] GetConsoleMode (in: hConsoleHandle=0x150, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0186.262] _get_osfhandle (_FileHandle=0) returned 0x144
	[0186.262] GetConsoleMode (in: hConsoleHandle=0x144, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0186.262] GetEnvironmentStringsW () returned 0x627cc0*
	[0186.263] GetProcessHeap () returned 0x620000
	[0186.263] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0xa1a) returned 0x6286e8
	[0186.263] FreeEnvironmentStringsA (penv="A") returned 1
	[0186.263] GetProcessHeap () returned 0x620000
	[0186.263] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x4) returned 0x620550
	[0186.263] GetEnvironmentStringsW () returned 0x627cc0*
	[0186.263] GetProcessHeap () returned 0x620000
	[0186.263] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0xa1a) returned 0x629110
	[0186.263] FreeEnvironmentStringsA (penv="A") returned 1
	[0186.263] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0186.263] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0186.263] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0186.263] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0186.263] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0186.263] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0186.263] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0186.263] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0186.264] RegCloseKey (hKey=0x88) returned 0x0
	[0186.264] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0186.264] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0186.264] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0186.264] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0186.264] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0186.264] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0186.264] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0186.264] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0186.264] RegCloseKey (hKey=0x88) returned 0x0
	[0186.264] time (in: timer=0x0 | out: timer=0x0) returned 0x62344244
	[0186.264] srand (_Seed=0x62344244) 
	[0186.264] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im thebat64.exe \""
	[0186.264] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im thebat64.exe \""
	[0186.264] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0186.264] GetProcessHeap () returned 0x620000
	[0186.265] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x210) returned 0x629b38
	[0186.265] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x629b40, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0186.265] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0186.265] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0186.265] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0186.265] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0186.265] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0186.265] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0186.265] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0186.265] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0186.265] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0186.265] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0186.265] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0186.265] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0186.265] GetProcessHeap () returned 0x620000
	[0186.266] RtlFreeHeap (HeapHandle=0x620000, Flags=0x0, BaseAddress=0x6286e8) returned 1
	[0186.266] GetEnvironmentStringsW () returned 0x627cc0*
	[0186.266] GetProcessHeap () returned 0x620000
	[0186.266] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0xa32) returned 0x62a790
	[0186.266] FreeEnvironmentStringsA (penv="A") returned 1
	[0186.266] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b
	[0186.266] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0186.266] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0186.266] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0186.266] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0186.266] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0186.266] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0186.266] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0186.266] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0186.266] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0186.267] GetProcessHeap () returned 0x620000
	[0186.267] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x44) returned 0x6205c8
	[0186.267] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0186.267] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19fc4c*="Desktop") returned 0x1d
	[0186.267] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0186.267] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x620618
	[0186.267] FindClose (in: hFindFile=0x620618 | out: hFindFile=0x620618) returned 1
	[0186.267] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x620618
	[0186.268] FindClose (in: hFindFile=0x620618 | out: hFindFile=0x620618) returned 1
	[0186.268] _wcsnicmp (_String1="RDHJ0C~1", _String2="RDhJ0CNFevzX", _MaxCount=0xc) returned 16
	[0186.268] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x620618
	[0186.268] FindClose (in: hFindFile=0x620618 | out: hFindFile=0x620618) returned 1
	[0186.268] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0186.268] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1
	[0186.268] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 1
	[0186.268] GetProcessHeap () returned 0x620000
	[0186.268] RtlFreeHeap (HeapHandle=0x620000, Flags=0x0, BaseAddress=0x62a790) returned 1
	[0186.269] GetEnvironmentStringsW () returned 0x627cc0*
	[0186.269] GetProcessHeap () returned 0x620000
	[0186.269] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0xa76) returned 0x629d50
	[0186.269] FreeEnvironmentStringsA (penv="=") returned 1
	[0186.269] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0186.269] GetProcessHeap () returned 0x620000
	[0186.269] RtlFreeHeap (HeapHandle=0x620000, Flags=0x0, BaseAddress=0x6205c8) returned 1
	[0186.269] GetProcessHeap () returned 0x620000
	[0186.269] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x400e) returned 0x62bc50
	[0186.270] GetProcessHeap () returned 0x620000
	[0186.270] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x4c) returned 0x62a7d0
	[0186.270] GetProcessHeap () returned 0x620000
	[0186.270] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x4008) returned 0x62fc68
	[0186.270] GetProcessHeap () returned 0x620000
	[0186.270] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x4008) returned 0x633c78
	[0186.271] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0186.272] GetProcessHeap () returned 0x620000
	[0186.272] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x418) returned 0x62a828
	[0186.272] SetErrorMode (uMode=0x0) returned 0x8003
	[0186.272] SetErrorMode (uMode=0x1) returned 0x0
	[0186.272] GetFullPathNameW (in: lpFileName="taskkill \\f \\.", nBufferLength=0x208, lpBuffer=0x62a830, lpFilePart=0x19fbac | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f", lpFilePart=0x19fbac*="f") returned 0x29
	[0186.272] SetErrorMode (uMode=0x8003) returned 0x1
	[0186.273] GetProcessHeap () returned 0x620000
	[0186.273] RtlReAllocateHeap (Heap=0x620000, Flags=0x0, Ptr=0x62a828, Size=0x7e) returned 0x62a828
	[0186.273] GetProcessHeap () returned 0x620000
	[0186.273] RtlSizeHeap (HeapHandle=0x620000, Flags=0x0, MemoryPointer=0x62a828) returned 0x7e
	[0186.273] NeedCurrentDirectoryForExePathW (ExeName="taskkill \\f \\.") returned 1
	[0186.273] GetProcessHeap () returned 0x620000
	[0186.273] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x62) returned 0x62a8b0
	[0186.273] GetProcessHeap () returned 0x620000
	[0186.273] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0xb8) returned 0x62a920
	[0186.273] GetProcessHeap () returned 0x620000
	[0186.273] RtlReAllocateHeap (Heap=0x620000, Flags=0x0, Ptr=0x62a920, Size=0x62) returned 0x62a920
	[0186.273] GetProcessHeap () returned 0x620000
	[0186.273] RtlSizeHeap (HeapHandle=0x620000, Flags=0x0, MemoryPointer=0x62a920) returned 0x62
	[0186.273] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0186.273] GetProcessHeap () returned 0x620000
	[0186.273] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0xe0) returned 0x62a990
	[0186.277] GetProcessHeap () returned 0x620000
	[0186.277] RtlReAllocateHeap (Heap=0x620000, Flags=0x0, Ptr=0x62a990, Size=0x76) returned 0x62a990
	[0186.277] GetProcessHeap () returned 0x620000
	[0186.277] RtlSizeHeap (HeapHandle=0x620000, Flags=0x0, MemoryPointer=0x62a990) returned 0x76
	[0186.278] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0186.278] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f\\im thebat64.exe ", fInfoLevelId=0x1, lpFindFileData=0x19f958, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f958) returned 0xffffffff
	[0186.278] GetLastError () returned 0x3
	[0186.278] GetProcessHeap () returned 0x620000
	[0186.278] RtlFreeHeap (HeapHandle=0x620000, Flags=0x0, BaseAddress=0x62fc68) returned 1
	[0186.279] GetProcessHeap () returned 0x620000
	[0186.279] RtlFreeHeap (HeapHandle=0x620000, Flags=0x0, BaseAddress=0x633c78) returned 1
	[0186.279] GetProcessHeap () returned 0x620000
	[0186.279] RtlFreeHeap (HeapHandle=0x620000, Flags=0x0, BaseAddress=0x62bc50) returned 1
	[0186.280] GetConsoleOutputCP () returned 0x1b5
	[0186.283] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0186.284] GetUserDefaultLCID () returned 0x409
	[0186.284] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x13d34a0, cchData=8 | out: lpLCData=":") returned 2
	[0186.284] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0186.284] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0186.284] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2
	[0186.284] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x13d34b0, cchData=8 | out: lpLCData="/") returned 2
	[0186.284] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x13d3500, cchData=32 | out: lpLCData="Mon") returned 4
	[0186.284] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x13d3540, cchData=32 | out: lpLCData="Tue") returned 4
	[0186.284] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x13d3580, cchData=32 | out: lpLCData="Wed") returned 4
	[0186.284] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x13d35c0, cchData=32 | out: lpLCData="Thu") returned 4
	[0186.284] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x13d3600, cchData=32 | out: lpLCData="Fri") returned 4
	[0186.284] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x13d3640, cchData=32 | out: lpLCData="Sat") returned 4
	[0186.285] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x13d3680, cchData=32 | out: lpLCData="Sun") returned 4
	[0186.285] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x13d34c0, cchData=8 | out: lpLCData=".") returned 2
	[0186.285] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x13d34e0, cchData=8 | out: lpLCData=",") returned 2
	[0186.285] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0186.286] GetProcessHeap () returned 0x620000
	[0186.286] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x0, Size=0x20c) returned 0x62aa58
	[0186.286] GetConsoleTitleW (in: lpConsoleTitle=0x62aa58, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0186.288] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0186.288] GetProcAddress (hModule=0x75600000, lpProcName="CopyFileExW") returned 0x7561ffc0
	[0186.288] GetProcAddress (hModule=0x75600000, lpProcName="IsDebuggerPresent") returned 0x7561b0b0
	[0186.288] GetProcAddress (hModule=0x75600000, lpProcName="SetConsoleInputExeNameW") returned 0x7559b440
	[0186.288] GetProcessHeap () returned 0x620000
	[0186.288] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x400a) returned 0x62bc50
	[0186.288] GetProcessHeap () returned 0x620000
	[0186.289] RtlFreeHeap (HeapHandle=0x620000, Flags=0x0, BaseAddress=0x62bc50) returned 1
	[0186.289] _wcsicmp (_String1="taskkill", _String2=")") returned 75
	[0186.290] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14
	[0186.290] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14
	[0186.290] _wcsicmp (_String1="IF", _String2="taskkill") returned -11
	[0186.290] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11
	[0186.290] _wcsicmp (_String1="REM", _String2="taskkill") returned -2
	[0186.290] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2
	[0186.290] GetProcessHeap () returned 0x620000
	[0186.290] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x58) returned 0x62ac70
	[0186.290] GetProcessHeap () returned 0x620000
	[0186.290] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x1a) returned 0x620578
	[0186.290] GetProcessHeap () returned 0x620000
	[0186.290] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x34) returned 0x62acd0
	[0186.291] GetConsoleTitleW (in: lpConsoleTitle=0x19fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0186.293] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0186.293] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0186.293] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0186.293] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0186.293] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0186.293] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0186.293] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0186.293] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0186.293] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0186.293] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0186.293] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0186.293] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0186.293] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0186.293] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0186.293] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0186.293] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0186.293] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0186.293] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0186.293] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0186.293] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0186.293] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0186.293] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0186.293] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0186.293] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0186.294] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0186.294] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0186.294] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0186.294] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0186.294] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0186.294] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0186.294] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0186.294] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0186.294] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0186.294] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0186.294] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0186.294] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0186.294] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0186.294] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0186.294] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0186.294] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0186.294] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0186.294] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0186.294] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0186.294] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0186.294] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0186.294] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0186.294] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0186.294] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0186.294] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0186.294] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0186.294] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0186.294] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0186.294] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0186.294] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0186.294] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0186.295] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0186.295] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0186.295] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0186.295] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0186.295] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0186.295] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0186.295] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0186.295] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0186.295] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0186.295] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0186.295] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0186.295] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0186.295] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0186.295] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0186.295] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0186.295] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0186.295] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0186.295] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0186.295] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0186.295] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0186.295] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0186.295] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0186.295] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0186.295] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0186.295] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0186.295] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0186.295] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0186.295] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0186.296] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0186.296] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14
	[0186.296] _wcsicmp (_String1="taskkill", _String2="IF") returned 11
	[0186.296] _wcsicmp (_String1="taskkill", _String2="REM") returned 2
	[0186.296] GetProcessHeap () returned 0x620000
	[0186.296] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x210) returned 0x62ad10
	[0186.296] GetProcessHeap () returned 0x620000
	[0186.296] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x46) returned 0x62af28
	[0186.296] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0186.296] GetProcessHeap () returned 0x620000
	[0186.296] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x418) returned 0x6205c8
	[0186.296] SetErrorMode (uMode=0x0) returned 0x8003
	[0186.297] SetErrorMode (uMode=0x1) returned 0x0
	[0186.297] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x6205d0, lpFilePart=0x19f57c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19f57c*="Desktop") returned 0x1d
	[0186.297] SetErrorMode (uMode=0x8003) returned 0x1
	[0186.297] GetProcessHeap () returned 0x620000
	[0186.297] RtlReAllocateHeap (Heap=0x620000, Flags=0x0, Ptr=0x6205c8, Size=0x56) returned 0x6205c8
	[0186.297] GetProcessHeap () returned 0x620000
	[0186.297] RtlSizeHeap (HeapHandle=0x620000, Flags=0x0, MemoryPointer=0x6205c8) returned 0x56
	[0186.297] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0186.297] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0186.297] GetProcessHeap () returned 0x620000
	[0186.297] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x110) returned 0x62af78
	[0186.297] GetProcessHeap () returned 0x620000
	[0186.297] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x218) returned 0x620628
	[0186.303] GetProcessHeap () returned 0x620000
	[0186.303] RtlReAllocateHeap (Heap=0x620000, Flags=0x0, Ptr=0x620628, Size=0x112) returned 0x620628
	[0186.303] GetProcessHeap () returned 0x620000
	[0186.303] RtlSizeHeap (HeapHandle=0x620000, Flags=0x0, MemoryPointer=0x620628) returned 0x112
	[0186.303] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0186.303] GetProcessHeap () returned 0x620000
	[0186.303] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0xe0) returned 0x62b090
	[0186.305] GetProcessHeap () returned 0x620000
	[0186.305] RtlReAllocateHeap (Heap=0x620000, Flags=0x0, Ptr=0x62b090, Size=0x76) returned 0x62b090
	[0186.305] GetProcessHeap () returned 0x620000
	[0186.305] RtlSizeHeap (HeapHandle=0x620000, Flags=0x0, MemoryPointer=0x62b090) returned 0x76
	[0186.305] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0186.305] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0186.320] GetLastError () returned 0x2
	[0186.320] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0186.321] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x62b110
	[0186.321] GetProcessHeap () returned 0x620000
	[0186.321] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x0, Size=0x14) returned 0x6274e8
	[0186.321] FindClose (in: hFindFile=0x62b110 | out: hFindFile=0x62b110) returned 1
	[0186.321] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0186.321] GetLastError () returned 0x2
	[0186.321] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x62b110
	[0186.322] GetProcessHeap () returned 0x620000
	[0186.322] RtlReAllocateHeap (Heap=0x620000, Flags=0x0, Ptr=0x6274e8, Size=0x4) returned 0x62b150
	[0186.322] FindClose (in: hFindFile=0x62b110 | out: hFindFile=0x62b110) returned 1
	[0186.322] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0186.322] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0186.322] GetConsoleTitleW (in: lpConsoleTitle=0x19f7fc, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0186.326] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f728, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f70c | out: lpAttributeList=0x19f728, lpSize=0x19f70c) returned 1
	[0186.326] UpdateProcThreadAttribute (in: lpAttributeList=0x19f728, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f714, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f728, lpPreviousValue=0x0) returned 1
	[0186.326] GetStartupInfoW (in: lpStartupInfo=0x19f760 | out: lpStartupInfo=0x19f760*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x144, hStdOutput=0x150, hStdError=0x154)) 
	[0186.327] GetProcessHeap () returned 0x620000
	[0186.327] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x18) returned 0x627508
	[0186.327] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0186.327] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0186.327] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0186.327] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0186.327] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0186.327] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0186.327] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0186.327] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0186.327] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0186.327] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0186.328] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0186.328] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0186.328] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0186.328] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0186.328] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0186.328] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0186.328] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0186.328] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0186.328] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0186.328] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0186.328] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0186.328] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0186.328] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0186.328] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0186.328] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0186.328] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0186.328] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0186.328] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0186.328] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0186.328] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0186.328] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0186.328] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0186.329] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0186.329] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0186.329] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0186.329] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0186.329] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0186.329] GetProcessHeap () returned 0x620000
	[0186.329] RtlFreeHeap (HeapHandle=0x620000, Flags=0x0, BaseAddress=0x627508) returned 1
	[0186.329] GetProcessHeap () returned 0x620000
	[0186.329] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0xa) returned 0x62b110
	[0186.329] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1
	[0186.337] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill  /f /im thebat64.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x19f6b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill  /f /im thebat64.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f6fc | out: lpCommandLine="taskkill  /f /im thebat64.exe ", lpProcessInformation=0x19f6fc*(hProcess=0x9c, hThread=0x98, dwProcessId=0xeac, dwThreadId=0x55c)) returned 1
	[0186.392] CloseHandle (hObject=0x98) returned 1
	[0186.392] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0186.392] GetProcessHeap () returned 0x620000
	[0186.393] RtlFreeHeap (HeapHandle=0x620000, Flags=0x0, BaseAddress=0x629d50) returned 1
	[0186.393] GetEnvironmentStringsW () returned 0x629d50*
	[0186.393] GetProcessHeap () returned 0x620000
	[0186.393] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0xa76) returned 0x627cc0
	[0186.393] FreeEnvironmentStringsA (penv="=") returned 1
	[0186.393] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0
	[0187.569] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x19f694 | out: lpExitCode=0x19f694*=0x80) returned 1
	[0187.570] CloseHandle (hObject=0x9c) returned 1
	[0187.570] _vsnwprintf (in: _Buffer=0x19f77c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f69c | out: _Buffer="00000080") returned 8
	[0187.571] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1
	[0187.571] GetProcessHeap () returned 0x620000
	[0187.571] RtlFreeHeap (HeapHandle=0x620000, Flags=0x0, BaseAddress=0x627cc0) returned 1
	[0187.572] GetEnvironmentStringsW () returned 0x62b160*
	[0187.572] GetProcessHeap () returned 0x620000
	[0187.572] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0xa9c) returned 0x627cc0
	[0187.572] FreeEnvironmentStringsA (penv="=") returned 1
	[0187.572] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0187.572] GetProcessHeap () returned 0x620000
	[0187.572] RtlFreeHeap (HeapHandle=0x620000, Flags=0x0, BaseAddress=0x627cc0) returned 1
	[0187.572] GetEnvironmentStringsW () returned 0x62b160*
	[0187.572] GetProcessHeap () returned 0x620000
	[0187.572] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0xa9c) returned 0x627cc0
	[0187.572] FreeEnvironmentStringsA (penv="=") returned 1
	[0187.572] GetProcessHeap () returned 0x620000
	[0187.572] RtlFreeHeap (HeapHandle=0x620000, Flags=0x0, BaseAddress=0x62b110) returned 1
	[0187.572] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f728 | out: lpAttributeList=0x19f728) 
	[0187.572] _get_osfhandle (_FileHandle=1) returned 0x150
	[0187.573] SetConsoleMode (hConsoleHandle=0x150, dwMode=0x0) returned 0
	[0187.573] _get_osfhandle (_FileHandle=1) returned 0x150
	[0187.573] GetConsoleMode (in: hConsoleHandle=0x150, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0187.573] _get_osfhandle (_FileHandle=0) returned 0x144
	[0187.573] GetConsoleMode (in: hConsoleHandle=0x144, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0187.573] GetConsoleOutputCP () returned 0x1b5
	[0187.574] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0187.574] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0187.577] exit (_Code=128) 

Thread:
	id = 365
	os_tid = 0x13e0


Process:
	id = "74"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\syswow64\\taskkill.exe"
	page_root = "0x2f954000"
	os_pid = "0xeac"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "73"
	os_parent_pid = "0xf0c"
	cmd_line = "taskkill  /f /im thebat64.exe "
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 5238
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 5239
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 5240
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 5241
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 5242
	        start_va = 0xa0000
	          end_va = 0xdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 5243
	        start_va = 0xe0000
	          end_va = 0xe3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 5244
	        start_va = 0xf0000
	          end_va = 0xf0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 5245
	        start_va = 0x100000
	          end_va = 0x101fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 5246
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 5247
	        start_va = 0x13b0000
	          end_va = 0x13c5fff
	       monitored = 0
	     entry_point = 0x13bde80
	     region_type = mapped_file
	            name = "taskkill.exe"
	        filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe")

Region:
	              id = 5248
	        start_va = 0x13d0000
	          end_va = 0x53cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000013d0000"
	        filename = ""

Region:
	              id = 5249
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 5250
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 5251
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 5252
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 5253
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 5254
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 5255
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 5256
	        start_va = 0x110000
	          end_va = 0x11ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000110000"
	        filename = ""

Region:
	              id = 5257
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 5258
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 5259
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 5260
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 5261
	        start_va = 0x400000
	          end_va = 0x6bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 5262
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 5263
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 5264
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 5265
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 5266
	        start_va = 0x120000
	          end_va = 0x1ddfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 5267
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 5268
	        start_va = 0x74650000
	          end_va = 0x746cafff
	       monitored = 0
	     entry_point = 0x7466e970
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 5269
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 5270
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 5271
	        start_va = 0x440000
	          end_va = 0x47ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000440000"
	        filename = ""

Region:
	              id = 5272
	        start_va = 0x5c0000
	          end_va = 0x6bffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005c0000"
	        filename = ""

Region:
	              id = 5273
	        start_va = 0x76ae0000
	          end_va = 0x76b23fff
	       monitored = 0
	     entry_point = 0x76af9d80
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 5274
	        start_va = 0x75260000
	          end_va = 0x7530cfff
	       monitored = 0
	     entry_point = 0x75274f00
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 5275
	        start_va = 0x74450000
	          end_va = 0x7446dfff
	       monitored = 0
	     entry_point = 0x7445b640
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 5276
	        start_va = 0x74440000
	          end_va = 0x74449fff
	       monitored = 0
	     entry_point = 0x74442a00
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 5277
	        start_va = 0x74590000
	          end_va = 0x745e7fff
	       monitored = 0
	     entry_point = 0x745d25c0
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 5278
	        start_va = 0x77450000
	          end_va = 0x77596fff
	       monitored = 0
	     entry_point = 0x77461cf0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 5279
	        start_va = 0x76b30000
	          end_va = 0x76c7efff
	       monitored = 0
	     entry_point = 0x76be6820
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 5280
	        start_va = 0x753c0000
	          end_va = 0x75451fff
	       monitored = 0
	     entry_point = 0x753f8cf0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 5281
	        start_va = 0x6cc90000
	          end_va = 0x6cc97fff
	       monitored = 0
	     entry_point = 0x6cc917b0
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 5282
	        start_va = 0x6cc70000
	          end_va = 0x6cc85fff
	       monitored = 0
	     entry_point = 0x6cc721d0
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")

Region:
	              id = 5283
	        start_va = 0x77290000
	          end_va = 0x7744cfff
	       monitored = 0
	     entry_point = 0x77372a10
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")

Region:
	              id = 5284
	        start_va = 0x75310000
	          end_va = 0x7536efff
	       monitored = 0
	     entry_point = 0x75314af0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 5285
	        start_va = 0x77240000
	          end_va = 0x77284fff
	       monitored = 0
	     entry_point = 0x7725de90
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 5286
	        start_va = 0x6cc30000
	          end_va = 0x6cc6efff
	       monitored = 0
	     entry_point = 0x6cc446c0
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll")

Region:
	              id = 5287
	        start_va = 0x6caf0000
	          end_va = 0x6cc2efff
	       monitored = 0
	     entry_point = 0x6cb1d880
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll")

Region:
	              id = 5288
	        start_va = 0x6cad0000
	          end_va = 0x6caebfff
	       monitored = 0
	     entry_point = 0x6cad4720
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")

Region:
	              id = 5289
	        start_va = 0x6cac0000
	          end_va = 0x6cac9fff
	       monitored = 0
	     entry_point = 0x6cac28d0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")

Region:
	              id = 5290
	        start_va = 0x480000
	          end_va = 0x4effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 5291
	        start_va = 0x480000
	          end_va = 0x4a9fff
	       monitored = 0
	     entry_point = 0x485680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 5292
	        start_va = 0x4e0000
	          end_va = 0x4effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004e0000"
	        filename = ""

Region:
	              id = 5293
	        start_va = 0x6c0000
	          end_va = 0x847fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000006c0000"
	        filename = ""

Region:
	              id = 5294
	        start_va = 0x74ea0000
	          end_va = 0x74ecafff
	       monitored = 0
	     entry_point = 0x74ea5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 5295
	        start_va = 0x850000
	          end_va = 0x9d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000850000"
	        filename = ""

Region:
	              id = 5296
	        start_va = 0x53d0000
	          end_va = 0x67cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000053d0000"
	        filename = ""

Region:
	              id = 5297
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 5298
	        start_va = 0x1e0000
	          end_va = 0x1e0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001e0000"
	        filename = ""

Region:
	              id = 5299
	        start_va = 0x1f0000
	          end_va = 0x1f4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taskkill.exe.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui")

Region:
	              id = 5300
	        start_va = 0x480000
	          end_va = 0x480fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 5301
	        start_va = 0x490000
	          end_va = 0x490fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000490000"
	        filename = ""

Region:
	              id = 5302
	        start_va = 0x9e0000
	          end_va = 0xd16fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 5303
	        start_va = 0xd20000
	          end_va = 0xe09fff
	       monitored = 0
	     entry_point = 0xd5d650
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 5304
	        start_va = 0x4a0000
	          end_va = 0x4a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004a0000"
	        filename = ""

Region:
	              id = 5305
	        start_va = 0xd20000
	          end_va = 0xdfffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 5306
	        start_va = 0x76e20000
	          end_va = 0x76e2bfff
	       monitored = 0
	     entry_point = 0x76e23930
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")

Region:
	              id = 5307
	        start_va = 0x4b0000
	          end_va = 0x4b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004b0000"
	        filename = ""

Region:
	              id = 5308
	        start_va = 0x76c80000
	          end_va = 0x76d03fff
	       monitored = 0
	     entry_point = 0x76ca6220
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 5309
	        start_va = 0x4c0000
	          end_va = 0x4c0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004c0000"
	        filename = ""

Region:
	              id = 5310
	        start_va = 0x6cab0000
	          end_va = 0x6cabcfff
	       monitored = 0
	     entry_point = 0x6cab3520
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 5311
	        start_va = 0x6ca40000
	          end_va = 0x6caa6fff
	       monitored = 0
	     entry_point = 0x6ca5b610
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 5312
	        start_va = 0x740f0000
	          end_va = 0x7410afff
	       monitored = 0
	     entry_point = 0x740f9050
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 5313
	        start_va = 0x6c9f0000
	          end_va = 0x6ca33fff
	       monitored = 0
	     entry_point = 0x6ca0aaf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")

Region:
	              id = 5314
	        start_va = 0x4f0000
	          end_va = 0x52ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004f0000"
	        filename = ""

Region:
	              id = 5315
	        start_va = 0x530000
	          end_va = 0x56ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000530000"
	        filename = ""

Region:
	              id = 5316
	        start_va = 0x570000
	          end_va = 0x5affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000570000"
	        filename = ""

Region:
	              id = 5317
	        start_va = 0xe00000
	          end_va = 0xe3ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e00000"
	        filename = ""

Region:
	              id = 5318
	        start_va = 0xe40000
	          end_va = 0xe7ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e40000"
	        filename = ""

Region:
	              id = 5319
	        start_va = 0xe80000
	          end_va = 0xebffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e80000"
	        filename = ""

Region:
	              id = 5320
	        start_va = 0x6c9d0000
	          end_va = 0x6c9e0fff
	       monitored = 0
	     entry_point = 0x6c9d8fa0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 5321
	        start_va = 0x6c910000
	          end_va = 0x6c9cefff
	       monitored = 0
	     entry_point = 0x6c941e80
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 5323
	        start_va = 0x4d0000
	          end_va = 0x4d5fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004d0000"
	        filename = ""


Thread:
	id = 366
	os_tid = 0x55c


Thread:
	id = 367
	os_tid = 0xbec


Thread:
	id = 368
	os_tid = 0xad0


Thread:
	id = 369
	os_tid = 0x5e0


Thread:
	id = 370
	os_tid = 0xf84


Process:
	id = "75"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x2f661000"
	os_pid = "0x868"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x614"
	cmd_line = "cmd.exe /c \"taskkill /f /im thunderbird.exe \""
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 5326
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 5327
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 5328
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 5329
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 5330
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 5331
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 5332
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 5333
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 5334
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 5335
	        start_va = 0x13a0000
	          end_va = 0x13f1fff
	       monitored = 1
	     entry_point = 0x13b4fd0
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")

Region:
	              id = 5336
	        start_va = 0x1400000
	          end_va = 0x53fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001400000"
	        filename = ""

Region:
	              id = 5337
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 5338
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 5339
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 5340
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 5341
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 5342
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 5343
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 5344
	        start_va = 0x5d0000
	          end_va = 0x5dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005d0000"
	        filename = ""

Region:
	              id = 5345
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 5346
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 5347
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 5348
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 5349
	        start_va = 0x5e0000
	          end_va = 0x88ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005e0000"
	        filename = ""

Region:
	              id = 5350
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 5351
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 5352
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 5353
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 5354
	        start_va = 0x400000
	          end_va = 0x4bdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 5355
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 5356
	        start_va = 0x4c0000
	          end_va = 0x4fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004c0000"
	        filename = ""

Region:
	              id = 5357
	        start_va = 0x5e0000
	          end_va = 0x6dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005e0000"
	        filename = ""

Region:
	              id = 5358
	        start_va = 0x790000
	          end_va = 0x88ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000790000"
	        filename = ""

Region:
	              id = 5359
	        start_va = 0x500000
	          end_va = 0x58ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000500000"
	        filename = ""

Region:
	              id = 5360
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 5361
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 5362
	        start_va = 0x890000
	          end_va = 0xbc6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 371
	os_tid = 0x7f0

	[0187.982] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000
	[0187.983] __set_app_type (_Type=0x1) 
	[0187.983] __p__fmode () returned 0x74974d6c
	[0187.983] __p__commode () returned 0x74975b1c
	[0187.983] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13b5200) returned 0x0
	[0187.983] __getmainargs (in: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0, _DoWildCard=0, _StartInfo=0x13c60fc | out: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0) returned 0
	[0187.983] GetCurrentThreadId () returned 0x7f0
	[0187.983] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x7f0) returned 0x78
	[0187.983] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0187.983] GetProcAddress (hModule=0x75600000, lpProcName="SetThreadUILanguage") returned 0x75642510
	[0187.984] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0187.989] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0187.989] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2
	[0187.990] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0187.990] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0187.990] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0187.990] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0187.990] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0187.990] GetConsoleOutputCP () returned 0x1b5
	[0187.992] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0187.992] SetConsoleCtrlHandler (HandlerRoutine=0x13c0e40, Add=1) returned 1
	[0187.992] _get_osfhandle (_FileHandle=1) returned 0x144
	[0187.993] SetConsoleMode (hConsoleHandle=0x144, dwMode=0x0) returned 0
	[0187.993] _get_osfhandle (_FileHandle=1) returned 0x144
	[0187.993] GetConsoleMode (in: hConsoleHandle=0x144, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0187.993] _get_osfhandle (_FileHandle=0) returned 0x140
	[0187.993] GetConsoleMode (in: hConsoleHandle=0x140, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0187.993] GetEnvironmentStringsW () returned 0x797cc8*
	[0187.993] GetProcessHeap () returned 0x790000
	[0187.993] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0xa1a) returned 0x7986f0
	[0187.993] FreeEnvironmentStringsA (penv="A") returned 1
	[0187.993] GetProcessHeap () returned 0x790000
	[0187.993] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0x4) returned 0x790550
	[0187.993] GetEnvironmentStringsW () returned 0x797cc8*
	[0187.993] GetProcessHeap () returned 0x790000
	[0187.993] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0xa1a) returned 0x799118
	[0187.993] FreeEnvironmentStringsA (penv="A") returned 1
	[0187.993] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0187.994] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0187.994] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0187.994] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0187.994] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0187.994] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0187.994] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0187.994] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0187.994] RegCloseKey (hKey=0x88) returned 0x0
	[0187.994] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0187.994] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0187.994] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0187.994] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0187.994] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0187.995] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0187.995] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0187.995] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0187.995] RegCloseKey (hKey=0x88) returned 0x0
	[0187.995] time (in: timer=0x0 | out: timer=0x0) returned 0x62344246
	[0187.995] srand (_Seed=0x62344246) 
	[0187.995] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im thunderbird.exe \""
	[0187.995] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im thunderbird.exe \""
	[0187.995] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0187.995] GetProcessHeap () returned 0x790000
	[0187.995] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0x210) returned 0x799b40
	[0187.995] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x799b48, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0187.996] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0187.996] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0187.996] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0187.996] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0187.996] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0187.996] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0187.996] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0187.996] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0187.996] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0187.996] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0187.996] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0187.996] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0187.996] GetProcessHeap () returned 0x790000
	[0187.997] RtlFreeHeap (HeapHandle=0x790000, Flags=0x0, BaseAddress=0x7986f0) returned 1
	[0187.997] GetEnvironmentStringsW () returned 0x797cc8*
	[0187.997] GetProcessHeap () returned 0x790000
	[0187.997] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0xa32) returned 0x79a798
	[0187.997] FreeEnvironmentStringsA (penv="A") returned 1
	[0187.997] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b
	[0187.997] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0187.997] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0187.998] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0187.998] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0187.998] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0187.998] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0187.998] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0187.998] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0187.998] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0187.998] GetProcessHeap () returned 0x790000
	[0187.998] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0x44) returned 0x7905c8
	[0187.998] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0187.999] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19fc4c*="Desktop") returned 0x1d
	[0187.999] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0187.999] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x790618
	[0187.999] FindClose (in: hFindFile=0x790618 | out: hFindFile=0x790618) returned 1
	[0187.999] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x790618
	[0187.999] FindClose (in: hFindFile=0x790618 | out: hFindFile=0x790618) returned 1
	[0187.999] _wcsnicmp (_String1="RDHJ0C~1", _String2="RDhJ0CNFevzX", _MaxCount=0xc) returned 16
	[0187.999] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x790618
	[0188.000] FindClose (in: hFindFile=0x790618 | out: hFindFile=0x790618) returned 1
	[0188.000] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0188.000] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1
	[0188.000] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 1
	[0188.000] GetProcessHeap () returned 0x790000
	[0188.000] RtlFreeHeap (HeapHandle=0x790000, Flags=0x0, BaseAddress=0x79a798) returned 1
	[0188.000] GetEnvironmentStringsW () returned 0x797cc8*
	[0188.000] GetProcessHeap () returned 0x790000
	[0188.000] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0xa76) returned 0x799d58
	[0188.000] FreeEnvironmentStringsA (penv="=") returned 1
	[0188.001] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0188.001] GetProcessHeap () returned 0x790000
	[0188.001] RtlFreeHeap (HeapHandle=0x790000, Flags=0x0, BaseAddress=0x7905c8) returned 1
	[0188.001] GetProcessHeap () returned 0x790000
	[0188.001] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0x400e) returned 0x79bc58
	[0188.002] GetProcessHeap () returned 0x790000
	[0188.002] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0x52) returned 0x79a7d8
	[0188.002] GetProcessHeap () returned 0x790000
	[0188.002] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0x4008) returned 0x79fc70
	[0188.002] GetProcessHeap () returned 0x790000
	[0188.002] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0x4008) returned 0x7a3c80
	[0188.003] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0188.004] GetProcessHeap () returned 0x790000
	[0188.004] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0x418) returned 0x79a838
	[0188.004] SetErrorMode (uMode=0x0) returned 0x8003
	[0188.004] SetErrorMode (uMode=0x1) returned 0x0
	[0188.004] GetFullPathNameW (in: lpFileName="taskkill \\f \\.", nBufferLength=0x208, lpBuffer=0x79a840, lpFilePart=0x19fbac | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f", lpFilePart=0x19fbac*="f") returned 0x29
	[0188.004] SetErrorMode (uMode=0x8003) returned 0x1
	[0188.004] GetProcessHeap () returned 0x790000
	[0188.004] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79a838, Size=0x84) returned 0x79a838
	[0188.004] GetProcessHeap () returned 0x790000
	[0188.004] RtlSizeHeap (HeapHandle=0x790000, Flags=0x0, MemoryPointer=0x79a838) returned 0x84
	[0188.004] NeedCurrentDirectoryForExePathW (ExeName="taskkill \\f \\.") returned 1
	[0188.005] GetProcessHeap () returned 0x790000
	[0188.005] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0x62) returned 0x79a8c8
	[0188.005] GetProcessHeap () returned 0x790000
	[0188.005] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0xb8) returned 0x79a938
	[0188.005] GetProcessHeap () returned 0x790000
	[0188.005] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79a938, Size=0x62) returned 0x79a938
	[0188.005] GetProcessHeap () returned 0x790000
	[0188.005] RtlSizeHeap (HeapHandle=0x790000, Flags=0x0, MemoryPointer=0x79a938) returned 0x62
	[0188.005] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0188.005] GetProcessHeap () returned 0x790000
	[0188.005] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0xe0) returned 0x79a9a8
	[0188.009] GetProcessHeap () returned 0x790000
	[0188.009] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79a9a8, Size=0x76) returned 0x79a9a8
	[0188.009] GetProcessHeap () returned 0x790000
	[0188.009] RtlSizeHeap (HeapHandle=0x790000, Flags=0x0, MemoryPointer=0x79a9a8) returned 0x76
	[0188.009] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0188.010] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f\\im thunderbird.exe ", fInfoLevelId=0x1, lpFindFileData=0x19f958, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f958) returned 0xffffffff
	[0188.010] GetLastError () returned 0x3
	[0188.010] GetProcessHeap () returned 0x790000
	[0188.011] RtlFreeHeap (HeapHandle=0x790000, Flags=0x0, BaseAddress=0x79fc70) returned 1
	[0188.011] GetProcessHeap () returned 0x790000
	[0188.011] RtlFreeHeap (HeapHandle=0x790000, Flags=0x0, BaseAddress=0x7a3c80) returned 1
	[0188.011] GetProcessHeap () returned 0x790000
	[0188.011] RtlFreeHeap (HeapHandle=0x790000, Flags=0x0, BaseAddress=0x79bc58) returned 1
	[0188.012] GetConsoleOutputCP () returned 0x1b5
	[0188.014] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0188.014] GetUserDefaultLCID () returned 0x409
	[0188.015] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x13d34a0, cchData=8 | out: lpLCData=":") returned 2
	[0188.015] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0188.015] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0188.015] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2
	[0188.015] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x13d34b0, cchData=8 | out: lpLCData="/") returned 2
	[0188.015] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x13d3500, cchData=32 | out: lpLCData="Mon") returned 4
	[0188.016] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x13d3540, cchData=32 | out: lpLCData="Tue") returned 4
	[0188.016] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x13d3580, cchData=32 | out: lpLCData="Wed") returned 4
	[0188.016] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x13d35c0, cchData=32 | out: lpLCData="Thu") returned 4
	[0188.016] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x13d3600, cchData=32 | out: lpLCData="Fri") returned 4
	[0188.016] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x13d3640, cchData=32 | out: lpLCData="Sat") returned 4
	[0188.016] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x13d3680, cchData=32 | out: lpLCData="Sun") returned 4
	[0188.016] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x13d34c0, cchData=8 | out: lpLCData=".") returned 2
	[0188.016] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x13d34e0, cchData=8 | out: lpLCData=",") returned 2
	[0188.016] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0188.018] GetProcessHeap () returned 0x790000
	[0188.018] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x20c) returned 0x79aa70
	[0188.018] GetConsoleTitleW (in: lpConsoleTitle=0x79aa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0188.020] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0188.020] GetProcAddress (hModule=0x75600000, lpProcName="CopyFileExW") returned 0x7561ffc0
	[0188.021] GetProcAddress (hModule=0x75600000, lpProcName="IsDebuggerPresent") returned 0x7561b0b0
	[0188.021] GetProcAddress (hModule=0x75600000, lpProcName="SetConsoleInputExeNameW") returned 0x7559b440
	[0188.021] GetProcessHeap () returned 0x790000
	[0188.021] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0x400a) returned 0x79bc58
	[0188.021] GetProcessHeap () returned 0x790000
	[0188.022] RtlFreeHeap (HeapHandle=0x790000, Flags=0x0, BaseAddress=0x79bc58) returned 1
	[0188.023] _wcsicmp (_String1="taskkill", _String2=")") returned 75
	[0188.023] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14
	[0188.023] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14
	[0188.023] _wcsicmp (_String1="IF", _String2="taskkill") returned -11
	[0188.023] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11
	[0188.023] _wcsicmp (_String1="REM", _String2="taskkill") returned -2
	[0188.023] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2
	[0188.023] GetProcessHeap () returned 0x790000
	[0188.023] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0x58) returned 0x79ac88
	[0188.023] GetProcessHeap () returned 0x790000
	[0188.023] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0x1a) returned 0x790578
	[0188.023] GetProcessHeap () returned 0x790000
	[0188.024] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0x3a) returned 0x79ace8
	[0188.025] GetConsoleTitleW (in: lpConsoleTitle=0x19fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0188.026] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0188.026] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0188.026] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0188.026] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0188.027] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0188.027] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0188.027] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0188.027] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0188.027] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0188.027] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0188.027] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0188.027] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0188.027] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0188.027] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0188.027] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0188.027] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0188.027] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0188.027] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0188.027] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0188.027] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0188.027] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0188.027] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0188.027] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0188.027] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0188.027] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0188.027] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0188.027] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0188.027] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0188.027] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0188.028] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0188.028] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0188.028] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0188.028] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0188.028] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0188.028] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0188.028] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0188.028] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0188.028] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0188.028] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0188.028] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0188.028] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0188.028] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0188.028] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0188.028] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0188.028] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0188.028] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0188.028] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0188.028] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0188.028] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0188.028] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0188.028] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0188.028] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0188.028] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0188.028] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0188.028] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0188.028] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0188.029] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0188.029] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0188.029] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0188.029] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0188.029] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0188.029] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0188.029] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0188.029] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0188.029] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0188.029] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0188.029] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0188.029] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0188.029] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0188.029] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0188.029] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0188.029] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0188.029] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0188.029] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0188.029] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0188.029] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0188.029] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0188.029] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0188.029] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0188.029] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0188.029] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0188.029] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0188.029] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0188.029] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0188.029] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14
	[0188.029] _wcsicmp (_String1="taskkill", _String2="IF") returned 11
	[0188.030] _wcsicmp (_String1="taskkill", _String2="REM") returned 2
	[0188.030] GetProcessHeap () returned 0x790000
	[0188.030] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0x210) returned 0x79ad30
	[0188.030] GetProcessHeap () returned 0x790000
	[0188.030] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0x4c) returned 0x79af48
	[0188.030] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0188.031] GetProcessHeap () returned 0x790000
	[0188.031] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0x418) returned 0x7905c8
	[0188.031] SetErrorMode (uMode=0x0) returned 0x8003
	[0188.031] SetErrorMode (uMode=0x1) returned 0x0
	[0188.031] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x7905d0, lpFilePart=0x19f57c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19f57c*="Desktop") returned 0x1d
	[0188.031] SetErrorMode (uMode=0x8003) returned 0x1
	[0188.031] GetProcessHeap () returned 0x790000
	[0188.031] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7905c8, Size=0x56) returned 0x7905c8
	[0188.031] GetProcessHeap () returned 0x790000
	[0188.031] RtlSizeHeap (HeapHandle=0x790000, Flags=0x0, MemoryPointer=0x7905c8) returned 0x56
	[0188.031] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0188.031] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0188.031] GetProcessHeap () returned 0x790000
	[0188.031] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0x110) returned 0x79afa0
	[0188.031] GetProcessHeap () returned 0x790000
	[0188.031] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0x218) returned 0x790628
	[0188.036] GetProcessHeap () returned 0x790000
	[0188.036] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x790628, Size=0x112) returned 0x790628
	[0188.036] GetProcessHeap () returned 0x790000
	[0188.036] RtlSizeHeap (HeapHandle=0x790000, Flags=0x0, MemoryPointer=0x790628) returned 0x112
	[0188.036] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0188.036] GetProcessHeap () returned 0x790000
	[0188.036] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0xe0) returned 0x79b0b8
	[0188.039] GetProcessHeap () returned 0x790000
	[0188.039] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x79b0b8, Size=0x76) returned 0x79b0b8
	[0188.039] GetProcessHeap () returned 0x790000
	[0188.039] RtlSizeHeap (HeapHandle=0x790000, Flags=0x0, MemoryPointer=0x79b0b8) returned 0x76
	[0188.039] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0188.040] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0188.041] GetLastError () returned 0x2
	[0188.041] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0188.041] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x79b138
	[0188.041] GetProcessHeap () returned 0x790000
	[0188.041] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x14) returned 0x797430
	[0188.041] FindClose (in: hFindFile=0x79b138 | out: hFindFile=0x79b138) returned 1
	[0188.042] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0188.042] GetLastError () returned 0x2
	[0188.042] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x79b138
	[0188.042] GetProcessHeap () returned 0x790000
	[0188.042] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x797430, Size=0x4) returned 0x79b178
	[0188.042] FindClose (in: hFindFile=0x79b138 | out: hFindFile=0x79b138) returned 1
	[0188.042] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0188.042] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0188.042] GetConsoleTitleW (in: lpConsoleTitle=0x19f7fc, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0188.044] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f728, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f70c | out: lpAttributeList=0x19f728, lpSize=0x19f70c) returned 1
	[0188.044] UpdateProcThreadAttribute (in: lpAttributeList=0x19f728, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f714, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f728, lpPreviousValue=0x0) returned 1
	[0188.044] GetStartupInfoW (in: lpStartupInfo=0x19f760 | out: lpStartupInfo=0x19f760*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x140, hStdOutput=0x144, hStdError=0x150)) 
	[0188.044] GetProcessHeap () returned 0x790000
	[0188.044] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0x18) returned 0x7975b0
	[0188.044] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0188.044] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0188.044] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0188.044] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0188.044] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0188.044] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0188.044] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0188.044] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0188.045] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0188.045] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0188.045] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0188.045] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0188.045] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0188.045] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0188.045] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0188.045] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0188.045] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0188.045] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0188.045] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0188.045] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0188.045] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0188.045] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0188.045] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0188.045] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0188.045] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0188.045] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0188.045] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0188.045] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0188.045] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0188.045] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0188.045] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0188.045] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0188.045] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0188.045] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0188.045] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0188.045] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0188.046] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0188.046] GetProcessHeap () returned 0x790000
	[0188.046] RtlFreeHeap (HeapHandle=0x790000, Flags=0x0, BaseAddress=0x7975b0) returned 1
	[0188.046] GetProcessHeap () returned 0x790000
	[0188.046] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0xa) returned 0x79b138
	[0188.046] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1
	[0188.049] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill  /f /im thunderbird.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x19f6b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill  /f /im thunderbird.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f6fc | out: lpCommandLine="taskkill  /f /im thunderbird.exe ", lpProcessInformation=0x19f6fc*(hProcess=0x9c, hThread=0x98, dwProcessId=0xf18, dwThreadId=0x1c4)) returned 1
	[0188.078] CloseHandle (hObject=0x98) returned 1
	[0188.078] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0188.078] GetProcessHeap () returned 0x790000
	[0188.078] RtlFreeHeap (HeapHandle=0x790000, Flags=0x0, BaseAddress=0x799d58) returned 1
	[0188.079] GetEnvironmentStringsW () returned 0x799d58*
	[0188.079] GetProcessHeap () returned 0x790000
	[0188.079] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0xa76) returned 0x797cc8
	[0188.079] FreeEnvironmentStringsA (penv="=") returned 1
	[0188.079] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0
	[0189.219] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x19f694 | out: lpExitCode=0x19f694*=0x0) returned 1
	[0189.219] CloseHandle (hObject=0x9c) returned 1
	[0189.219] _vsnwprintf (in: _Buffer=0x19f77c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f69c | out: _Buffer="00000000") returned 8
	[0189.219] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1
	[0189.220] GetProcessHeap () returned 0x790000
	[0189.220] RtlFreeHeap (HeapHandle=0x790000, Flags=0x0, BaseAddress=0x797cc8) returned 1
	[0189.220] GetEnvironmentStringsW () returned 0x79b188*
	[0189.221] GetProcessHeap () returned 0x790000
	[0189.221] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0xa9c) returned 0x797cc8
	[0189.221] FreeEnvironmentStringsA (penv="=") returned 1
	[0189.221] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0189.221] GetProcessHeap () returned 0x790000
	[0189.221] RtlFreeHeap (HeapHandle=0x790000, Flags=0x0, BaseAddress=0x797cc8) returned 1
	[0189.221] GetEnvironmentStringsW () returned 0x79b188*
	[0189.221] GetProcessHeap () returned 0x790000
	[0189.221] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x8, Size=0xa9c) returned 0x797cc8
	[0189.221] FreeEnvironmentStringsA (penv="=") returned 1
	[0189.221] GetProcessHeap () returned 0x790000
	[0189.221] RtlFreeHeap (HeapHandle=0x790000, Flags=0x0, BaseAddress=0x79b138) returned 1
	[0189.221] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f728 | out: lpAttributeList=0x19f728) 
	[0189.221] _get_osfhandle (_FileHandle=1) returned 0x144
	[0189.221] SetConsoleMode (hConsoleHandle=0x144, dwMode=0x0) returned 0
	[0189.221] _get_osfhandle (_FileHandle=1) returned 0x144
	[0189.221] GetConsoleMode (in: hConsoleHandle=0x144, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0189.221] _get_osfhandle (_FileHandle=0) returned 0x140
	[0189.221] GetConsoleMode (in: hConsoleHandle=0x140, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0189.221] GetConsoleOutputCP () returned 0x1b5
	[0189.223] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0189.223] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0189.225] exit (_Code=0) 

Thread:
	id = 372
	os_tid = 0x918


Process:
	id = "76"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\syswow64\\taskkill.exe"
	page_root = "0x53b07000"
	os_pid = "0xf18"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "75"
	os_parent_pid = "0x868"
	cmd_line = "taskkill  /f /im thunderbird.exe "
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 5363
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 5364
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 5365
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 5366
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 5367
	        start_va = 0xa0000
	          end_va = 0xdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 5368
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 5369
	        start_va = 0x13b0000
	          end_va = 0x13c5fff
	       monitored = 0
	     entry_point = 0x13bde80
	     region_type = mapped_file
	            name = "taskkill.exe"
	        filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe")

Region:
	              id = 5370
	        start_va = 0x13d0000
	          end_va = 0x53cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000013d0000"
	        filename = ""

Region:
	              id = 5371
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 5372
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 5373
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 5374
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 5375
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 5376
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 5377
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 5378
	        start_va = 0xe0000
	          end_va = 0xe3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 5379
	        start_va = 0xf0000
	          end_va = 0xf0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 5380
	        start_va = 0x100000
	          end_va = 0x101fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 5381
	        start_va = 0x5a0000
	          end_va = 0x5affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005a0000"
	        filename = ""

Region:
	              id = 5382
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 5383
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 5384
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 5385
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 5386
	        start_va = 0x5b0000
	          end_va = 0x89ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005b0000"
	        filename = ""

Region:
	              id = 5387
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 5388
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 5389
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 5390
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 5391
	        start_va = 0x110000
	          end_va = 0x1cdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 5392
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 5393
	        start_va = 0x74650000
	          end_va = 0x746cafff
	       monitored = 0
	     entry_point = 0x7466e970
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 5394
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 5395
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 5396
	        start_va = 0x440000
	          end_va = 0x47ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000440000"
	        filename = ""

Region:
	              id = 5397
	        start_va = 0x76ae0000
	          end_va = 0x76b23fff
	       monitored = 0
	     entry_point = 0x76af9d80
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 5398
	        start_va = 0x75260000
	          end_va = 0x7530cfff
	       monitored = 0
	     entry_point = 0x75274f00
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 5399
	        start_va = 0x74450000
	          end_va = 0x7446dfff
	       monitored = 0
	     entry_point = 0x7445b640
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 5400
	        start_va = 0x74440000
	          end_va = 0x74449fff
	       monitored = 0
	     entry_point = 0x74442a00
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 5401
	        start_va = 0x74590000
	          end_va = 0x745e7fff
	       monitored = 0
	     entry_point = 0x745d25c0
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 5402
	        start_va = 0x77450000
	          end_va = 0x77596fff
	       monitored = 0
	     entry_point = 0x77461cf0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 5403
	        start_va = 0x76b30000
	          end_va = 0x76c7efff
	       monitored = 0
	     entry_point = 0x76be6820
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 5404
	        start_va = 0x6cc90000
	          end_va = 0x6cc97fff
	       monitored = 0
	     entry_point = 0x6cc917b0
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 5405
	        start_va = 0x6cc70000
	          end_va = 0x6cc85fff
	       monitored = 0
	     entry_point = 0x6cc721d0
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")

Region:
	              id = 5406
	        start_va = 0x753c0000
	          end_va = 0x75451fff
	       monitored = 0
	     entry_point = 0x753f8cf0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 5407
	        start_va = 0x77290000
	          end_va = 0x7744cfff
	       monitored = 0
	     entry_point = 0x77372a10
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")

Region:
	              id = 5408
	        start_va = 0x75310000
	          end_va = 0x7536efff
	       monitored = 0
	     entry_point = 0x75314af0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 5409
	        start_va = 0x6cc30000
	          end_va = 0x6cc6efff
	       monitored = 0
	     entry_point = 0x6cc446c0
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll")

Region:
	              id = 5410
	        start_va = 0x6caf0000
	          end_va = 0x6cc2efff
	       monitored = 0
	     entry_point = 0x6cb1d880
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll")

Region:
	              id = 5411
	        start_va = 0x77240000
	          end_va = 0x77284fff
	       monitored = 0
	     entry_point = 0x7725de90
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 5412
	        start_va = 0x6cad0000
	          end_va = 0x6caebfff
	       monitored = 0
	     entry_point = 0x6cad4720
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")

Region:
	              id = 5413
	        start_va = 0x6cac0000
	          end_va = 0x6cac9fff
	       monitored = 0
	     entry_point = 0x6cac28d0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")

Region:
	              id = 5414
	        start_va = 0x480000
	          end_va = 0x4dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 5415
	        start_va = 0x1d0000
	          end_va = 0x1f9fff
	       monitored = 0
	     entry_point = 0x1d5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 5416
	        start_va = 0x5b0000
	          end_va = 0x737fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000005b0000"
	        filename = ""

Region:
	              id = 5417
	        start_va = 0x7a0000
	          end_va = 0x89ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000007a0000"
	        filename = ""

Region:
	              id = 5418
	        start_va = 0x74ea0000
	          end_va = 0x74ecafff
	       monitored = 0
	     entry_point = 0x74ea5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 5419
	        start_va = 0x8a0000
	          end_va = 0xa20fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000008a0000"
	        filename = ""

Region:
	              id = 5420
	        start_va = 0x53d0000
	          end_va = 0x67cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000053d0000"
	        filename = ""

Region:
	              id = 5421
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 5422
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001d0000"
	        filename = ""

Region:
	              id = 5423
	        start_va = 0x1e0000
	          end_va = 0x1e4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taskkill.exe.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui")

Region:
	              id = 5424
	        start_va = 0x1f0000
	          end_va = 0x1f0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001f0000"
	        filename = ""

Region:
	              id = 5425
	        start_va = 0x480000
	          end_va = 0x480fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 5426
	        start_va = 0x4d0000
	          end_va = 0x4dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004d0000"
	        filename = ""

Region:
	              id = 5427
	        start_va = 0xa30000
	          end_va = 0xd66fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 5428
	        start_va = 0xd70000
	          end_va = 0xe59fff
	       monitored = 0
	     entry_point = 0xdad650
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 5429
	        start_va = 0x490000
	          end_va = 0x493fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000490000"
	        filename = ""

Region:
	              id = 5430
	        start_va = 0xd70000
	          end_va = 0xe4ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 5431
	        start_va = 0x76e20000
	          end_va = 0x76e2bfff
	       monitored = 0
	     entry_point = 0x76e23930
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")

Region:
	              id = 5432
	        start_va = 0x4a0000
	          end_va = 0x4a0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004a0000"
	        filename = ""

Region:
	              id = 5433
	        start_va = 0x76c80000
	          end_va = 0x76d03fff
	       monitored = 0
	     entry_point = 0x76ca6220
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 5434
	        start_va = 0x4b0000
	          end_va = 0x4b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004b0000"
	        filename = ""

Region:
	              id = 5435
	        start_va = 0x6cab0000
	          end_va = 0x6cabcfff
	       monitored = 0
	     entry_point = 0x6cab3520
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 5436
	        start_va = 0x6ca40000
	          end_va = 0x6caa6fff
	       monitored = 0
	     entry_point = 0x6ca5b610
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 5437
	        start_va = 0x740f0000
	          end_va = 0x7410afff
	       monitored = 0
	     entry_point = 0x740f9050
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 5438
	        start_va = 0x6c9f0000
	          end_va = 0x6ca33fff
	       monitored = 0
	     entry_point = 0x6ca0aaf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")

Region:
	              id = 5439
	        start_va = 0x4e0000
	          end_va = 0x51ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004e0000"
	        filename = ""

Region:
	              id = 5440
	        start_va = 0x520000
	          end_va = 0x55ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000520000"
	        filename = ""

Region:
	              id = 5441
	        start_va = 0x560000
	          end_va = 0x59ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000560000"
	        filename = ""

Region:
	              id = 5442
	        start_va = 0x740000
	          end_va = 0x77ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000740000"
	        filename = ""

Region:
	              id = 5443
	        start_va = 0xe50000
	          end_va = 0xe8ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e50000"
	        filename = ""

Region:
	              id = 5444
	        start_va = 0xe90000
	          end_va = 0xecffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e90000"
	        filename = ""

Region:
	              id = 5445
	        start_va = 0x6c9d0000
	          end_va = 0x6c9e0fff
	       monitored = 0
	     entry_point = 0x6c9d8fa0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 5446
	        start_va = 0x6c910000
	          end_va = 0x6c9cefff
	       monitored = 0
	     entry_point = 0x6c941e80
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 5448
	        start_va = 0x4c0000
	          end_va = 0x4c5fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004c0000"
	        filename = ""


Thread:
	id = 373
	os_tid = 0x1c4


Thread:
	id = 374
	os_tid = 0x4b4


Thread:
	id = 375
	os_tid = 0xc1c


Thread:
	id = 376
	os_tid = 0x1398


Thread:
	id = 377
	os_tid = 0x860


Process:
	id = "77"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x5ca6a000"
	os_pid = "0xc2c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x614"
	cmd_line = "cmd.exe /c \"taskkill /f /im visio.exe \""
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 5451
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 5452
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 5453
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 5454
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 5455
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 5456
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 5457
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 5458
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 5459
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 5460
	        start_va = 0x13a0000
	          end_va = 0x13f1fff
	       monitored = 1
	     entry_point = 0x13b4fd0
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")

Region:
	              id = 5461
	        start_va = 0x1400000
	          end_va = 0x53fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001400000"
	        filename = ""

Region:
	              id = 5462
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 5463
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 5464
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 5465
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 5466
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 5467
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 5468
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 5469
	        start_va = 0x5a0000
	          end_va = 0x5affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005a0000"
	        filename = ""

Region:
	              id = 5470
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 5471
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 5472
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 5473
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 5474
	        start_va = 0x400000
	          end_va = 0x52ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 5475
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 5476
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 5477
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 5478
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 5479
	        start_va = 0x5b0000
	          end_va = 0x66dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 5480
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 5481
	        start_va = 0x530000
	          end_va = 0x56ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000530000"
	        filename = ""

Region:
	              id = 5482
	        start_va = 0x670000
	          end_va = 0x76ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000670000"
	        filename = ""

Region:
	              id = 5483
	        start_va = 0x770000
	          end_va = 0x84ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000770000"
	        filename = ""

Region:
	              id = 5484
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 5485
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 5486
	        start_va = 0x850000
	          end_va = 0xb86fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 378
	os_tid = 0x394

	[0189.456] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000
	[0189.456] __set_app_type (_Type=0x1) 
	[0189.456] __p__fmode () returned 0x74974d6c
	[0189.456] __p__commode () returned 0x74975b1c
	[0189.456] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13b5200) returned 0x0
	[0189.457] __getmainargs (in: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0, _DoWildCard=0, _StartInfo=0x13c60fc | out: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0) returned 0
	[0189.457] GetCurrentThreadId () returned 0x394
	[0189.457] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x394) returned 0x78
	[0189.457] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0189.457] GetProcAddress (hModule=0x75600000, lpProcName="SetThreadUILanguage") returned 0x75642510
	[0189.457] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0189.468] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0189.468] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2
	[0189.469] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0189.471] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0189.471] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0189.471] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0189.471] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0189.471] GetConsoleOutputCP () returned 0x1b5
	[0189.480] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0189.481] SetConsoleCtrlHandler (HandlerRoutine=0x13c0e40, Add=1) returned 1
	[0189.481] _get_osfhandle (_FileHandle=1) returned 0x140
	[0189.481] SetConsoleMode (hConsoleHandle=0x140, dwMode=0x0) returned 0
	[0189.481] _get_osfhandle (_FileHandle=1) returned 0x140
	[0189.481] GetConsoleMode (in: hConsoleHandle=0x140, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0189.481] _get_osfhandle (_FileHandle=0) returned 0x13c
	[0189.481] GetConsoleMode (in: hConsoleHandle=0x13c, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0189.481] GetEnvironmentStringsW () returned 0x437cb0*
	[0189.481] GetProcessHeap () returned 0x430000
	[0189.481] RtlAllocateHeap (HeapHandle=0x430000, Flags=0x8, Size=0xa1a) returned 0x4386d8
	[0189.482] FreeEnvironmentStringsA (penv="A") returned 1
	[0189.482] GetProcessHeap () returned 0x430000
	[0189.482] RtlAllocateHeap (HeapHandle=0x430000, Flags=0x8, Size=0x4) returned 0x430550
	[0189.482] GetEnvironmentStringsW () returned 0x437cb0*
	[0189.482] GetProcessHeap () returned 0x430000
	[0189.482] RtlAllocateHeap (HeapHandle=0x430000, Flags=0x8, Size=0xa1a) returned 0x439100
	[0189.482] FreeEnvironmentStringsA (penv="A") returned 1
	[0189.482] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0189.482] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0189.482] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0189.482] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0189.483] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0189.483] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0189.483] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0189.483] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0189.483] RegCloseKey (hKey=0x88) returned 0x0
	[0189.483] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0189.483] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0189.483] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0189.483] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0189.484] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0189.484] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0189.484] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0189.484] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0189.484] RegCloseKey (hKey=0x88) returned 0x0
	[0189.484] time (in: timer=0x0 | out: timer=0x0) returned 0x62344247
	[0189.484] srand (_Seed=0x62344247) 
	[0189.484] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im visio.exe \""
	[0189.484] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im visio.exe \""
	[0189.484] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0189.484] GetProcessHeap () returned 0x430000
	[0189.484] RtlAllocateHeap (HeapHandle=0x430000, Flags=0x8, Size=0x210) returned 0x439b28
	[0189.484] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x439b30, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0189.485] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0189.485] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0189.485] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0189.485] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0189.485] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0189.485] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0189.485] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0189.485] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0189.485] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0189.485] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0189.485] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0189.485] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0189.486] GetProcessHeap () returned 0x430000
	[0189.486] RtlFreeHeap (HeapHandle=0x430000, Flags=0x0, BaseAddress=0x4386d8) returned 1
	[0189.486] GetEnvironmentStringsW () returned 0x437cb0*
	[0189.486] GetProcessHeap () returned 0x430000
	[0189.486] RtlAllocateHeap (HeapHandle=0x430000, Flags=0x8, Size=0xa32) returned 0x43a780
	[0189.487] FreeEnvironmentStringsA (penv="A") returned 1
	[0189.487] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b
	[0189.487] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0189.487] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0189.487] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0189.487] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0189.487] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0189.487] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0189.510] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0189.511] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0189.511] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0189.511] GetProcessHeap () returned 0x430000
	[0189.511] RtlAllocateHeap (HeapHandle=0x430000, Flags=0x8, Size=0x44) returned 0x4305c8
	[0189.511] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0189.511] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19fc4c*="Desktop") returned 0x1d
	[0189.511] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0189.512] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x430618
	[0189.512] FindClose (in: hFindFile=0x430618 | out: hFindFile=0x430618) returned 1
	[0189.512] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x430618
	[0189.512] FindClose (in: hFindFile=0x430618 | out: hFindFile=0x430618) returned 1
	[0189.512] _wcsnicmp (_String1="RDHJ0C~1", _String2="RDhJ0CNFevzX", _MaxCount=0xc) returned 16
	[0189.512] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x430618
	[0189.513] FindClose (in: hFindFile=0x430618 | out: hFindFile=0x430618) returned 1
	[0189.513] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0189.513] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1
	[0189.513] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 1
	[0189.513] GetProcessHeap () returned 0x430000
	[0189.513] RtlFreeHeap (HeapHandle=0x430000, Flags=0x0, BaseAddress=0x43a780) returned 1
	[0189.514] GetEnvironmentStringsW () returned 0x437cb0*
	[0189.514] GetProcessHeap () returned 0x430000
	[0189.514] RtlAllocateHeap (HeapHandle=0x430000, Flags=0x8, Size=0xa76) returned 0x439d40
	[0189.514] FreeEnvironmentStringsA (penv="=") returned 1
	[0189.514] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0189.514] GetProcessHeap () returned 0x430000
	[0189.514] RtlFreeHeap (HeapHandle=0x430000, Flags=0x0, BaseAddress=0x4305c8) returned 1
	[0189.514] GetProcessHeap () returned 0x430000
	[0189.514] RtlAllocateHeap (HeapHandle=0x430000, Flags=0x8, Size=0x400e) returned 0x43bc40
	[0189.515] GetProcessHeap () returned 0x430000
	[0189.515] RtlAllocateHeap (HeapHandle=0x430000, Flags=0x8, Size=0x46) returned 0x43a7c0
	[0189.515] GetProcessHeap () returned 0x430000
	[0189.515] RtlAllocateHeap (HeapHandle=0x430000, Flags=0x8, Size=0x4008) returned 0x43fc58
	[0189.516] GetProcessHeap () returned 0x430000
	[0189.516] RtlAllocateHeap (HeapHandle=0x430000, Flags=0x8, Size=0x4008) returned 0x443c68
	[0189.517] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0189.518] GetProcessHeap () returned 0x430000
	[0189.518] RtlAllocateHeap (HeapHandle=0x430000, Flags=0x8, Size=0x418) returned 0x43a810
	[0189.518] SetErrorMode (uMode=0x0) returned 0x8003
	[0189.518] SetErrorMode (uMode=0x1) returned 0x0
	[0189.518] GetFullPathNameW (in: lpFileName="taskkill \\f \\.", nBufferLength=0x208, lpBuffer=0x43a818, lpFilePart=0x19fbac | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f", lpFilePart=0x19fbac*="f") returned 0x29
	[0189.519] SetErrorMode (uMode=0x8003) returned 0x1
	[0189.519] GetProcessHeap () returned 0x430000
	[0189.519] RtlReAllocateHeap (Heap=0x430000, Flags=0x0, Ptr=0x43a810, Size=0x78) returned 0x43a810
	[0189.519] GetProcessHeap () returned 0x430000
	[0189.519] RtlSizeHeap (HeapHandle=0x430000, Flags=0x0, MemoryPointer=0x43a810) returned 0x78
	[0189.519] NeedCurrentDirectoryForExePathW (ExeName="taskkill \\f \\.") returned 1
	[0189.519] GetProcessHeap () returned 0x430000
	[0189.519] RtlAllocateHeap (HeapHandle=0x430000, Flags=0x8, Size=0x62) returned 0x43a890
	[0189.519] GetProcessHeap () returned 0x430000
	[0189.519] RtlAllocateHeap (HeapHandle=0x430000, Flags=0x8, Size=0xb8) returned 0x43a900
	[0189.519] GetProcessHeap () returned 0x430000
	[0189.519] RtlReAllocateHeap (Heap=0x430000, Flags=0x0, Ptr=0x43a900, Size=0x62) returned 0x43a900
	[0189.519] GetProcessHeap () returned 0x430000
	[0189.519] RtlSizeHeap (HeapHandle=0x430000, Flags=0x0, MemoryPointer=0x43a900) returned 0x62
	[0189.519] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0189.519] GetProcessHeap () returned 0x430000
	[0189.519] RtlAllocateHeap (HeapHandle=0x430000, Flags=0x8, Size=0xe0) returned 0x43a970
	[0189.525] GetProcessHeap () returned 0x430000
	[0189.525] RtlReAllocateHeap (Heap=0x430000, Flags=0x0, Ptr=0x43a970, Size=0x76) returned 0x43a970
	[0189.525] GetProcessHeap () returned 0x430000
	[0189.525] RtlSizeHeap (HeapHandle=0x430000, Flags=0x0, MemoryPointer=0x43a970) returned 0x76
	[0189.525] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0189.526] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f\\im visio.exe ", fInfoLevelId=0x1, lpFindFileData=0x19f958, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f958) returned 0xffffffff
	[0189.526] GetLastError () returned 0x3
	[0189.526] GetProcessHeap () returned 0x430000
	[0189.526] RtlFreeHeap (HeapHandle=0x430000, Flags=0x0, BaseAddress=0x43fc58) returned 1
	[0189.526] GetProcessHeap () returned 0x430000
	[0189.527] RtlFreeHeap (HeapHandle=0x430000, Flags=0x0, BaseAddress=0x443c68) returned 1
	[0189.527] GetProcessHeap () returned 0x430000
	[0189.527] RtlFreeHeap (HeapHandle=0x430000, Flags=0x0, BaseAddress=0x43bc40) returned 1
	[0189.527] GetConsoleOutputCP () returned 0x1b5
	[0189.531] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0189.531] GetUserDefaultLCID () returned 0x409
	[0189.531] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x13d34a0, cchData=8 | out: lpLCData=":") returned 2
	[0189.531] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0189.531] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0189.532] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2
	[0189.532] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x13d34b0, cchData=8 | out: lpLCData="/") returned 2
	[0189.532] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x13d3500, cchData=32 | out: lpLCData="Mon") returned 4
	[0189.532] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x13d3540, cchData=32 | out: lpLCData="Tue") returned 4
	[0189.532] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x13d3580, cchData=32 | out: lpLCData="Wed") returned 4
	[0189.532] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x13d35c0, cchData=32 | out: lpLCData="Thu") returned 4
	[0189.532] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x13d3600, cchData=32 | out: lpLCData="Fri") returned 4
	[0189.532] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x13d3640, cchData=32 | out: lpLCData="Sat") returned 4
	[0189.532] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x13d3680, cchData=32 | out: lpLCData="Sun") returned 4
	[0189.532] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x13d34c0, cchData=8 | out: lpLCData=".") returned 2
	[0189.532] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x13d34e0, cchData=8 | out: lpLCData=",") returned 2
	[0189.532] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0189.534] GetProcessHeap () returned 0x430000
	[0189.534] RtlAllocateHeap (HeapHandle=0x430000, Flags=0x0, Size=0x20c) returned 0x43aa38
	[0189.534] GetConsoleTitleW (in: lpConsoleTitle=0x43aa38, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0189.535] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0189.535] GetProcAddress (hModule=0x75600000, lpProcName="CopyFileExW") returned 0x7561ffc0
	[0189.535] GetProcAddress (hModule=0x75600000, lpProcName="IsDebuggerPresent") returned 0x7561b0b0
	[0189.535] GetProcAddress (hModule=0x75600000, lpProcName="SetConsoleInputExeNameW") returned 0x7559b440
	[0189.545] GetProcessHeap () returned 0x430000
	[0189.546] RtlAllocateHeap (HeapHandle=0x430000, Flags=0x8, Size=0x400a) returned 0x43bc40
	[0189.546] GetProcessHeap () returned 0x430000
	[0189.546] RtlFreeHeap (HeapHandle=0x430000, Flags=0x0, BaseAddress=0x43bc40) returned 1
	[0189.548] _wcsicmp (_String1="taskkill", _String2=")") returned 75
	[0189.548] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14
	[0189.548] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14
	[0189.548] _wcsicmp (_String1="IF", _String2="taskkill") returned -11
	[0189.548] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11
	[0189.548] _wcsicmp (_String1="REM", _String2="taskkill") returned -2
	[0189.548] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2
	[0189.548] GetProcessHeap () returned 0x430000
	[0189.548] RtlAllocateHeap (HeapHandle=0x430000, Flags=0x8, Size=0x58) returned 0x43ac50
	[0189.548] GetProcessHeap () returned 0x430000
	[0189.548] RtlAllocateHeap (HeapHandle=0x430000, Flags=0x8, Size=0x1a) returned 0x430578
	[0189.549] GetProcessHeap () returned 0x430000
	[0189.549] RtlAllocateHeap (HeapHandle=0x430000, Flags=0x8, Size=0x2e) returned 0x43acb0
	[0189.550] GetConsoleTitleW (in: lpConsoleTitle=0x19fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0189.552] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0189.552] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0189.552] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0189.552] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0189.552] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0189.552] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0189.552] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0189.552] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0189.552] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0189.552] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0189.552] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0189.553] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0189.553] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0189.553] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0189.553] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0189.553] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0189.553] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0189.553] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0189.553] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0189.553] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0189.553] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0189.553] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0189.553] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0189.553] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0189.553] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0189.553] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0189.553] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0189.553] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0189.553] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0189.553] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0189.553] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0189.553] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0189.553] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0189.553] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0189.554] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0189.554] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0189.554] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0189.554] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0189.554] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0189.554] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0189.554] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0189.554] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0189.554] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0189.554] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0189.554] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0189.554] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0189.554] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0189.554] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0189.554] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0189.554] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0189.554] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0189.554] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0189.554] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0189.554] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0189.554] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0189.554] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0189.554] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0189.554] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0189.555] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0189.555] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0189.555] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0189.555] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0189.555] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0189.555] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0189.555] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0189.555] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0189.555] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0189.555] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0189.555] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0189.555] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0189.555] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0189.555] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0189.555] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0189.555] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0189.555] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0189.555] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0189.555] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0189.555] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0189.556] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0189.556] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0189.556] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0189.556] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0189.556] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0189.556] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0189.556] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14
	[0189.556] _wcsicmp (_String1="taskkill", _String2="IF") returned 11
	[0189.556] _wcsicmp (_String1="taskkill", _String2="REM") returned 2
	[0189.556] GetProcessHeap () returned 0x430000
	[0189.556] RtlAllocateHeap (HeapHandle=0x430000, Flags=0x8, Size=0x210) returned 0x43ace8
	[0189.556] GetProcessHeap () returned 0x430000
	[0189.556] RtlAllocateHeap (HeapHandle=0x430000, Flags=0x8, Size=0x40) returned 0x43af00
	[0189.557] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0189.557] GetProcessHeap () returned 0x430000
	[0189.557] RtlAllocateHeap (HeapHandle=0x430000, Flags=0x8, Size=0x418) returned 0x4305c8
	[0189.557] SetErrorMode (uMode=0x0) returned 0x8003
	[0189.557] SetErrorMode (uMode=0x1) returned 0x0
	[0189.557] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4305d0, lpFilePart=0x19f57c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19f57c*="Desktop") returned 0x1d
	[0189.557] SetErrorMode (uMode=0x8003) returned 0x1
	[0189.557] GetProcessHeap () returned 0x430000
	[0189.557] RtlReAllocateHeap (Heap=0x430000, Flags=0x0, Ptr=0x4305c8, Size=0x56) returned 0x4305c8
	[0189.558] GetProcessHeap () returned 0x430000
	[0189.558] RtlSizeHeap (HeapHandle=0x430000, Flags=0x0, MemoryPointer=0x4305c8) returned 0x56
	[0189.558] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0189.558] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0189.558] GetProcessHeap () returned 0x430000
	[0189.558] RtlAllocateHeap (HeapHandle=0x430000, Flags=0x8, Size=0x110) returned 0x43af48
	[0189.558] GetProcessHeap () returned 0x430000
	[0189.558] RtlAllocateHeap (HeapHandle=0x430000, Flags=0x8, Size=0x218) returned 0x430628
	[0189.564] GetProcessHeap () returned 0x430000
	[0189.564] RtlReAllocateHeap (Heap=0x430000, Flags=0x0, Ptr=0x430628, Size=0x112) returned 0x430628
	[0189.564] GetProcessHeap () returned 0x430000
	[0189.564] RtlSizeHeap (HeapHandle=0x430000, Flags=0x0, MemoryPointer=0x430628) returned 0x112
	[0189.564] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0189.564] GetProcessHeap () returned 0x430000
	[0189.564] RtlAllocateHeap (HeapHandle=0x430000, Flags=0x8, Size=0xe0) returned 0x43b060
	[0189.568] GetProcessHeap () returned 0x430000
	[0189.568] RtlReAllocateHeap (Heap=0x430000, Flags=0x0, Ptr=0x43b060, Size=0x76) returned 0x43b060
	[0189.568] GetProcessHeap () returned 0x430000
	[0189.568] RtlSizeHeap (HeapHandle=0x430000, Flags=0x0, MemoryPointer=0x43b060) returned 0x76
	[0189.568] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0189.568] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0189.569] GetLastError () returned 0x2
	[0189.569] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0189.569] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x43b0e0
	[0189.569] GetProcessHeap () returned 0x430000
	[0189.569] RtlAllocateHeap (HeapHandle=0x430000, Flags=0x0, Size=0x14) returned 0x4374d8
	[0189.569] FindClose (in: hFindFile=0x43b0e0 | out: hFindFile=0x43b0e0) returned 1
	[0189.569] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0189.570] GetLastError () returned 0x2
	[0189.570] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x43b0e0
	[0189.570] GetProcessHeap () returned 0x430000
	[0189.570] RtlReAllocateHeap (Heap=0x430000, Flags=0x0, Ptr=0x4374d8, Size=0x4) returned 0x43b120
	[0189.570] FindClose (in: hFindFile=0x43b0e0 | out: hFindFile=0x43b0e0) returned 1
	[0189.570] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0189.570] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0189.570] GetConsoleTitleW (in: lpConsoleTitle=0x19f7fc, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0189.572] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f728, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f70c | out: lpAttributeList=0x19f728, lpSize=0x19f70c) returned 1
	[0189.572] UpdateProcThreadAttribute (in: lpAttributeList=0x19f728, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f714, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f728, lpPreviousValue=0x0) returned 1
	[0189.572] GetStartupInfoW (in: lpStartupInfo=0x19f760 | out: lpStartupInfo=0x19f760*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x13c, hStdOutput=0x140, hStdError=0x144)) 
	[0189.572] GetProcessHeap () returned 0x430000
	[0189.572] RtlAllocateHeap (HeapHandle=0x430000, Flags=0x8, Size=0x18) returned 0x4374f8
	[0189.572] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0189.572] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0189.572] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0189.572] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0189.572] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0189.572] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0189.572] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0189.573] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0189.573] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0189.573] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0189.573] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0189.573] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0189.573] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0189.573] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0189.573] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0189.573] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0189.573] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0189.573] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0189.573] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0189.573] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0189.573] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0189.573] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0189.573] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0189.573] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0189.573] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0189.573] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0189.573] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0189.573] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0189.573] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0189.573] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0189.573] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0189.574] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0189.574] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0189.574] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0189.574] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0189.574] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0189.574] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0189.574] GetProcessHeap () returned 0x430000
	[0189.574] RtlFreeHeap (HeapHandle=0x430000, Flags=0x0, BaseAddress=0x4374f8) returned 1
	[0189.574] GetProcessHeap () returned 0x430000
	[0189.574] RtlAllocateHeap (HeapHandle=0x430000, Flags=0x8, Size=0xa) returned 0x43b0e0
	[0189.574] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1
	[0189.577] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill  /f /im visio.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x19f6b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill  /f /im visio.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f6fc | out: lpCommandLine="taskkill  /f /im visio.exe ", lpProcessInformation=0x19f6fc*(hProcess=0x9c, hThread=0x98, dwProcessId=0x22c, dwThreadId=0x3d4)) returned 1
	[0189.601] CloseHandle (hObject=0x98) returned 1
	[0189.601] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0189.601] GetProcessHeap () returned 0x430000
	[0189.602] RtlFreeHeap (HeapHandle=0x430000, Flags=0x0, BaseAddress=0x439d40) returned 1
	[0189.602] GetEnvironmentStringsW () returned 0x439d40*
	[0189.602] GetProcessHeap () returned 0x430000
	[0189.602] RtlAllocateHeap (HeapHandle=0x430000, Flags=0x8, Size=0xa76) returned 0x43bc40
	[0189.602] FreeEnvironmentStringsA (penv="=") returned 1
	[0189.603] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0
	[0190.440] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x19f694 | out: lpExitCode=0x19f694*=0x80) returned 1
	[0190.440] CloseHandle (hObject=0x9c) returned 1
	[0190.440] _vsnwprintf (in: _Buffer=0x19f77c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f69c | out: _Buffer="00000080") returned 8
	[0190.440] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1
	[0190.441] GetProcessHeap () returned 0x430000
	[0190.441] RtlFreeHeap (HeapHandle=0x430000, Flags=0x0, BaseAddress=0x43bc40) returned 1
	[0190.441] GetEnvironmentStringsW () returned 0x43b130*
	[0190.442] GetProcessHeap () returned 0x430000
	[0190.442] RtlAllocateHeap (HeapHandle=0x430000, Flags=0x8, Size=0xa9c) returned 0x43bbd8
	[0190.442] FreeEnvironmentStringsA (penv="=") returned 1
	[0190.442] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0190.442] GetProcessHeap () returned 0x430000
	[0190.442] RtlFreeHeap (HeapHandle=0x430000, Flags=0x0, BaseAddress=0x43bbd8) returned 1
	[0190.442] GetEnvironmentStringsW () returned 0x43b130*
	[0190.442] GetProcessHeap () returned 0x430000
	[0190.442] RtlAllocateHeap (HeapHandle=0x430000, Flags=0x8, Size=0xa9c) returned 0x43bbd8
	[0190.442] FreeEnvironmentStringsA (penv="=") returned 1
	[0190.442] GetProcessHeap () returned 0x430000
	[0190.442] RtlFreeHeap (HeapHandle=0x430000, Flags=0x0, BaseAddress=0x43b0e0) returned 1
	[0190.442] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f728 | out: lpAttributeList=0x19f728) 
	[0190.442] _get_osfhandle (_FileHandle=1) returned 0x140
	[0190.442] SetConsoleMode (hConsoleHandle=0x140, dwMode=0x0) returned 0
	[0190.443] _get_osfhandle (_FileHandle=1) returned 0x140
	[0190.443] GetConsoleMode (in: hConsoleHandle=0x140, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0190.443] _get_osfhandle (_FileHandle=0) returned 0x13c
	[0190.443] GetConsoleMode (in: hConsoleHandle=0x13c, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0190.443] GetConsoleOutputCP () returned 0x1b5
	[0190.444] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0190.444] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0190.445] exit (_Code=128) 

Thread:
	id = 379
	os_tid = 0x230


Process:
	id = "78"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\syswow64\\taskkill.exe"
	page_root = "0x2f58f000"
	os_pid = "0x22c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "77"
	os_parent_pid = "0xc2c"
	cmd_line = "taskkill  /f /im visio.exe "
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 5487
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 5488
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 5489
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 5490
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 5491
	        start_va = 0xa0000
	          end_va = 0xdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 5492
	        start_va = 0xe0000
	          end_va = 0xe3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 5493
	        start_va = 0xf0000
	          end_va = 0xf0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 5494
	        start_va = 0x100000
	          end_va = 0x101fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 5495
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 5496
	        start_va = 0x13b0000
	          end_va = 0x13c5fff
	       monitored = 0
	     entry_point = 0x13bde80
	     region_type = mapped_file
	            name = "taskkill.exe"
	        filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe")

Region:
	              id = 5497
	        start_va = 0x13d0000
	          end_va = 0x53cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000013d0000"
	        filename = ""

Region:
	              id = 5498
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 5499
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 5500
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 5501
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 5502
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 5503
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 5504
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 5505
	        start_va = 0x1e0000
	          end_va = 0x1effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001e0000"
	        filename = ""

Region:
	              id = 5506
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 5507
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 5508
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 5509
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 5510
	        start_va = 0x400000
	          end_va = 0x62ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 5511
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 5512
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 5513
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 5514
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 5515
	        start_va = 0x110000
	          end_va = 0x1cdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 5516
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 5517
	        start_va = 0x74650000
	          end_va = 0x746cafff
	       monitored = 0
	     entry_point = 0x7466e970
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 5518
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 5519
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 5520
	        start_va = 0x440000
	          end_va = 0x47ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000440000"
	        filename = ""

Region:
	              id = 5521
	        start_va = 0x530000
	          end_va = 0x62ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000530000"
	        filename = ""

Region:
	              id = 5522
	        start_va = 0x76ae0000
	          end_va = 0x76b23fff
	       monitored = 0
	     entry_point = 0x76af9d80
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 5523
	        start_va = 0x75260000
	          end_va = 0x7530cfff
	       monitored = 0
	     entry_point = 0x75274f00
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 5524
	        start_va = 0x74450000
	          end_va = 0x7446dfff
	       monitored = 0
	     entry_point = 0x7445b640
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 5525
	        start_va = 0x74440000
	          end_va = 0x74449fff
	       monitored = 0
	     entry_point = 0x74442a00
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 5526
	        start_va = 0x74590000
	          end_va = 0x745e7fff
	       monitored = 0
	     entry_point = 0x745d25c0
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 5527
	        start_va = 0x77450000
	          end_va = 0x77596fff
	       monitored = 0
	     entry_point = 0x77461cf0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 5528
	        start_va = 0x76b30000
	          end_va = 0x76c7efff
	       monitored = 0
	     entry_point = 0x76be6820
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 5529
	        start_va = 0x753c0000
	          end_va = 0x75451fff
	       monitored = 0
	     entry_point = 0x753f8cf0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 5530
	        start_va = 0x77290000
	          end_va = 0x7744cfff
	       monitored = 0
	     entry_point = 0x77372a10
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")

Region:
	              id = 5531
	        start_va = 0x75310000
	          end_va = 0x7536efff
	       monitored = 0
	     entry_point = 0x75314af0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 5532
	        start_va = 0x77240000
	          end_va = 0x77284fff
	       monitored = 0
	     entry_point = 0x7725de90
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 5533
	        start_va = 0x6cc90000
	          end_va = 0x6cc97fff
	       monitored = 0
	     entry_point = 0x6cc917b0
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 5534
	        start_va = 0x6cc70000
	          end_va = 0x6cc85fff
	       monitored = 0
	     entry_point = 0x6cc721d0
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")

Region:
	              id = 5535
	        start_va = 0x6cc30000
	          end_va = 0x6cc6efff
	       monitored = 0
	     entry_point = 0x6cc446c0
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll")

Region:
	              id = 5536
	        start_va = 0x6caf0000
	          end_va = 0x6cc2efff
	       monitored = 0
	     entry_point = 0x6cb1d880
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll")

Region:
	              id = 5537
	        start_va = 0x6cad0000
	          end_va = 0x6caebfff
	       monitored = 0
	     entry_point = 0x6cad4720
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")

Region:
	              id = 5538
	        start_va = 0x6cac0000
	          end_va = 0x6cac9fff
	       monitored = 0
	     entry_point = 0x6cac28d0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")

Region:
	              id = 5539
	        start_va = 0x630000
	          end_va = 0x7dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000630000"
	        filename = ""

Region:
	              id = 5540
	        start_va = 0x480000
	          end_va = 0x4a9fff
	       monitored = 0
	     entry_point = 0x485680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 5541
	        start_va = 0x630000
	          end_va = 0x7b7fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000630000"
	        filename = ""

Region:
	              id = 5542
	        start_va = 0x7d0000
	          end_va = 0x7dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000007d0000"
	        filename = ""

Region:
	              id = 5543
	        start_va = 0x74ea0000
	          end_va = 0x74ecafff
	       monitored = 0
	     entry_point = 0x74ea5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 5544
	        start_va = 0x7e0000
	          end_va = 0x960fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000007e0000"
	        filename = ""

Region:
	              id = 5545
	        start_va = 0x53d0000
	          end_va = 0x67cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000053d0000"
	        filename = ""

Region:
	              id = 5546
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 5547
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001d0000"
	        filename = ""

Region:
	              id = 5548
	        start_va = 0x1f0000
	          end_va = 0x1f4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taskkill.exe.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui")

Region:
	              id = 5549
	        start_va = 0x480000
	          end_va = 0x480fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 5550
	        start_va = 0x490000
	          end_va = 0x490fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000490000"
	        filename = ""

Region:
	              id = 5551
	        start_va = 0x970000
	          end_va = 0xca6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 5552
	        start_va = 0xcb0000
	          end_va = 0xd99fff
	       monitored = 0
	     entry_point = 0xced650
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 5553
	        start_va = 0x4a0000
	          end_va = 0x4a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004a0000"
	        filename = ""

Region:
	              id = 5554
	        start_va = 0xcb0000
	          end_va = 0xd8ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 5555
	        start_va = 0x76e20000
	          end_va = 0x76e2bfff
	       monitored = 0
	     entry_point = 0x76e23930
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")

Region:
	              id = 5556
	        start_va = 0x4b0000
	          end_va = 0x4b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004b0000"
	        filename = ""

Region:
	              id = 5557
	        start_va = 0x76c80000
	          end_va = 0x76d03fff
	       monitored = 0
	     entry_point = 0x76ca6220
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 5558
	        start_va = 0x4c0000
	          end_va = 0x4c0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004c0000"
	        filename = ""

Region:
	              id = 5559
	        start_va = 0x6cab0000
	          end_va = 0x6cabcfff
	       monitored = 0
	     entry_point = 0x6cab3520
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 5560
	        start_va = 0x6ca40000
	          end_va = 0x6caa6fff
	       monitored = 0
	     entry_point = 0x6ca5b610
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 5561
	        start_va = 0x740f0000
	          end_va = 0x7410afff
	       monitored = 0
	     entry_point = 0x740f9050
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 5562
	        start_va = 0x6c9f0000
	          end_va = 0x6ca33fff
	       monitored = 0
	     entry_point = 0x6ca0aaf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")

Region:
	              id = 5563
	        start_va = 0x4d0000
	          end_va = 0x50ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004d0000"
	        filename = ""

Region:
	              id = 5564
	        start_va = 0xd90000
	          end_va = 0xdcffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000d90000"
	        filename = ""

Region:
	              id = 5565
	        start_va = 0xdd0000
	          end_va = 0xe0ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000dd0000"
	        filename = ""

Region:
	              id = 5566
	        start_va = 0xe10000
	          end_va = 0xe4ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e10000"
	        filename = ""

Region:
	              id = 5567
	        start_va = 0xe50000
	          end_va = 0xe8ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e50000"
	        filename = ""

Region:
	              id = 5568
	        start_va = 0xe90000
	          end_va = 0xecffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e90000"
	        filename = ""

Region:
	              id = 5569
	        start_va = 0x6c9d0000
	          end_va = 0x6c9e0fff
	       monitored = 0
	     entry_point = 0x6c9d8fa0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 5570
	        start_va = 0x6c910000
	          end_va = 0x6c9cefff
	       monitored = 0
	     entry_point = 0x6c941e80
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 5572
	        start_va = 0x510000
	          end_va = 0x515fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000510000"
	        filename = ""


Thread:
	id = 380
	os_tid = 0x3d4


Thread:
	id = 381
	os_tid = 0xcd4


Thread:
	id = 382
	os_tid = 0x510


Thread:
	id = 383
	os_tid = 0x500


Thread:
	id = 384
	os_tid = 0xf00


Process:
	id = "79"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x3577000"
	os_pid = "0x514"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x614"
	cmd_line = "cmd.exe /c \"taskkill /f /im winword.exe \""
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 5575
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 5576
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 5577
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 5578
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 5579
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 5580
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 5581
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 5582
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 5583
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 5584
	        start_va = 0x13a0000
	          end_va = 0x13f1fff
	       monitored = 1
	     entry_point = 0x13b4fd0
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")

Region:
	              id = 5585
	        start_va = 0x1400000
	          end_va = 0x53fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001400000"
	        filename = ""

Region:
	              id = 5586
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 5587
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 5588
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 5589
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 5590
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 5591
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 5592
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 5593
	        start_va = 0x490000
	          end_va = 0x49ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000490000"
	        filename = ""

Region:
	              id = 5594
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 5595
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 5596
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 5597
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 5598
	        start_va = 0x4a0000
	          end_va = 0x69ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004a0000"
	        filename = ""

Region:
	              id = 5599
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 5600
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 5601
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 5602
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 5603
	        start_va = 0x4a0000
	          end_va = 0x55dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 5604
	        start_va = 0x5a0000
	          end_va = 0x69ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005a0000"
	        filename = ""

Region:
	              id = 5605
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 5606
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 5607
	        start_va = 0x6a0000
	          end_va = 0x79ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000006a0000"
	        filename = ""

Region:
	              id = 5608
	        start_va = 0x7a0000
	          end_va = 0x93ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000007a0000"
	        filename = ""

Region:
	              id = 5609
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 5610
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 5611
	        start_va = 0x940000
	          end_va = 0xc76fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 385
	os_tid = 0xec0

	[0190.699] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000
	[0190.699] __set_app_type (_Type=0x1) 
	[0190.699] __p__fmode () returned 0x74974d6c
	[0190.699] __p__commode () returned 0x74975b1c
	[0190.699] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13b5200) returned 0x0
	[0190.699] __getmainargs (in: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0, _DoWildCard=0, _StartInfo=0x13c60fc | out: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0) returned 0
	[0190.700] GetCurrentThreadId () returned 0xec0
	[0190.700] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xec0) returned 0x78
	[0190.700] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0190.700] GetProcAddress (hModule=0x75600000, lpProcName="SetThreadUILanguage") returned 0x75642510
	[0190.700] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0190.706] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0190.707] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2
	[0190.707] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0190.707] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0190.707] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0190.707] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0190.707] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0190.707] GetConsoleOutputCP () returned 0x1b5
	[0190.708] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0190.708] SetConsoleCtrlHandler (HandlerRoutine=0x13c0e40, Add=1) returned 1
	[0190.708] _get_osfhandle (_FileHandle=1) returned 0x13c
	[0190.709] SetConsoleMode (hConsoleHandle=0x13c, dwMode=0x0) returned 0
	[0190.709] _get_osfhandle (_FileHandle=1) returned 0x13c
	[0190.709] GetConsoleMode (in: hConsoleHandle=0x13c, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0190.709] _get_osfhandle (_FileHandle=0) returned 0x130
	[0190.709] GetConsoleMode (in: hConsoleHandle=0x130, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0190.709] GetEnvironmentStringsW () returned 0x5a7cc0*
	[0190.709] GetProcessHeap () returned 0x5a0000
	[0190.709] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0xa1a) returned 0x5a86e8
	[0190.709] FreeEnvironmentStringsA (penv="A") returned 1
	[0190.709] GetProcessHeap () returned 0x5a0000
	[0190.709] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x4) returned 0x5a0550
	[0190.709] GetEnvironmentStringsW () returned 0x5a7cc0*
	[0190.709] GetProcessHeap () returned 0x5a0000
	[0190.709] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0xa1a) returned 0x5a9110
	[0190.709] FreeEnvironmentStringsA (penv="A") returned 1
	[0190.710] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0190.710] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0190.710] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0190.710] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0190.710] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0190.710] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0190.710] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0190.710] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0190.710] RegCloseKey (hKey=0x88) returned 0x0
	[0190.710] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0190.710] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0190.710] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0190.710] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0190.710] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0190.711] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0190.711] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0190.711] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0190.711] RegCloseKey (hKey=0x88) returned 0x0
	[0190.711] time (in: timer=0x0 | out: timer=0x0) returned 0x62344248
	[0190.711] srand (_Seed=0x62344248) 
	[0190.711] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im winword.exe \""
	[0190.711] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im winword.exe \""
	[0190.711] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0190.711] GetProcessHeap () returned 0x5a0000
	[0190.711] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x210) returned 0x5a9b38
	[0190.711] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5a9b40, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0190.711] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0190.711] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0190.712] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0190.712] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0190.712] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0190.712] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0190.712] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0190.712] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0190.712] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0190.712] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0190.712] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0190.712] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0190.712] GetProcessHeap () returned 0x5a0000
	[0190.713] RtlFreeHeap (HeapHandle=0x5a0000, Flags=0x0, BaseAddress=0x5a86e8) returned 1
	[0190.713] GetEnvironmentStringsW () returned 0x5a7cc0*
	[0190.713] GetProcessHeap () returned 0x5a0000
	[0190.713] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0xa32) returned 0x5aa790
	[0190.713] FreeEnvironmentStringsA (penv="A") returned 1
	[0190.713] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b
	[0190.714] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0190.714] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0190.714] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0190.714] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0190.714] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0190.714] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0190.714] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0190.714] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0190.714] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0190.714] GetProcessHeap () returned 0x5a0000
	[0190.714] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x44) returned 0x5a05c8
	[0190.714] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0190.714] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19fc4c*="Desktop") returned 0x1d
	[0190.714] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0190.715] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x5a0618
	[0190.715] FindClose (in: hFindFile=0x5a0618 | out: hFindFile=0x5a0618) returned 1
	[0190.715] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x5a0618
	[0190.715] FindClose (in: hFindFile=0x5a0618 | out: hFindFile=0x5a0618) returned 1
	[0190.715] _wcsnicmp (_String1="RDHJ0C~1", _String2="RDhJ0CNFevzX", _MaxCount=0xc) returned 16
	[0190.715] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x5a0618
	[0190.715] FindClose (in: hFindFile=0x5a0618 | out: hFindFile=0x5a0618) returned 1
	[0190.715] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0190.715] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1
	[0190.716] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 1
	[0190.716] GetProcessHeap () returned 0x5a0000
	[0190.716] RtlFreeHeap (HeapHandle=0x5a0000, Flags=0x0, BaseAddress=0x5aa790) returned 1
	[0190.716] GetEnvironmentStringsW () returned 0x5a7cc0*
	[0190.716] GetProcessHeap () returned 0x5a0000
	[0190.716] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0xa76) returned 0x5a9d50
	[0190.716] FreeEnvironmentStringsA (penv="=") returned 1
	[0190.716] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0190.716] GetProcessHeap () returned 0x5a0000
	[0190.716] RtlFreeHeap (HeapHandle=0x5a0000, Flags=0x0, BaseAddress=0x5a05c8) returned 1
	[0190.717] GetProcessHeap () returned 0x5a0000
	[0190.717] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x400e) returned 0x5abc50
	[0190.717] GetProcessHeap () returned 0x5a0000
	[0190.717] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x4a) returned 0x5aa7d0
	[0190.717] GetProcessHeap () returned 0x5a0000
	[0190.717] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x4008) returned 0x5afc68
	[0190.718] GetProcessHeap () returned 0x5a0000
	[0190.718] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x4008) returned 0x5b3c78
	[0190.719] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0190.719] GetProcessHeap () returned 0x5a0000
	[0190.719] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x418) returned 0x5aa828
	[0190.719] SetErrorMode (uMode=0x0) returned 0x8003
	[0190.720] SetErrorMode (uMode=0x1) returned 0x0
	[0190.720] GetFullPathNameW (in: lpFileName="taskkill \\f \\.", nBufferLength=0x208, lpBuffer=0x5aa830, lpFilePart=0x19fbac | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f", lpFilePart=0x19fbac*="f") returned 0x29
	[0190.720] SetErrorMode (uMode=0x8003) returned 0x1
	[0190.720] GetProcessHeap () returned 0x5a0000
	[0190.720] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5aa828, Size=0x7c) returned 0x5aa828
	[0190.720] GetProcessHeap () returned 0x5a0000
	[0190.720] RtlSizeHeap (HeapHandle=0x5a0000, Flags=0x0, MemoryPointer=0x5aa828) returned 0x7c
	[0190.720] NeedCurrentDirectoryForExePathW (ExeName="taskkill \\f \\.") returned 1
	[0190.720] GetProcessHeap () returned 0x5a0000
	[0190.720] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x62) returned 0x5aa8b0
	[0190.720] GetProcessHeap () returned 0x5a0000
	[0190.720] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0xb8) returned 0x5aa920
	[0190.720] GetProcessHeap () returned 0x5a0000
	[0190.720] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5aa920, Size=0x62) returned 0x5aa920
	[0190.720] GetProcessHeap () returned 0x5a0000
	[0190.720] RtlSizeHeap (HeapHandle=0x5a0000, Flags=0x0, MemoryPointer=0x5aa920) returned 0x62
	[0190.720] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0190.720] GetProcessHeap () returned 0x5a0000
	[0190.720] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0xe0) returned 0x5aa990
	[0190.725] GetProcessHeap () returned 0x5a0000
	[0190.725] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5aa990, Size=0x76) returned 0x5aa990
	[0190.725] GetProcessHeap () returned 0x5a0000
	[0190.725] RtlSizeHeap (HeapHandle=0x5a0000, Flags=0x0, MemoryPointer=0x5aa990) returned 0x76
	[0190.725] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0190.725] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f\\im winword.exe ", fInfoLevelId=0x1, lpFindFileData=0x19f958, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f958) returned 0xffffffff
	[0190.725] GetLastError () returned 0x3
	[0190.726] GetProcessHeap () returned 0x5a0000
	[0190.726] RtlFreeHeap (HeapHandle=0x5a0000, Flags=0x0, BaseAddress=0x5afc68) returned 1
	[0190.726] GetProcessHeap () returned 0x5a0000
	[0190.727] RtlFreeHeap (HeapHandle=0x5a0000, Flags=0x0, BaseAddress=0x5b3c78) returned 1
	[0190.727] GetProcessHeap () returned 0x5a0000
	[0190.728] RtlFreeHeap (HeapHandle=0x5a0000, Flags=0x0, BaseAddress=0x5abc50) returned 1
	[0190.728] GetConsoleOutputCP () returned 0x1b5
	[0190.730] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0190.730] GetUserDefaultLCID () returned 0x409
	[0190.730] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x13d34a0, cchData=8 | out: lpLCData=":") returned 2
	[0190.730] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0190.730] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0190.730] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2
	[0190.730] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x13d34b0, cchData=8 | out: lpLCData="/") returned 2
	[0190.730] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x13d3500, cchData=32 | out: lpLCData="Mon") returned 4
	[0190.730] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x13d3540, cchData=32 | out: lpLCData="Tue") returned 4
	[0190.730] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x13d3580, cchData=32 | out: lpLCData="Wed") returned 4
	[0190.730] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x13d35c0, cchData=32 | out: lpLCData="Thu") returned 4
	[0190.730] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x13d3600, cchData=32 | out: lpLCData="Fri") returned 4
	[0190.730] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x13d3640, cchData=32 | out: lpLCData="Sat") returned 4
	[0190.730] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x13d3680, cchData=32 | out: lpLCData="Sun") returned 4
	[0190.731] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x13d34c0, cchData=8 | out: lpLCData=".") returned 2
	[0190.731] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x13d34e0, cchData=8 | out: lpLCData=",") returned 2
	[0190.731] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0190.732] GetProcessHeap () returned 0x5a0000
	[0190.732] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x20c) returned 0x5aaa58
	[0190.732] GetConsoleTitleW (in: lpConsoleTitle=0x5aaa58, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0190.736] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0190.736] GetProcAddress (hModule=0x75600000, lpProcName="CopyFileExW") returned 0x7561ffc0
	[0190.736] GetProcAddress (hModule=0x75600000, lpProcName="IsDebuggerPresent") returned 0x7561b0b0
	[0190.736] GetProcAddress (hModule=0x75600000, lpProcName="SetConsoleInputExeNameW") returned 0x7559b440
	[0190.737] GetProcessHeap () returned 0x5a0000
	[0190.737] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x400a) returned 0x5abc50
	[0190.737] GetProcessHeap () returned 0x5a0000
	[0190.737] RtlFreeHeap (HeapHandle=0x5a0000, Flags=0x0, BaseAddress=0x5abc50) returned 1
	[0190.738] _wcsicmp (_String1="taskkill", _String2=")") returned 75
	[0190.738] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14
	[0190.738] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14
	[0190.738] _wcsicmp (_String1="IF", _String2="taskkill") returned -11
	[0190.738] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11
	[0190.738] _wcsicmp (_String1="REM", _String2="taskkill") returned -2
	[0190.738] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2
	[0190.739] GetProcessHeap () returned 0x5a0000
	[0190.739] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x58) returned 0x5aac70
	[0190.739] GetProcessHeap () returned 0x5a0000
	[0190.739] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x1a) returned 0x5a0578
	[0190.739] GetProcessHeap () returned 0x5a0000
	[0190.739] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x32) returned 0x5aacd0
	[0190.740] GetConsoleTitleW (in: lpConsoleTitle=0x19fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0190.743] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0190.743] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0190.743] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0190.743] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0190.743] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0190.743] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0190.743] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0190.743] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0190.743] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0190.743] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0190.743] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0190.743] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0190.743] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0190.743] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0190.743] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0190.743] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0190.743] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0190.743] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0190.743] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0190.743] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0190.743] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0190.743] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0190.743] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0190.743] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0190.743] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0190.743] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0190.743] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0190.744] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0190.744] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0190.744] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0190.744] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0190.744] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0190.744] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0190.744] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0190.744] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0190.744] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0190.744] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0190.744] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0190.744] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0190.744] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0190.744] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0190.744] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0190.744] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0190.744] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0190.744] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0190.744] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0190.744] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0190.744] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0190.744] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0190.744] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0190.744] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0190.744] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0190.744] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0190.744] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0190.744] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0190.744] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0190.744] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0190.744] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0190.745] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0190.745] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0190.745] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0190.745] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0190.745] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0190.745] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0190.745] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0190.745] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0190.745] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0190.745] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0190.745] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0190.745] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0190.745] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0190.745] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0190.745] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0190.745] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0190.745] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0190.745] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0190.745] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0190.745] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0190.745] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0190.745] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0190.745] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0190.745] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0190.745] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0190.745] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0190.745] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14
	[0190.746] _wcsicmp (_String1="taskkill", _String2="IF") returned 11
	[0190.746] _wcsicmp (_String1="taskkill", _String2="REM") returned 2
	[0190.746] GetProcessHeap () returned 0x5a0000
	[0190.746] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x210) returned 0x5aad10
	[0190.746] GetProcessHeap () returned 0x5a0000
	[0190.746] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x44) returned 0x5aaf28
	[0190.746] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0190.746] GetProcessHeap () returned 0x5a0000
	[0190.746] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x418) returned 0x5a05c8
	[0190.746] SetErrorMode (uMode=0x0) returned 0x8003
	[0190.747] SetErrorMode (uMode=0x1) returned 0x0
	[0190.747] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x5a05d0, lpFilePart=0x19f57c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19f57c*="Desktop") returned 0x1d
	[0190.747] SetErrorMode (uMode=0x8003) returned 0x1
	[0190.747] GetProcessHeap () returned 0x5a0000
	[0190.747] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5a05c8, Size=0x56) returned 0x5a05c8
	[0190.747] GetProcessHeap () returned 0x5a0000
	[0190.747] RtlSizeHeap (HeapHandle=0x5a0000, Flags=0x0, MemoryPointer=0x5a05c8) returned 0x56
	[0190.747] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0190.747] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0190.747] GetProcessHeap () returned 0x5a0000
	[0190.747] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x110) returned 0x5aaf78
	[0190.747] GetProcessHeap () returned 0x5a0000
	[0190.747] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x218) returned 0x5a0628
	[0190.752] GetProcessHeap () returned 0x5a0000
	[0190.752] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5a0628, Size=0x112) returned 0x5a0628
	[0190.752] GetProcessHeap () returned 0x5a0000
	[0190.752] RtlSizeHeap (HeapHandle=0x5a0000, Flags=0x0, MemoryPointer=0x5a0628) returned 0x112
	[0190.752] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0190.752] GetProcessHeap () returned 0x5a0000
	[0190.752] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0xe0) returned 0x5ab090
	[0190.753] GetProcessHeap () returned 0x5a0000
	[0190.754] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5ab090, Size=0x76) returned 0x5ab090
	[0190.754] GetProcessHeap () returned 0x5a0000
	[0190.754] RtlSizeHeap (HeapHandle=0x5a0000, Flags=0x0, MemoryPointer=0x5ab090) returned 0x76
	[0190.754] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0190.754] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0190.754] GetLastError () returned 0x2
	[0190.754] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0190.754] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x5ab110
	[0190.754] GetProcessHeap () returned 0x5a0000
	[0190.754] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x0, Size=0x14) returned 0x5a75c8
	[0190.754] FindClose (in: hFindFile=0x5ab110 | out: hFindFile=0x5ab110) returned 1
	[0190.755] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0190.755] GetLastError () returned 0x2
	[0190.755] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x5ab110
	[0190.755] GetProcessHeap () returned 0x5a0000
	[0190.755] RtlReAllocateHeap (Heap=0x5a0000, Flags=0x0, Ptr=0x5a75c8, Size=0x4) returned 0x5ab150
	[0190.755] FindClose (in: hFindFile=0x5ab110 | out: hFindFile=0x5ab110) returned 1
	[0190.755] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0190.755] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0190.755] GetConsoleTitleW (in: lpConsoleTitle=0x19f7fc, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0190.756] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f728, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f70c | out: lpAttributeList=0x19f728, lpSize=0x19f70c) returned 1
	[0190.756] UpdateProcThreadAttribute (in: lpAttributeList=0x19f728, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f714, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f728, lpPreviousValue=0x0) returned 1
	[0190.757] GetStartupInfoW (in: lpStartupInfo=0x19f760 | out: lpStartupInfo=0x19f760*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x130, hStdOutput=0x13c, hStdError=0x140)) 
	[0190.757] GetProcessHeap () returned 0x5a0000
	[0190.757] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0x18) returned 0x5a7748
	[0190.757] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0190.757] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0190.757] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0190.757] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0190.757] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0190.757] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0190.757] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0190.757] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0190.757] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0190.757] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0190.757] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0190.757] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0190.757] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0190.758] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0190.758] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0190.758] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0190.758] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0190.758] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0190.758] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0190.758] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0190.758] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0190.758] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0190.758] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0190.758] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0190.758] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0190.758] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0190.758] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0190.758] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0190.758] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0190.758] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0190.758] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0190.758] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0190.758] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0190.758] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0190.758] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0190.758] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0190.759] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0190.759] GetProcessHeap () returned 0x5a0000
	[0190.759] RtlFreeHeap (HeapHandle=0x5a0000, Flags=0x0, BaseAddress=0x5a7748) returned 1
	[0190.759] GetProcessHeap () returned 0x5a0000
	[0190.759] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0xa) returned 0x5ab110
	[0190.759] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1
	[0190.761] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill  /f /im winword.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x19f6b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill  /f /im winword.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f6fc | out: lpCommandLine="taskkill  /f /im winword.exe ", lpProcessInformation=0x19f6fc*(hProcess=0x9c, hThread=0x98, dwProcessId=0x750, dwThreadId=0xb68)) returned 1
	[0190.779] CloseHandle (hObject=0x98) returned 1
	[0190.779] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0190.779] GetProcessHeap () returned 0x5a0000
	[0190.779] RtlFreeHeap (HeapHandle=0x5a0000, Flags=0x0, BaseAddress=0x5a9d50) returned 1
	[0190.780] GetEnvironmentStringsW () returned 0x5a9d50*
	[0190.780] GetProcessHeap () returned 0x5a0000
	[0190.780] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0xa76) returned 0x5a7cc0
	[0190.780] FreeEnvironmentStringsA (penv="=") returned 1
	[0190.780] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0
	[0191.715] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x19f694 | out: lpExitCode=0x19f694*=0x80) returned 1
	[0191.715] CloseHandle (hObject=0x9c) returned 1
	[0191.715] _vsnwprintf (in: _Buffer=0x19f77c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f69c | out: _Buffer="00000080") returned 8
	[0191.716] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1
	[0191.716] GetProcessHeap () returned 0x5a0000
	[0191.717] RtlFreeHeap (HeapHandle=0x5a0000, Flags=0x0, BaseAddress=0x5a7cc0) returned 1
	[0191.717] GetEnvironmentStringsW () returned 0x5ab160*
	[0191.717] GetProcessHeap () returned 0x5a0000
	[0191.717] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0xa9c) returned 0x5a7cc0
	[0191.717] FreeEnvironmentStringsA (penv="=") returned 1
	[0191.717] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0191.717] GetProcessHeap () returned 0x5a0000
	[0191.717] RtlFreeHeap (HeapHandle=0x5a0000, Flags=0x0, BaseAddress=0x5a7cc0) returned 1
	[0191.717] GetEnvironmentStringsW () returned 0x5ab160*
	[0191.717] GetProcessHeap () returned 0x5a0000
	[0191.717] RtlAllocateHeap (HeapHandle=0x5a0000, Flags=0x8, Size=0xa9c) returned 0x5a7cc0
	[0191.718] FreeEnvironmentStringsA (penv="=") returned 1
	[0191.718] GetProcessHeap () returned 0x5a0000
	[0191.718] RtlFreeHeap (HeapHandle=0x5a0000, Flags=0x0, BaseAddress=0x5ab110) returned 1
	[0191.718] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f728 | out: lpAttributeList=0x19f728) 
	[0191.718] _get_osfhandle (_FileHandle=1) returned 0x13c
	[0191.718] SetConsoleMode (hConsoleHandle=0x13c, dwMode=0x0) returned 0
	[0191.718] _get_osfhandle (_FileHandle=1) returned 0x13c
	[0191.718] GetConsoleMode (in: hConsoleHandle=0x13c, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0191.718] _get_osfhandle (_FileHandle=0) returned 0x130
	[0191.718] GetConsoleMode (in: hConsoleHandle=0x130, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0191.718] GetConsoleOutputCP () returned 0x1b5
	[0191.722] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0191.722] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0191.725] exit (_Code=128) 

Thread:
	id = 386
	os_tid = 0xa48


Process:
	id = "80"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\syswow64\\taskkill.exe"
	page_root = "0x2f567000"
	os_pid = "0x750"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "79"
	os_parent_pid = "0x514"
	cmd_line = "taskkill  /f /im winword.exe "
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 5612
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 5613
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 5614
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 5615
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 5616
	        start_va = 0xa0000
	          end_va = 0xdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 5617
	        start_va = 0xe0000
	          end_va = 0xe3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 5618
	        start_va = 0xf0000
	          end_va = 0xf0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 5619
	        start_va = 0x100000
	          end_va = 0x101fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 5620
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 5621
	        start_va = 0x13b0000
	          end_va = 0x13c5fff
	       monitored = 0
	     entry_point = 0x13bde80
	     region_type = mapped_file
	            name = "taskkill.exe"
	        filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe")

Region:
	              id = 5622
	        start_va = 0x13d0000
	          end_va = 0x53cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000013d0000"
	        filename = ""

Region:
	              id = 5623
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 5624
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 5625
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 5626
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 5627
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 5628
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 5629
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 5630
	        start_va = 0x190000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000190000"
	        filename = ""

Region:
	              id = 5631
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 5632
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 5633
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 5634
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 5635
	        start_va = 0x400000
	          end_va = 0x5affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 5636
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 5637
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 5638
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 5639
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 5640
	        start_va = 0x5b0000
	          end_va = 0x66dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 5641
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 5642
	        start_va = 0x74650000
	          end_va = 0x746cafff
	       monitored = 0
	     entry_point = 0x7466e970
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 5643
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 5644
	        start_va = 0x110000
	          end_va = 0x14ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000110000"
	        filename = ""

Region:
	              id = 5645
	        start_va = 0x150000
	          end_va = 0x18ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000150000"
	        filename = ""

Region:
	              id = 5646
	        start_va = 0x76ae0000
	          end_va = 0x76b23fff
	       monitored = 0
	     entry_point = 0x76af9d80
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 5647
	        start_va = 0x75260000
	          end_va = 0x7530cfff
	       monitored = 0
	     entry_point = 0x75274f00
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 5648
	        start_va = 0x74450000
	          end_va = 0x7446dfff
	       monitored = 0
	     entry_point = 0x7445b640
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 5649
	        start_va = 0x74440000
	          end_va = 0x74449fff
	       monitored = 0
	     entry_point = 0x74442a00
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 5650
	        start_va = 0x74590000
	          end_va = 0x745e7fff
	       monitored = 0
	     entry_point = 0x745d25c0
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 5651
	        start_va = 0x77450000
	          end_va = 0x77596fff
	       monitored = 0
	     entry_point = 0x77461cf0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 5652
	        start_va = 0x76b30000
	          end_va = 0x76c7efff
	       monitored = 0
	     entry_point = 0x76be6820
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 5653
	        start_va = 0x753c0000
	          end_va = 0x75451fff
	       monitored = 0
	     entry_point = 0x753f8cf0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 5654
	        start_va = 0x77290000
	          end_va = 0x7744cfff
	       monitored = 0
	     entry_point = 0x77372a10
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")

Region:
	              id = 5655
	        start_va = 0x75310000
	          end_va = 0x7536efff
	       monitored = 0
	     entry_point = 0x75314af0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 5656
	        start_va = 0x77240000
	          end_va = 0x77284fff
	       monitored = 0
	     entry_point = 0x7725de90
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 5657
	        start_va = 0x6cc90000
	          end_va = 0x6cc97fff
	       monitored = 0
	     entry_point = 0x6cc917b0
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 5658
	        start_va = 0x6cc70000
	          end_va = 0x6cc85fff
	       monitored = 0
	     entry_point = 0x6cc721d0
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")

Region:
	              id = 5659
	        start_va = 0x6cc30000
	          end_va = 0x6cc6efff
	       monitored = 0
	     entry_point = 0x6cc446c0
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll")

Region:
	              id = 5660
	        start_va = 0x6caf0000
	          end_va = 0x6cc2efff
	       monitored = 0
	     entry_point = 0x6cb1d880
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll")

Region:
	              id = 5661
	        start_va = 0x6cad0000
	          end_va = 0x6caebfff
	       monitored = 0
	     entry_point = 0x6cad4720
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")

Region:
	              id = 5662
	        start_va = 0x6cac0000
	          end_va = 0x6cac9fff
	       monitored = 0
	     entry_point = 0x6cac28d0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")

Region:
	              id = 5663
	        start_va = 0x670000
	          end_va = 0x7effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000670000"
	        filename = ""

Region:
	              id = 5664
	        start_va = 0x1a0000
	          end_va = 0x1c9fff
	       monitored = 0
	     entry_point = 0x1a5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 5665
	        start_va = 0x7f0000
	          end_va = 0x977fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000007f0000"
	        filename = ""

Region:
	              id = 5666
	        start_va = 0x74ea0000
	          end_va = 0x74ecafff
	       monitored = 0
	     entry_point = 0x74ea5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 5667
	        start_va = 0x980000
	          end_va = 0xb00fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000980000"
	        filename = ""

Region:
	              id = 5668
	        start_va = 0x53d0000
	          end_va = 0x67cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000053d0000"
	        filename = ""

Region:
	              id = 5669
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 5670
	        start_va = 0x1a0000
	          end_va = 0x1a0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 5671
	        start_va = 0x1b0000
	          end_va = 0x1b4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taskkill.exe.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui")

Region:
	              id = 5672
	        start_va = 0x1c0000
	          end_va = 0x1c0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 5673
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001d0000"
	        filename = ""

Region:
	              id = 5674
	        start_va = 0xb10000
	          end_va = 0xe46fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 5675
	        start_va = 0x670000
	          end_va = 0x759fff
	       monitored = 0
	     entry_point = 0x6ad650
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 5676
	        start_va = 0x7e0000
	          end_va = 0x7effff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000007e0000"
	        filename = ""

Region:
	              id = 5677
	        start_va = 0x1e0000
	          end_va = 0x1e3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001e0000"
	        filename = ""

Region:
	              id = 5678
	        start_va = 0x670000
	          end_va = 0x74ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 5679
	        start_va = 0x76e20000
	          end_va = 0x76e2bfff
	       monitored = 0
	     entry_point = 0x76e23930
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")

Region:
	              id = 5680
	        start_va = 0x1f0000
	          end_va = 0x1f0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001f0000"
	        filename = ""

Region:
	              id = 5681
	        start_va = 0x76c80000
	          end_va = 0x76d03fff
	       monitored = 0
	     entry_point = 0x76ca6220
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 5682
	        start_va = 0x400000
	          end_va = 0x400fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000400000"
	        filename = ""

Region:
	              id = 5683
	        start_va = 0x4b0000
	          end_va = 0x5affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004b0000"
	        filename = ""

Region:
	              id = 5684
	        start_va = 0x6cab0000
	          end_va = 0x6cabcfff
	       monitored = 0
	     entry_point = 0x6cab3520
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 5685
	        start_va = 0x6ca40000
	          end_va = 0x6caa6fff
	       monitored = 0
	     entry_point = 0x6ca5b610
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 5686
	        start_va = 0x740f0000
	          end_va = 0x7410afff
	       monitored = 0
	     entry_point = 0x740f9050
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 5687
	        start_va = 0x6c9f0000
	          end_va = 0x6ca33fff
	       monitored = 0
	     entry_point = 0x6ca0aaf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")

Region:
	              id = 5688
	        start_va = 0x410000
	          end_va = 0x44ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000410000"
	        filename = ""

Region:
	              id = 5689
	        start_va = 0x450000
	          end_va = 0x48ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000450000"
	        filename = ""

Region:
	              id = 5690
	        start_va = 0x750000
	          end_va = 0x78ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000750000"
	        filename = ""

Region:
	              id = 5691
	        start_va = 0x790000
	          end_va = 0x7cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000790000"
	        filename = ""

Region:
	              id = 5692
	        start_va = 0xe50000
	          end_va = 0xe8ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e50000"
	        filename = ""

Region:
	              id = 5693
	        start_va = 0xe90000
	          end_va = 0xecffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000e90000"
	        filename = ""

Region:
	              id = 5694
	        start_va = 0x6c9d0000
	          end_va = 0x6c9e0fff
	       monitored = 0
	     entry_point = 0x6c9d8fa0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 5695
	        start_va = 0x6c910000
	          end_va = 0x6c9cefff
	       monitored = 0
	     entry_point = 0x6c941e80
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 5697
	        start_va = 0x490000
	          end_va = 0x495fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000490000"
	        filename = ""


Thread:
	id = 387
	os_tid = 0xb68


Thread:
	id = 388
	os_tid = 0xe8


Thread:
	id = 389
	os_tid = 0x90c


Thread:
	id = 390
	os_tid = 0x11e8


Thread:
	id = 391
	os_tid = 0xe5c


Process:
	id = "81"
	image_name = "cmd.exe"
	filename = "c:\\windows\\syswow64\\cmd.exe"
	page_root = "0x2f182000"
	os_pid = "0xe50"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x614"
	cmd_line = "cmd.exe /c \"taskkill /f /im wordpad.exe\""
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 5700
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 5701
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 5702
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 5703
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 5704
	        start_va = 0xa0000
	          end_va = 0x19ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 5705
	        start_va = 0x1a0000
	          end_va = 0x1a3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001a0000"
	        filename = ""

Region:
	              id = 5706
	        start_va = 0x1b0000
	          end_va = 0x1b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001b0000"
	        filename = ""

Region:
	              id = 5707
	        start_va = 0x1c0000
	          end_va = 0x1c1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001c0000"
	        filename = ""

Region:
	              id = 5708
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 5709
	        start_va = 0x13a0000
	          end_va = 0x13f1fff
	       monitored = 1
	     entry_point = 0x13b4fd0
	     region_type = mapped_file
	            name = "cmd.exe"
	        filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")

Region:
	              id = 5710
	        start_va = 0x1400000
	          end_va = 0x53fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000001400000"
	        filename = ""

Region:
	              id = 5711
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 5712
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 5713
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 5714
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 5715
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 5716
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 5717
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 5718
	        start_va = 0x5a0000
	          end_va = 0x5affff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005a0000"
	        filename = ""

Region:
	              id = 5719
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 5720
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 5721
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 5722
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 5723
	        start_va = 0x400000
	          end_va = 0x55ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 5724
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 5725
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 5726
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 5727
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 5728
	        start_va = 0x5b0000
	          end_va = 0x66dfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 5729
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 5730
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 5731
	        start_va = 0x460000
	          end_va = 0x55ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000460000"
	        filename = ""

Region:
	              id = 5732
	        start_va = 0x670000
	          end_va = 0x76ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000670000"
	        filename = ""

Region:
	              id = 5733
	        start_va = 0x770000
	          end_va = 0x7fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000770000"
	        filename = ""

Region:
	              id = 5734
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 5735
	        start_va = 0x30000
	          end_va = 0x33fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 5736
	        start_va = 0x800000
	          end_va = 0xb36fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")


Thread:
	id = 392
	os_tid = 0xd88

	[0191.876] GetModuleHandleA (lpModuleName=0x0) returned 0x13a0000
	[0191.876] __set_app_type (_Type=0x1) 
	[0191.876] __p__fmode () returned 0x74974d6c
	[0191.876] __p__commode () returned 0x74975b1c
	[0191.876] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13b5200) returned 0x0
	[0191.876] __getmainargs (in: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0, _DoWildCard=0, _StartInfo=0x13c60fc | out: _Argc=0x13c60e8, _Argv=0x13c60ec, _Env=0x13c60f0) returned 0
	[0191.876] GetCurrentThreadId () returned 0xd88
	[0191.876] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xd88) returned 0x78
	[0191.877] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0191.877] GetProcAddress (hModule=0x75600000, lpProcName="SetThreadUILanguage") returned 0x75642510
	[0191.877] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0191.923] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0191.923] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2
	[0191.923] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0191.923] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c
	[0191.923] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c
	[0191.923] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c
	[0191.923] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c
	[0191.923] GetConsoleOutputCP () returned 0x1b5
	[0191.924] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0191.924] SetConsoleCtrlHandler (HandlerRoutine=0x13c0e40, Add=1) returned 1
	[0191.925] _get_osfhandle (_FileHandle=1) returned 0x130
	[0191.925] SetConsoleMode (hConsoleHandle=0x130, dwMode=0x0) returned 0
	[0191.925] _get_osfhandle (_FileHandle=1) returned 0x130
	[0191.925] GetConsoleMode (in: hConsoleHandle=0x130, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0191.925] _get_osfhandle (_FileHandle=0) returned 0x154
	[0191.925] GetConsoleMode (in: hConsoleHandle=0x154, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0191.925] GetEnvironmentStringsW () returned 0x467cc0*
	[0191.925] GetProcessHeap () returned 0x460000
	[0191.925] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xa1a) returned 0x4686e8
	[0191.925] FreeEnvironmentStringsA (penv="A") returned 1
	[0191.925] GetProcessHeap () returned 0x460000
	[0191.925] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x4) returned 0x460550
	[0191.925] GetEnvironmentStringsW () returned 0x467cc0*
	[0191.926] GetProcessHeap () returned 0x460000
	[0191.926] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xa1a) returned 0x469110
	[0191.926] FreeEnvironmentStringsA (penv="A") returned 1
	[0191.926] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0191.926] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0191.926] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0191.926] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0191.926] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0191.926] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0191.927] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0
	[0191.927] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0191.927] RegCloseKey (hKey=0x88) returned 0x0
	[0191.927] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x88) returned 0x0
	[0191.927] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0191.927] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0
	[0191.927] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0191.927] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0
	[0191.927] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0191.927] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0
	[0191.927] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2
	[0191.927] RegCloseKey (hKey=0x88) returned 0x0
	[0191.927] time (in: timer=0x0 | out: timer=0x0) returned 0x6234424a
	[0191.927] srand (_Seed=0x6234424a) 
	[0191.927] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im wordpad.exe\""
	[0191.927] GetCommandLineW () returned="cmd.exe /c \"taskkill /f /im wordpad.exe\""
	[0191.927] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0191.928] GetProcessHeap () returned 0x460000
	[0191.928] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x210) returned 0x469b38
	[0191.928] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x469b40, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b
	[0191.928] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0191.928] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0191.928] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0191.928] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0191.928] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0191.928] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0191.928] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0191.928] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0191.928] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0191.928] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0191.928] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0191.928] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0191.929] GetProcessHeap () returned 0x460000
	[0191.929] RtlFreeHeap (HeapHandle=0x460000, Flags=0x0, BaseAddress=0x4686e8) returned 1
	[0191.929] GetEnvironmentStringsW () returned 0x467cc0*
	[0191.929] GetProcessHeap () returned 0x460000
	[0191.929] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xa32) returned 0x46a790
	[0191.930] FreeEnvironmentStringsA (penv="A") returned 1
	[0191.930] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b
	[0191.930] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0191.930] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0191.930] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0191.930] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0191.930] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0191.930] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0191.930] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0191.930] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0191.930] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0191.930] GetProcessHeap () returned 0x460000
	[0191.930] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x44) returned 0x4605c8
	[0191.930] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0191.930] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19fc4c*="Desktop") returned 0x1d
	[0191.930] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0191.930] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x460618
	[0191.931] FindClose (in: hFindFile=0x460618 | out: hFindFile=0x460618) returned 1
	[0191.931] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x460618
	[0191.931] FindClose (in: hFindFile=0x460618 | out: hFindFile=0x460618) returned 1
	[0191.931] _wcsnicmp (_String1="RDHJ0C~1", _String2="RDhJ0CNFevzX", _MaxCount=0xc) returned 16
	[0191.931] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa0fe8606, ftLastAccessTime.dwHighDateTime=0x1d83aa1, ftLastWriteTime.dwLowDateTime=0xa0fe8606, ftLastWriteTime.dwHighDateTime=0x1d83aa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x460618
	[0191.931] FindClose (in: hFindFile=0x460618 | out: hFindFile=0x460618) returned 1
	[0191.931] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11
	[0191.931] SetCurrentDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 1
	[0191.931] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 1
	[0191.931] GetProcessHeap () returned 0x460000
	[0191.932] RtlFreeHeap (HeapHandle=0x460000, Flags=0x0, BaseAddress=0x46a790) returned 1
	[0191.932] GetEnvironmentStringsW () returned 0x467cc0*
	[0191.932] GetProcessHeap () returned 0x460000
	[0191.932] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xa76) returned 0x469d50
	[0191.932] FreeEnvironmentStringsA (penv="=") returned 1
	[0191.932] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x13d7720 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d
	[0191.932] GetProcessHeap () returned 0x460000
	[0191.933] RtlFreeHeap (HeapHandle=0x460000, Flags=0x0, BaseAddress=0x4605c8) returned 1
	[0191.933] GetProcessHeap () returned 0x460000
	[0191.933] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x400e) returned 0x46bc50
	[0191.934] GetProcessHeap () returned 0x460000
	[0191.934] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x48) returned 0x46a7d0
	[0191.934] GetProcessHeap () returned 0x460000
	[0191.934] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x4008) returned 0x46fc68
	[0191.934] GetProcessHeap () returned 0x460000
	[0191.934] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x4008) returned 0x473c78
	[0191.936] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0191.937] GetProcessHeap () returned 0x460000
	[0191.937] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x418) returned 0x46a820
	[0191.937] SetErrorMode (uMode=0x0) returned 0x8003
	[0191.937] SetErrorMode (uMode=0x1) returned 0x0
	[0191.937] GetFullPathNameW (in: lpFileName="taskkill \\f \\.", nBufferLength=0x208, lpBuffer=0x46a828, lpFilePart=0x19fbac | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f", lpFilePart=0x19fbac*="f") returned 0x29
	[0191.937] SetErrorMode (uMode=0x8003) returned 0x1
	[0191.937] GetProcessHeap () returned 0x460000
	[0191.937] RtlReAllocateHeap (Heap=0x460000, Flags=0x0, Ptr=0x46a820, Size=0x7a) returned 0x46a820
	[0191.937] GetProcessHeap () returned 0x460000
	[0191.937] RtlSizeHeap (HeapHandle=0x460000, Flags=0x0, MemoryPointer=0x46a820) returned 0x7a
	[0191.938] NeedCurrentDirectoryForExePathW (ExeName="taskkill \\f \\.") returned 1
	[0191.938] GetProcessHeap () returned 0x460000
	[0191.938] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x62) returned 0x46a8a8
	[0191.938] GetProcessHeap () returned 0x460000
	[0191.938] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xb8) returned 0x46a918
	[0191.938] GetProcessHeap () returned 0x460000
	[0191.938] RtlReAllocateHeap (Heap=0x460000, Flags=0x0, Ptr=0x46a918, Size=0x62) returned 0x46a918
	[0191.938] GetProcessHeap () returned 0x460000
	[0191.938] RtlSizeHeap (HeapHandle=0x460000, Flags=0x0, MemoryPointer=0x46a918) returned 0x62
	[0191.938] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0191.938] GetProcessHeap () returned 0x460000
	[0191.938] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xe0) returned 0x46a988
	[0191.943] GetProcessHeap () returned 0x460000
	[0191.943] RtlReAllocateHeap (Heap=0x460000, Flags=0x0, Ptr=0x46a988, Size=0x76) returned 0x46a988
	[0191.943] GetProcessHeap () returned 0x460000
	[0191.943] RtlSizeHeap (HeapHandle=0x460000, Flags=0x0, MemoryPointer=0x46a988) returned 0x76
	[0191.943] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0191.943] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill \\f\\im wordpad.exe", fInfoLevelId=0x1, lpFindFileData=0x19f958, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f958) returned 0xffffffff
	[0191.944] GetLastError () returned 0x3
	[0191.944] GetProcessHeap () returned 0x460000
	[0191.944] RtlFreeHeap (HeapHandle=0x460000, Flags=0x0, BaseAddress=0x46fc68) returned 1
	[0191.944] GetProcessHeap () returned 0x460000
	[0191.945] RtlFreeHeap (HeapHandle=0x460000, Flags=0x0, BaseAddress=0x473c78) returned 1
	[0191.945] GetProcessHeap () returned 0x460000
	[0191.945] RtlFreeHeap (HeapHandle=0x460000, Flags=0x0, BaseAddress=0x46bc50) returned 1
	[0191.945] GetConsoleOutputCP () returned 0x1b5
	[0191.947] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0191.947] GetUserDefaultLCID () returned 0x409
	[0191.948] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x13d34a0, cchData=8 | out: lpLCData=":") returned 2
	[0191.948] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0191.948] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2
	[0191.948] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2
	[0191.948] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x13d34b0, cchData=8 | out: lpLCData="/") returned 2
	[0191.948] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x13d3500, cchData=32 | out: lpLCData="Mon") returned 4
	[0191.948] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x13d3540, cchData=32 | out: lpLCData="Tue") returned 4
	[0191.948] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x13d3580, cchData=32 | out: lpLCData="Wed") returned 4
	[0191.949] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x13d35c0, cchData=32 | out: lpLCData="Thu") returned 4
	[0191.949] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x13d3600, cchData=32 | out: lpLCData="Fri") returned 4
	[0191.949] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x13d3640, cchData=32 | out: lpLCData="Sat") returned 4
	[0191.949] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x13d3680, cchData=32 | out: lpLCData="Sun") returned 4
	[0191.949] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x13d34c0, cchData=8 | out: lpLCData=".") returned 2
	[0191.949] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x13d34e0, cchData=8 | out: lpLCData=",") returned 2
	[0191.949] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0191.951] GetProcessHeap () returned 0x460000
	[0191.951] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x0, Size=0x20c) returned 0x46aa50
	[0191.951] GetConsoleTitleW (in: lpConsoleTitle=0x46aa50, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0191.953] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75600000
	[0191.953] GetProcAddress (hModule=0x75600000, lpProcName="CopyFileExW") returned 0x7561ffc0
	[0191.953] GetProcAddress (hModule=0x75600000, lpProcName="IsDebuggerPresent") returned 0x7561b0b0
	[0191.953] GetProcAddress (hModule=0x75600000, lpProcName="SetConsoleInputExeNameW") returned 0x7559b440
	[0191.954] GetProcessHeap () returned 0x460000
	[0191.954] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x400a) returned 0x46bc50
	[0191.954] GetProcessHeap () returned 0x460000
	[0191.954] RtlFreeHeap (HeapHandle=0x460000, Flags=0x0, BaseAddress=0x46bc50) returned 1
	[0191.955] _wcsicmp (_String1="taskkill", _String2=")") returned 75
	[0191.955] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14
	[0191.955] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14
	[0191.955] _wcsicmp (_String1="IF", _String2="taskkill") returned -11
	[0191.955] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11
	[0191.955] _wcsicmp (_String1="REM", _String2="taskkill") returned -2
	[0191.955] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2
	[0191.956] GetProcessHeap () returned 0x460000
	[0191.956] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x58) returned 0x46ac68
	[0191.956] GetProcessHeap () returned 0x460000
	[0191.956] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x1a) returned 0x460578
	[0191.956] GetProcessHeap () returned 0x460000
	[0191.956] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x30) returned 0x46acc8
	[0191.958] GetConsoleTitleW (in: lpConsoleTitle=0x19fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0191.960] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0191.960] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0191.960] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0191.960] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0191.960] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0191.960] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0191.960] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0191.960] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0191.960] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0191.960] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0191.960] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0191.960] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0191.960] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0191.961] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0191.961] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0191.961] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0191.961] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0191.961] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0191.961] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0191.961] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0191.961] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0191.961] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0191.961] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0191.961] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0191.961] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0191.961] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0191.961] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0191.961] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0191.961] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0191.961] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0191.961] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0191.961] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0191.961] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0191.961] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0191.961] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0191.962] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0191.962] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0191.962] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0191.962] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0191.962] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0191.962] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0191.962] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0191.962] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16
	[0191.962] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15
	[0191.962] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16
	[0191.962] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24
	[0191.962] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17
	[0191.962] _wcsicmp (_String1="taskkill", _String2="CD") returned 17
	[0191.962] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17
	[0191.962] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2
	[0191.962] _wcsicmp (_String1="taskkill", _String2="REN") returned 2
	[0191.962] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15
	[0191.962] _wcsicmp (_String1="taskkill", _String2="SET") returned 1
	[0191.962] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4
	[0191.962] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16
	[0191.962] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8
	[0191.962] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4
	[0191.962] _wcsicmp (_String1="taskkill", _String2="MD") returned 7
	[0191.963] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7
	[0191.963] _wcsicmp (_String1="taskkill", _String2="RD") returned 2
	[0191.963] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2
	[0191.963] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4
	[0191.963] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13
	[0191.963] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1
	[0191.963] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17
	[0191.963] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17
	[0191.963] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2
	[0191.963] _wcsicmp (_String1="taskkill", _String2="VER") returned -2
	[0191.963] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2
	[0191.963] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15
	[0191.963] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1
	[0191.963] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15
	[0191.963] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8
	[0191.963] _wcsicmp (_String1="taskkill", _String2="START") returned 1
	[0191.963] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16
	[0191.963] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9
	[0191.963] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7
	[0191.963] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4
	[0191.963] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4
	[0191.963] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19
	[0191.963] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14
	[0191.963] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18
	[0191.963] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17
	[0191.964] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7
	[0191.964] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14
	[0191.964] _wcsicmp (_String1="taskkill", _String2="IF") returned 11
	[0191.964] _wcsicmp (_String1="taskkill", _String2="REM") returned 2
	[0191.964] GetProcessHeap () returned 0x460000
	[0191.964] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x210) returned 0x46ad00
	[0191.964] GetProcessHeap () returned 0x460000
	[0191.964] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x42) returned 0x46af18
	[0191.964] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17
	[0191.965] GetProcessHeap () returned 0x460000
	[0191.965] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x418) returned 0x4605c8
	[0191.965] SetErrorMode (uMode=0x0) returned 0x8003
	[0191.965] SetErrorMode (uMode=0x1) returned 0x0
	[0191.965] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4605d0, lpFilePart=0x19f57c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x19f57c*="Desktop") returned 0x1d
	[0191.965] SetErrorMode (uMode=0x8003) returned 0x1
	[0191.965] GetProcessHeap () returned 0x460000
	[0191.965] RtlReAllocateHeap (Heap=0x460000, Flags=0x0, Ptr=0x4605c8, Size=0x56) returned 0x4605c8
	[0191.965] GetProcessHeap () returned 0x460000
	[0191.965] RtlSizeHeap (HeapHandle=0x460000, Flags=0x0, MemoryPointer=0x4605c8) returned 0x56
	[0191.965] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63
	[0191.966] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0191.966] GetProcessHeap () returned 0x460000
	[0191.966] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x110) returned 0x46af68
	[0191.966] GetProcessHeap () returned 0x460000
	[0191.966] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x218) returned 0x460628
	[0191.973] GetProcessHeap () returned 0x460000
	[0191.973] RtlReAllocateHeap (Heap=0x460000, Flags=0x0, Ptr=0x460628, Size=0x112) returned 0x460628
	[0191.973] GetProcessHeap () returned 0x460000
	[0191.973] RtlSizeHeap (HeapHandle=0x460000, Flags=0x0, MemoryPointer=0x460628) returned 0x112
	[0191.973] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x13cf4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35
	[0191.973] GetProcessHeap () returned 0x460000
	[0191.973] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xe0) returned 0x46b080
	[0191.976] GetProcessHeap () returned 0x460000
	[0191.976] RtlReAllocateHeap (Heap=0x460000, Flags=0x0, Ptr=0x46b080, Size=0x76) returned 0x46b080
	[0191.976] GetProcessHeap () returned 0x460000
	[0191.976] RtlSizeHeap (HeapHandle=0x460000, Flags=0x0, MemoryPointer=0x46b080) returned 0x76
	[0191.976] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0191.976] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0191.976] GetLastError () returned 0x2
	[0191.976] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0191.977] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x46b100
	[0191.977] GetProcessHeap () returned 0x460000
	[0191.977] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x0, Size=0x14) returned 0x467628
	[0191.977] FindClose (in: hFindFile=0x46b100 | out: hFindFile=0x46b100) returned 1
	[0191.977] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0xffffffff
	[0191.978] GetLastError () returned 0x2
	[0191.978] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f308, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f308) returned 0x46b100
	[0191.978] GetProcessHeap () returned 0x460000
	[0191.978] RtlReAllocateHeap (Heap=0x460000, Flags=0x0, Ptr=0x467628, Size=0x4) returned 0x46b140
	[0191.978] FindClose (in: hFindFile=0x46b100 | out: hFindFile=0x46b100) returned 1
	[0191.978] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0191.978] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0191.978] GetConsoleTitleW (in: lpConsoleTitle=0x19f7fc, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\b40db2ff2f7b61092ec9962bfefe8eca240d3a4238e9e96ebe48e840dcdc5965.exe") returned 0x62
	[0191.982] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f728, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f70c | out: lpAttributeList=0x19f728, lpSize=0x19f70c) returned 1
	[0191.982] UpdateProcThreadAttribute (in: lpAttributeList=0x19f728, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f714, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f728, lpPreviousValue=0x0) returned 1
	[0191.982] GetStartupInfoW (in: lpStartupInfo=0x19f760 | out: lpStartupInfo=0x19f760*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x154, hStdOutput=0x130, hStdError=0x13c)) 
	[0191.982] GetProcessHeap () returned 0x460000
	[0191.982] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x18) returned 0x4674c8
	[0191.982] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0191.982] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0191.983] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0191.983] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0191.983] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0191.983] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0191.983] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0191.983] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0191.983] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0191.983] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0191.983] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0191.983] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0191.983] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0191.983] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0191.983] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0191.983] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0191.983] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0191.983] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0191.983] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0191.983] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0191.983] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0191.983] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0191.983] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0191.983] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0191.983] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0191.984] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0191.984] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0191.984] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0191.984] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0191.984] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0191.984] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0191.984] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0191.984] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0191.984] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0191.984] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0191.984] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0191.984] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0191.984] GetProcessHeap () returned 0x460000
	[0191.984] RtlFreeHeap (HeapHandle=0x460000, Flags=0x0, BaseAddress=0x4674c8) returned 1
	[0191.984] GetProcessHeap () returned 0x460000
	[0191.984] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xa) returned 0x46b100
	[0191.984] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1
	[0191.989] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill  /f /im wordpad.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0x19f6b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill  /f /im wordpad.exe", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f6fc | out: lpCommandLine="taskkill  /f /im wordpad.exe", lpProcessInformation=0x19f6fc*(hProcess=0x9c, hThread=0x98, dwProcessId=0x8f8, dwThreadId=0xd08)) returned 1
	[0192.018] CloseHandle (hObject=0x98) returned 1
	[0192.019] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0192.019] GetProcessHeap () returned 0x460000
	[0192.019] RtlFreeHeap (HeapHandle=0x460000, Flags=0x0, BaseAddress=0x469d50) returned 1
	[0192.019] GetEnvironmentStringsW () returned 0x469d50*
	[0192.019] GetProcessHeap () returned 0x460000
	[0192.019] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xa76) returned 0x467cc0
	[0192.019] FreeEnvironmentStringsA (penv="=") returned 1
	[0192.019] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0
	[0193.285] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x19f694 | out: lpExitCode=0x19f694*=0x80) returned 1
	[0193.285] CloseHandle (hObject=0x9c) returned 1
	[0193.285] _vsnwprintf (in: _Buffer=0x19f77c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f69c | out: _Buffer="00000080") returned 8
	[0193.285] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1
	[0193.286] GetProcessHeap () returned 0x460000
	[0193.286] RtlFreeHeap (HeapHandle=0x460000, Flags=0x0, BaseAddress=0x467cc0) returned 1
	[0193.286] GetEnvironmentStringsW () returned 0x46b150*
	[0193.287] GetProcessHeap () returned 0x460000
	[0193.287] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xa9c) returned 0x467cc0
	[0193.287] FreeEnvironmentStringsA (penv="=") returned 1
	[0193.287] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0193.287] GetProcessHeap () returned 0x460000
	[0193.287] RtlFreeHeap (HeapHandle=0x460000, Flags=0x0, BaseAddress=0x467cc0) returned 1
	[0193.287] GetEnvironmentStringsW () returned 0x46b150*
	[0193.287] GetProcessHeap () returned 0x460000
	[0193.287] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xa9c) returned 0x467cc0
	[0193.288] FreeEnvironmentStringsA (penv="=") returned 1
	[0193.288] GetProcessHeap () returned 0x460000
	[0193.288] RtlFreeHeap (HeapHandle=0x460000, Flags=0x0, BaseAddress=0x46b100) returned 1
	[0193.288] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f728 | out: lpAttributeList=0x19f728) 
	[0193.288] _get_osfhandle (_FileHandle=1) returned 0x130
	[0193.288] SetConsoleMode (hConsoleHandle=0x130, dwMode=0x0) returned 0
	[0193.288] _get_osfhandle (_FileHandle=1) returned 0x130
	[0193.288] GetConsoleMode (in: hConsoleHandle=0x130, lpMode=0x13cf40c | out: lpMode=0x13cf40c) returned 0
	[0193.288] _get_osfhandle (_FileHandle=0) returned 0x154
	[0193.288] GetConsoleMode (in: hConsoleHandle=0x154, lpMode=0x13cf408 | out: lpMode=0x13cf408) returned 0
	[0193.288] GetConsoleOutputCP () returned 0x1b5
	[0193.293] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x13cf460 | out: lpCPInfo=0x13cf460) returned 1
	[0193.293] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0193.295] exit (_Code=128) 

Thread:
	id = 393
	os_tid = 0x1388


Process:
	id = "82"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\syswow64\\taskkill.exe"
	page_root = "0x314dd000"
	os_pid = "0x8f8"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "81"
	os_parent_pid = "0xe50"
	cmd_line = "taskkill  /f /im wordpad.exe"
	cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
	os_username = "XC64ZB\\RDhJ0CNFevzX"
	bitness = "32"
	os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]

Region:
	              id = 5737
	        start_va = 0x10000
	          end_va = 0x2ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000010000"
	        filename = ""

Region:
	              id = 5738
	        start_va = 0x30000
	          end_va = 0x30fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000030000"
	        filename = ""

Region:
	              id = 5739
	        start_va = 0x40000
	          end_va = 0x54fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000040000"
	        filename = ""

Region:
	              id = 5740
	        start_va = 0x60000
	          end_va = 0x9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000060000"
	        filename = ""

Region:
	              id = 5741
	        start_va = 0xa0000
	          end_va = 0xdffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000a0000"
	        filename = ""

Region:
	              id = 5742
	        start_va = 0xe0000
	          end_va = 0xe3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 5743
	        start_va = 0xf0000
	          end_va = 0xf0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000f0000"
	        filename = ""

Region:
	              id = 5744
	        start_va = 0x100000
	          end_va = 0x101fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000100000"
	        filename = ""

Region:
	              id = 5745
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 5746
	        start_va = 0x13b0000
	          end_va = 0x13c5fff
	       monitored = 0
	     entry_point = 0x13bde80
	     region_type = mapped_file
	            name = "taskkill.exe"
	        filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe")

Region:
	              id = 5747
	        start_va = 0x13d0000
	          end_va = 0x53cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000013d0000"
	        filename = ""

Region:
	              id = 5748
	        start_va = 0x77720000
	          end_va = 0x7789afff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")

Region:
	              id = 5749
	        start_va = 0x7ffb0000
	          end_va = 0x7ffd2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007ffb0000"
	        filename = ""

Region:
	              id = 5750
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 5751
	        start_va = 0x7fff0000
	          end_va = 0x7df87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007fff0000"
	        filename = ""

Region:
	              id = 5752
	        start_va = 0x7df87ffa0000
	          end_va = 0x7ff87ff9ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df87ffa0000"
	        filename = ""

Region:
	              id = 5753
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")

Region:
	              id = 5754
	        start_va = 0x7ff880161000
	          end_va = 0x7ffffffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00007ff880161000"
	        filename = ""

Region:
	              id = 5755
	        start_va = 0x590000
	          end_va = 0x59ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000590000"
	        filename = ""

Region:
	              id = 5756
	        start_va = 0x662d0000
	          end_va = 0x66349fff
	       monitored = 0
	     entry_point = 0x662e3290
	     region_type = mapped_file
	            name = "wow64win.dll"
	        filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")

Region:
	              id = 5757
	        start_va = 0x66350000
	          end_va = 0x6639ffff
	       monitored = 0
	     entry_point = 0x66368180
	     region_type = mapped_file
	            name = "wow64.dll"
	        filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")

Region:
	              id = 5758
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 5759
	        start_va = 0x663a0000
	          end_va = 0x663a7fff
	       monitored = 0
	     entry_point = 0x663a17c0
	     region_type = mapped_file
	            name = "wow64cpu.dll"
	        filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")

Region:
	              id = 5760
	        start_va = 0x5a0000
	          end_va = 0x76ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005a0000"
	        filename = ""

Region:
	              id = 5761
	        start_va = 0x75600000
	          end_va = 0x756dffff
	       monitored = 0
	     entry_point = 0x75613980
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")

Region:
	              id = 5762
	        start_va = 0x75480000
	          end_va = 0x755fdfff
	       monitored = 0
	     entry_point = 0x75531b90
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")

Region:
	              id = 5763
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 5764
	        start_va = 0x7feb0000
	          end_va = 0x7ffaffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x000000007feb0000"
	        filename = ""

Region:
	              id = 5765
	        start_va = 0x110000
	          end_va = 0x1cdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 5766
	        start_va = 0x20000
	          end_va = 0x23fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000020000"
	        filename = ""

Region:
	              id = 5767
	        start_va = 0x74650000
	          end_va = 0x746cafff
	       monitored = 0
	     entry_point = 0x7466e970
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")

Region:
	              id = 5768
	        start_va = 0x748c0000
	          end_va = 0x7497dfff
	       monitored = 0
	     entry_point = 0x748f5630
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")

Region:
	              id = 5769
	        start_va = 0x400000
	          end_va = 0x43ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 5770
	        start_va = 0x440000
	          end_va = 0x47ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000440000"
	        filename = ""

Region:
	              id = 5771
	        start_va = 0x76ae0000
	          end_va = 0x76b23fff
	       monitored = 0
	     entry_point = 0x76af9d80
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")

Region:
	              id = 5772
	        start_va = 0x75260000
	          end_va = 0x7530cfff
	       monitored = 0
	     entry_point = 0x75274f00
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")

Region:
	              id = 5773
	        start_va = 0x74450000
	          end_va = 0x7446dfff
	       monitored = 0
	     entry_point = 0x7445b640
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")

Region:
	              id = 5774
	        start_va = 0x74440000
	          end_va = 0x74449fff
	       monitored = 0
	     entry_point = 0x74442a00
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")

Region:
	              id = 5775
	        start_va = 0x74590000
	          end_va = 0x745e7fff
	       monitored = 0
	     entry_point = 0x745d25c0
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")

Region:
	              id = 5776
	        start_va = 0x77450000
	          end_va = 0x77596fff
	       monitored = 0
	     entry_point = 0x77461cf0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")

Region:
	              id = 5777
	        start_va = 0x76b30000
	          end_va = 0x76c7efff
	       monitored = 0
	     entry_point = 0x76be6820
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")

Region:
	              id = 5778
	        start_va = 0x753c0000
	          end_va = 0x75451fff
	       monitored = 0
	     entry_point = 0x753f8cf0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")

Region:
	              id = 5779
	        start_va = 0x77290000
	          end_va = 0x7744cfff
	       monitored = 0
	     entry_point = 0x77372a10
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")

Region:
	              id = 5780
	        start_va = 0x75310000
	          end_va = 0x7536efff
	       monitored = 0
	     entry_point = 0x75314af0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")

Region:
	              id = 5781
	        start_va = 0x77240000
	          end_va = 0x77284fff
	       monitored = 0
	     entry_point = 0x7725de90
	     region_type = mapped_file
	            name = "shlwapi.dll"
	        filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")

Region:
	              id = 5782
	        start_va = 0x6cc90000
	          end_va = 0x6cc97fff
	       monitored = 0
	     entry_point = 0x6cc917b0
	     region_type = mapped_file
	            name = "version.dll"
	        filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")

Region:
	              id = 5783
	        start_va = 0x6cc70000
	          end_va = 0x6cc85fff
	       monitored = 0
	     entry_point = 0x6cc721d0
	     region_type = mapped_file
	            name = "mpr.dll"
	        filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll")

Region:
	              id = 5784
	        start_va = 0x6cc30000
	          end_va = 0x6cc6efff
	       monitored = 0
	     entry_point = 0x6cc446c0
	     region_type = mapped_file
	            name = "framedynos.dll"
	        filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll")

Region:
	              id = 5785
	        start_va = 0x6caf0000
	          end_va = 0x6cc2efff
	       monitored = 0
	     entry_point = 0x6cb1d880
	     region_type = mapped_file
	            name = "dbghelp.dll"
	        filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll")

Region:
	              id = 5786
	        start_va = 0x6cad0000
	          end_va = 0x6caebfff
	       monitored = 0
	     entry_point = 0x6cad4720
	     region_type = mapped_file
	            name = "srvcli.dll"
	        filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll")

Region:
	              id = 5787
	        start_va = 0x6cac0000
	          end_va = 0x6cac9fff
	       monitored = 0
	     entry_point = 0x6cac28d0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll")

Region:
	              id = 5788
	        start_va = 0x480000
	          end_va = 0x57ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 5789
	        start_va = 0x1d0000
	          end_va = 0x1f9fff
	       monitored = 0
	     entry_point = 0x1d5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 5790
	        start_va = 0x770000
	          end_va = 0x8f7fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000770000"
	        filename = ""

Region:
	              id = 5791
	        start_va = 0x74ea0000
	          end_va = 0x74ecafff
	       monitored = 0
	     entry_point = 0x74ea5680
	     region_type = mapped_file
	            name = "imm32.dll"
	        filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")

Region:
	              id = 5792
	        start_va = 0x900000
	          end_va = 0xa80fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000900000"
	        filename = ""

Region:
	              id = 5793
	        start_va = 0x53d0000
	          end_va = 0x67cffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000053d0000"
	        filename = ""

Region:
	              id = 5794
	        start_va = 0x30000
	          end_va = 0x31fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 5795
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001d0000"
	        filename = ""

Region:
	              id = 5796
	        start_va = 0x1e0000
	          end_va = 0x1e4fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "taskkill.exe.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui")

Region:
	              id = 5797
	        start_va = 0x1f0000
	          end_va = 0x1f0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001f0000"
	        filename = ""

Region:
	              id = 5798
	        start_va = 0x480000
	          end_va = 0x480fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000480000"
	        filename = ""

Region:
	              id = 5799
	        start_va = 0x570000
	          end_va = 0x57ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000570000"
	        filename = ""

Region:
	              id = 5800
	        start_va = 0xa90000
	          end_va = 0xdc6fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 5801
	        start_va = 0xdd0000
	          end_va = 0xeb9fff
	       monitored = 0
	     entry_point = 0xe0d650
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")

Region:
	              id = 5802
	        start_va = 0x490000
	          end_va = 0x493fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000490000"
	        filename = ""

Region:
	              id = 5803
	        start_va = 0xdd0000
	          end_va = 0xeaffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")

Region:
	              id = 5804
	        start_va = 0x76e20000
	          end_va = 0x76e2bfff
	       monitored = 0
	     entry_point = 0x76e23930
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")

Region:
	              id = 5805
	        start_va = 0x4a0000
	          end_va = 0x4a0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004a0000"
	        filename = ""

Region:
	              id = 5806
	        start_va = 0x76c80000
	          end_va = 0x76d03fff
	       monitored = 0
	     entry_point = 0x76ca6220
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")

Region:
	              id = 5807
	        start_va = 0x4b0000
	          end_va = 0x4b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000004b0000"
	        filename = ""

Region:
	              id = 5808
	        start_va = 0x6cab0000
	          end_va = 0x6cabcfff
	       monitored = 0
	     entry_point = 0x6cab3520
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")

Region:
	              id = 5809
	        start_va = 0x6ca40000
	          end_va = 0x6caa6fff
	       monitored = 0
	     entry_point = 0x6ca5b610
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")

Region:
	              id = 5810
	        start_va = 0x740f0000
	          end_va = 0x7410afff
	       monitored = 0
	     entry_point = 0x740f9050
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")

Region:
	              id = 5811
	        start_va = 0x6c9f0000
	          end_va = 0x6ca33fff
	       monitored = 0
	     entry_point = 0x6ca0aaf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")

Region:
	              id = 5812
	        start_va = 0x4c0000
	          end_va = 0x4fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000004c0000"
	        filename = ""

Region:
	              id = 5813
	        start_va = 0x500000
	          end_va = 0x53ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000500000"
	        filename = ""

Region:
	              id = 5814
	        start_va = 0x5a0000
	          end_va = 0x5dffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005a0000"
	        filename = ""

Region:
	              id = 5815
	        start_va = 0x5e0000
	          end_va = 0x61ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005e0000"
	        filename = ""

Region:
	              id = 5816
	        start_va = 0x620000
	          end_va = 0x65ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000620000"
	        filename = ""

Region:
	              id = 5817
	        start_va = 0x670000
	          end_va = 0x76ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000670000"
	        filename = ""

Region:
	              id = 5818
	        start_va = 0xeb0000
	          end_va = 0xeeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000eb0000"
	        filename = ""

Region:
	              id = 5819
	        start_va = 0x6c9d0000
	          end_va = 0x6c9e0fff
	       monitored = 0
	     entry_point = 0x6c9d8fa0
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")

Region:
	              id = 5820
	        start_va = 0x6c910000
	          end_va = 0x6c9cefff
	       monitored = 0
	     entry_point = 0x6c941e80
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")

Region:
	              id = 5822
	        start_va = 0x540000
	          end_va = 0x545fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000540000"
	        filename = ""


Thread:
	id = 394
	os_tid = 0xd08


Thread:
	id = 395
	os_tid = 0xbfc


Thread:
	id = 396
	os_tid = 0x700


Thread:
	id = 397
	os_tid = 0x368


Thread:
	id = 398
	os_tid = 0xac8


Process:
	id = "83"
	image_name = "svchost.exe"
	filename = "c:\\windows\\system32\\svchost.exe"
	page_root = "0x75321000"
	os_pid = "0x378"
	os_integrity_level = "0x4000"
	os_privileges = "0x60800000"
	monitor_reason = "rpc_server"
	parent_id = "5"
	os_parent_pid = "0x214"
	cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalServiceNetworkRestricted"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\Local Service"
	bitness = "32"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AppIDSvc" [0xa], "NT SERVICE\\Audiosrv" [0xa], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xa], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\icssvc" [0xa], "NT SERVICE\\lmhosts" [0xe], "NT SERVICE\\NgcCtnrSvc" [0xa], "NT SERVICE\\vmictimesync" [0xa], "NT SERVICE\\Wcmsvc" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000c224" [0xc000000f], "LOCAL" [0x7]

Region:
	              id = 5837
	        start_va = 0x10000
	          end_va = 0x1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000010000"
	        filename = ""

Region:
	              id = 5838
	        start_va = 0x20000
	          end_va = 0x21fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000020000"
	        filename = ""

Region:
	              id = 5839
	        start_va = 0x30000
	          end_va = 0x44fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000030000"
	        filename = ""

Region:
	              id = 5840
	        start_va = 0x50000
	          end_va = 0xcffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000050000"
	        filename = ""

Region:
	              id = 5841
	        start_va = 0xd0000
	          end_va = 0xd3fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000d0000"
	        filename = ""

Region:
	              id = 5842
	        start_va = 0xe0000
	          end_va = 0xe0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000000e0000"
	        filename = ""

Region:
	              id = 5843
	        start_va = 0xf0000
	          end_va = 0xf1fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000000f0000"
	        filename = ""

Region:
	              id = 5844
	        start_va = 0x100000
	          end_va = 0x1bdfff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "locale.nls"
	        filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")

Region:
	              id = 5845
	        start_va = 0x1c0000
	          end_va = 0x1c0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001c0000"
	        filename = ""

Region:
	              id = 5846
	        start_va = 0x1d0000
	          end_va = 0x1d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001d0000"
	        filename = ""

Region:
	              id = 5847
	        start_va = 0x1e0000
	          end_va = 0x1e0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000001e0000"
	        filename = ""

Region:
	              id = 5848
	        start_va = 0x1f0000
	          end_va = 0x1f0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000001f0000"
	        filename = ""

Region:
	              id = 5849
	        start_va = 0x200000
	          end_va = 0x3fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000200000"
	        filename = ""

Region:
	              id = 5850
	        start_va = 0x400000
	          end_va = 0x47ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000400000"
	        filename = ""

Region:
	              id = 5851
	        start_va = 0x480000
	          end_va = 0x53ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000480000"
	        filename = ""

Region:
	              id = 5852
	        start_va = 0x540000
	          end_va = 0x55ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000540000"
	        filename = ""

Region:
	              id = 5853
	        start_va = 0x560000
	          end_va = 0x57ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000560000"
	        filename = ""

Region:
	              id = 5854
	        start_va = 0x580000
	          end_va = 0x59ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000580000"
	        filename = ""

Region:
	              id = 5855
	        start_va = 0x5a0000
	          end_va = 0x5a6fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005a0000"
	        filename = ""

Region:
	              id = 5856
	        start_va = 0x5b0000
	          end_va = 0x5b0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000005b0000"
	        filename = ""

Region:
	              id = 5857
	        start_va = 0x5c0000
	          end_va = 0x5c0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005c0000"
	        filename = ""

Region:
	              id = 5858
	        start_va = 0x5d0000
	          end_va = 0x5d0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000005d0000"
	        filename = ""

Region:
	              id = 5859
	        start_va = 0x5e0000
	          end_va = 0x5e0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000005e0000"
	        filename = ""

Region:
	              id = 5860
	        start_va = 0x5f0000
	          end_va = 0x5f0fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00000000005f0000"
	        filename = ""

Region:
	              id = 5861
	        start_va = 0x600000
	          end_va = 0x6fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000600000"
	        filename = ""

Region:
	              id = 5862
	        start_va = 0x700000
	          end_va = 0x77ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000700000"
	        filename = ""

Region:
	              id = 5863
	        start_va = 0x800000
	          end_va = 0x800fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000800000"
	        filename = ""

Region:
	              id = 5864
	        start_va = 0x860000
	          end_va = 0x866fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000860000"
	        filename = ""

Region:
	              id = 5865
	        start_va = 0x870000
	          end_va = 0x8d3fff
	       monitored = 0
	     entry_point = 0x885ae0
	     region_type = mapped_file
	            name = "wevtapi.dll"
	        filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll")

Region:
	              id = 5866
	        start_va = 0x900000
	          end_va = 0x9fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000000900000"
	        filename = ""

Region:
	              id = 5867
	        start_va = 0xa00000
	          end_va = 0xb87fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000a00000"
	        filename = ""

Region:
	              id = 5868
	        start_va = 0xb90000
	          end_va = 0xd10fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000b90000"
	        filename = ""

Region:
	              id = 5869
	        start_va = 0xd20000
	          end_va = 0x111afff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x0000000000d20000"
	        filename = ""

Region:
	              id = 5870
	        start_va = 0x1220000
	          end_va = 0x129ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001220000"
	        filename = ""

Region:
	              id = 5871
	        start_va = 0x12b0000
	          end_va = 0x12b6fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000012b0000"
	        filename = ""

Region:
	              id = 5872
	        start_va = 0x1300000
	          end_va = 0x13fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001300000"
	        filename = ""

Region:
	              id = 5873
	        start_va = 0x1400000
	          end_va = 0x147ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001400000"
	        filename = ""

Region:
	              id = 5874
	        start_va = 0x1480000
	          end_va = 0x14fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001480000"
	        filename = ""

Region:
	              id = 5875
	        start_va = 0x1500000
	          end_va = 0x15fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001500000"
	        filename = ""

Region:
	              id = 5876
	        start_va = 0x16d0000
	          end_va = 0x16d6fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x00000000016d0000"
	        filename = ""

Region:
	              id = 5877
	        start_va = 0x1700000
	          end_va = 0x17fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001700000"
	        filename = ""

Region:
	              id = 5878
	        start_va = 0x1800000
	          end_va = 0x187ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001800000"
	        filename = ""

Region:
	              id = 5879
	        start_va = 0x1880000
	          end_va = 0x18fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001880000"
	        filename = ""

Region:
	              id = 5880
	        start_va = 0x1900000
	          end_va = 0x197ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001900000"
	        filename = ""

Region:
	              id = 5881
	        start_va = 0x1980000
	          end_va = 0x19fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001980000"
	        filename = ""

Region:
	              id = 5882
	        start_va = 0x1a00000
	          end_va = 0x1afffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001a00000"
	        filename = ""

Region:
	              id = 5883
	        start_va = 0x1b90000
	          end_va = 0x1c8ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001b90000"
	        filename = ""

Region:
	              id = 5884
	        start_va = 0x1d00000
	          end_va = 0x1dfffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001d00000"
	        filename = ""

Region:
	              id = 5885
	        start_va = 0x1e00000
	          end_va = 0x1efffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000001e00000"
	        filename = ""

Region:
	              id = 5886
	        start_va = 0x2000000
	          end_va = 0x20fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002000000"
	        filename = ""

Region:
	              id = 5887
	        start_va = 0x2100000
	          end_va = 0x21fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002100000"
	        filename = ""

Region:
	              id = 5888
	        start_va = 0x2200000
	          end_va = 0x22fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002200000"
	        filename = ""

Region:
	              id = 5889
	        start_va = 0x2300000
	          end_va = 0x2636fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "sortdefault.nls"
	        filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")

Region:
	              id = 5890
	        start_va = 0x2640000
	          end_va = 0x273ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002640000"
	        filename = ""

Region:
	              id = 5891
	        start_va = 0x2740000
	          end_va = 0x281ffff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "kernelbase.dll.mui"
	        filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui")

Region:
	              id = 5892
	        start_va = 0x2820000
	          end_va = 0x291ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002820000"
	        filename = ""

Region:
	              id = 5893
	        start_va = 0x2a20000
	          end_va = 0x2b1ffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002a20000"
	        filename = ""

Region:
	              id = 5894
	        start_va = 0x2c00000
	          end_va = 0x2cfffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002c00000"
	        filename = ""

Region:
	              id = 5895
	        start_va = 0x2d00000
	          end_va = 0x2dfffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002d00000"
	        filename = ""

Region:
	              id = 5896
	        start_va = 0x2e00000
	          end_va = 0x2efffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002e00000"
	        filename = ""

Region:
	              id = 5897
	        start_va = 0x2f00000
	          end_va = 0x2ffffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000002f00000"
	        filename = ""

Region:
	              id = 5898
	        start_va = 0x3000000
	          end_va = 0x30fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003000000"
	        filename = ""

Region:
	              id = 5899
	        start_va = 0x3100000
	          end_va = 0x31fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003100000"
	        filename = ""

Region:
	              id = 5900
	        start_va = 0x3200000
	          end_va = 0x32fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003200000"
	        filename = ""

Region:
	              id = 5901
	        start_va = 0x3300000
	          end_va = 0x33fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003300000"
	        filename = ""

Region:
	              id = 5902
	        start_va = 0x3400000
	          end_va = 0x34fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003400000"
	        filename = ""

Region:
	              id = 5903
	        start_va = 0x3500000
	          end_va = 0x35fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003500000"
	        filename = ""

Region:
	              id = 5904
	        start_va = 0x3600000
	          end_va = 0x36fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003600000"
	        filename = ""

Region:
	              id = 5905
	        start_va = 0x3700000
	          end_va = 0x37fffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003700000"
	        filename = ""

Region:
	              id = 5906
	        start_va = 0x3a00000
	          end_va = 0x3afffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003a00000"
	        filename = ""

Region:
	              id = 5907
	        start_va = 0x3e00000
	          end_va = 0x3efffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x0000000003e00000"
	        filename = ""

Region:
	              id = 5908
	        start_va = 0x7ffe0000
	          end_va = 0x7ffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = private
	            name = "private_0x000000007ffe0000"
	        filename = ""

Region:
	              id = 5909
	        start_va = 0x7df5ffec0000
	          end_va = 0x7df5fffbffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df5ffec0000"
	        filename = ""

Region:
	              id = 5910
	        start_va = 0x7df5fffc0000
	          end_va = 0x7df5fffe2fff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df5fffc0000"
	        filename = ""

Region:
	              id = 5911
	        start_va = 0x7df5ffff0000
	          end_va = 0x7ff5fffeffff
	       monitored = 1
	     entry_point = 0x0
	     region_type = pagefile_backed
	            name = "pagefile_0x00007df5ffff0000"
	        filename = ""

Region:
	              id = 5912
	        start_va = 0x7ff6a3140000
	          end_va = 0x7ff6a314cfff
	       monitored = 0
	     entry_point = 0x7ff6a3143980
	     region_type = mapped_file
	            name = "svchost.exe"
	        filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe")

Region:
	              id = 5913
	        start_va = 0x7ff865740000
	          end_va = 0x7ff865772fff
	       monitored = 0
	     entry_point = 0x7ff86574ae20
	     region_type = mapped_file
	            name = "wscsvc.dll"
	        filename = "\\Windows\\System32\\wscsvc.dll" (normalized: "c:\\windows\\system32\\wscsvc.dll")

Region:
	              id = 5914
	        start_va = 0x7ff866b90000
	          end_va = 0x7ff866d47fff
	       monitored = 0
	     entry_point = 0x7ff866b95550
	     region_type = mapped_file
	            name = "wmalfxgfxdsp.dll"
	        filename = "\\Windows\\System32\\WMALFXGFXDSP.dll" (normalized: "c:\\windows\\system32\\wmalfxgfxdsp.dll")

Region:
	              id = 5915
	        start_va = 0x7ff867de0000
	          end_va = 0x7ff867e67fff
	       monitored = 0
	     entry_point = 0x7ff867df4510
	     region_type = mapped_file
	            name = "audioses.dll"
	        filename = "\\Windows\\System32\\AudioSes.dll" (normalized: "c:\\windows\\system32\\audioses.dll")

Region:
	              id = 5916
	        start_va = 0x7ff86e970000
	          end_va = 0x7ff86e983fff
	       monitored = 0
	     entry_point = 0x7ff86e971800
	     region_type = mapped_file
	            name = "wbemsvc.dll"
	        filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll")

Region:
	              id = 5917
	        start_va = 0x7ff86e990000
	          end_va = 0x7ff86ea85fff
	       monitored = 0
	     entry_point = 0x7ff86e9c9590
	     region_type = mapped_file
	            name = "fastprox.dll"
	        filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll")

Region:
	              id = 5918
	        start_va = 0x7ff86efa0000
	          end_va = 0x7ff86efb0fff
	       monitored = 0
	     entry_point = 0x7ff86efa2fc0
	     region_type = mapped_file
	            name = "wbemprox.dll"
	        filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll")

Region:
	              id = 5919
	        start_va = 0x7ff870c70000
	          end_va = 0x7ff870ceefff
	       monitored = 0
	     entry_point = 0x7ff870c87110
	     region_type = mapped_file
	            name = "wbemcomn.dll"
	        filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll")

Region:
	              id = 5920
	        start_va = 0x7ff874560000
	          end_va = 0x7ff87458afff
	       monitored = 0
	     entry_point = 0x7ff87456c3c0
	     region_type = mapped_file
	            name = "rtworkq.dll"
	        filename = "\\Windows\\System32\\RTWorkQ.dll" (normalized: "c:\\windows\\system32\\rtworkq.dll")

Region:
	              id = 5921
	        start_va = 0x7ff874590000
	          end_va = 0x7ff87469cfff
	       monitored = 0
	     entry_point = 0x7ff8745bf420
	     region_type = mapped_file
	            name = "mfplat.dll"
	        filename = "\\Windows\\System32\\mfplat.dll" (normalized: "c:\\windows\\system32\\mfplat.dll")

Region:
	              id = 5922
	        start_va = 0x7ff8750d0000
	          end_va = 0x7ff8750dafff
	       monitored = 0
	     entry_point = 0x7ff8750d1d30
	     region_type = mapped_file
	            name = "winnsi.dll"
	        filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll")

Region:
	              id = 5923
	        start_va = 0x7ff8750e0000
	          end_va = 0x7ff875127fff
	       monitored = 0
	     entry_point = 0x7ff8750ea1e0
	     region_type = mapped_file
	            name = "dhcpcore6.dll"
	        filename = "\\Windows\\System32\\dhcpcore6.dll" (normalized: "c:\\windows\\system32\\dhcpcore6.dll")

Region:
	              id = 5924
	        start_va = 0x7ff875250000
	          end_va = 0x7ff875269fff
	       monitored = 0
	     entry_point = 0x7ff875252430
	     region_type = mapped_file
	            name = "dhcpcsvc.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll")

Region:
	              id = 5925
	        start_va = 0x7ff875270000
	          end_va = 0x7ff875285fff
	       monitored = 0
	     entry_point = 0x7ff8752719f0
	     region_type = mapped_file
	            name = "dhcpcsvc6.dll"
	        filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll")

Region:
	              id = 5926
	        start_va = 0x7ff8752d0000
	          end_va = 0x7ff8752ddfff
	       monitored = 0
	     entry_point = 0x7ff8752d2e50
	     region_type = mapped_file
	            name = "cmintegrator.dll"
	        filename = "\\Windows\\System32\\cmintegrator.dll" (normalized: "c:\\windows\\system32\\cmintegrator.dll")

Region:
	              id = 5927
	        start_va = 0x7ff8752e0000
	          end_va = 0x7ff875317fff
	       monitored = 0
	     entry_point = 0x7ff8752e68f0
	     region_type = mapped_file
	            name = "wcmcsp.dll"
	        filename = "\\Windows\\System32\\wcmcsp.dll" (normalized: "c:\\windows\\system32\\wcmcsp.dll")

Region:
	              id = 5928
	        start_va = 0x7ff875480000
	          end_va = 0x7ff8754b7fff
	       monitored = 0
	     entry_point = 0x7ff875498cc0
	     region_type = mapped_file
	            name = "iphlpapi.dll"
	        filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll")

Region:
	              id = 5929
	        start_va = 0x7ff8754c0000
	          end_va = 0x7ff875558fff
	       monitored = 0
	     entry_point = 0x7ff8754da090
	     region_type = mapped_file
	            name = "wcmsvc.dll"
	        filename = "\\Windows\\System32\\wcmsvc.dll" (normalized: "c:\\windows\\system32\\wcmsvc.dll")

Region:
	              id = 5930
	        start_va = 0x7ff875ae0000
	          end_va = 0x7ff875b3cfff
	       monitored = 0
	     entry_point = 0x7ff875af2bf0
	     region_type = mapped_file
	            name = "dhcpcore.dll"
	        filename = "\\Windows\\System32\\dhcpcore.dll" (normalized: "c:\\windows\\system32\\dhcpcore.dll")

Region:
	              id = 5931
	        start_va = 0x7ff875b50000
	          end_va = 0x7ff875c5afff
	       monitored = 0
	     entry_point = 0x7ff875b92610
	     region_type = mapped_file
	            name = "audiosrv.dll"
	        filename = "\\Windows\\System32\\audiosrv.dll" (normalized: "c:\\windows\\system32\\audiosrv.dll")

Region:
	              id = 5932
	        start_va = 0x7ff875d20000
	          end_va = 0x7ff875d30fff
	       monitored = 0
	     entry_point = 0x7ff875d23320
	     region_type = mapped_file
	            name = "wmiclnt.dll"
	        filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll")

Region:
	              id = 5933
	        start_va = 0x7ff876870000
	          end_va = 0x7ff8769a5fff
	       monitored = 0
	     entry_point = 0x7ff87689f350
	     region_type = mapped_file
	            name = "wintypes.dll"
	        filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll")

Region:
	              id = 5934
	        start_va = 0x7ff878090000
	          end_va = 0x7ff8780fffff
	       monitored = 0
	     entry_point = 0x7ff8780b2960
	     region_type = mapped_file
	            name = "mmdevapi.dll"
	        filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll")

Region:
	              id = 5935
	        start_va = 0x7ff8786b0000
	          end_va = 0x7ff8786c7fff
	       monitored = 0
	     entry_point = 0x7ff8786b5910
	     region_type = mapped_file
	            name = "nlaapi.dll"
	        filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll")

Region:
	              id = 5936
	        start_va = 0x7ff878960000
	          end_va = 0x7ff878b10fff
	       monitored = 0
	     entry_point = 0x7ff8789b3690
	     region_type = mapped_file
	            name = "wevtsvc.dll"
	        filename = "\\Windows\\System32\\wevtsvc.dll" (normalized: "c:\\windows\\system32\\wevtsvc.dll")

Region:
	              id = 5937
	        start_va = 0x7ff878b20000
	          end_va = 0x7ff878be7fff
	       monitored = 0
	     entry_point = 0x7ff878b613f0
	     region_type = mapped_file
	            name = "winhttp.dll"
	        filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll")

Region:
	              id = 5938
	        start_va = 0x7ff878df0000
	          end_va = 0x7ff878e39fff
	       monitored = 0
	     entry_point = 0x7ff878dfac30
	     region_type = mapped_file
	            name = "deviceaccess.dll"
	        filename = "\\Windows\\System32\\deviceaccess.dll" (normalized: "c:\\windows\\system32\\deviceaccess.dll")

Region:
	              id = 5939
	        start_va = 0x7ff8798b0000
	          end_va = 0x7ff8798b8fff
	       monitored = 0
	     entry_point = 0x7ff8798b19a0
	     region_type = mapped_file
	            name = "nrpsrv.dll"
	        filename = "\\Windows\\System32\\nrpsrv.dll" (normalized: "c:\\windows\\system32\\nrpsrv.dll")

Region:
	              id = 5940
	        start_va = 0x7ff8798c0000
	          end_va = 0x7ff8798cafff
	       monitored = 0
	     entry_point = 0x7ff8798c1cd0
	     region_type = mapped_file
	            name = "lmhsvc.dll"
	        filename = "\\Windows\\System32\\lmhsvc.dll" (normalized: "c:\\windows\\system32\\lmhsvc.dll")

Region:
	              id = 5941
	        start_va = 0x7ff87ab10000
	          end_va = 0x7ff87ac95fff
	       monitored = 0
	     entry_point = 0x7ff87ab5d700
	     region_type = mapped_file
	            name = "propsys.dll"
	        filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll")

Region:
	              id = 5942
	        start_va = 0x7ff87ad00000
	          end_va = 0x7ff87ad12fff
	       monitored = 0
	     entry_point = 0x7ff87ad02760
	     region_type = mapped_file
	            name = "wtsapi32.dll"
	        filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll")

Region:
	              id = 5943
	        start_va = 0x7ff87afe0000
	          end_va = 0x7ff87b006fff
	       monitored = 0
	     entry_point = 0x7ff87afe7940
	     region_type = mapped_file
	            name = "devobj.dll"
	        filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll")

Region:
	              id = 5944
	        start_va = 0x7ff87b030000
	          end_va = 0x7ff87b0d9fff
	       monitored = 0
	     entry_point = 0x7ff87b057910
	     region_type = mapped_file
	            name = "dnsapi.dll"
	        filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll")

Region:
	              id = 5945
	        start_va = 0x7ff87b340000
	          end_va = 0x7ff87b371fff
	       monitored = 0
	     entry_point = 0x7ff87b352340
	     region_type = mapped_file
	            name = "fwbase.dll"
	        filename = "\\Windows\\System32\\fwbase.dll" (normalized: "c:\\windows\\system32\\fwbase.dll")

Region:
	              id = 5946
	        start_va = 0x7ff87b5c0000
	          end_va = 0x7ff87b5e3fff
	       monitored = 0
	     entry_point = 0x7ff87b5c3260
	     region_type = mapped_file
	            name = "gpapi.dll"
	        filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll")

Region:
	              id = 5947
	        start_va = 0x7ff87b760000
	          end_va = 0x7ff87b853fff
	       monitored = 0
	     entry_point = 0x7ff87b76a960
	     region_type = mapped_file
	            name = "ucrtbase.dll"
	        filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll")

Region:
	              id = 5948
	        start_va = 0x7ff87b9d0000
	          end_va = 0x7ff87b9dbfff
	       monitored = 0
	     entry_point = 0x7ff87b9d27e0
	     region_type = mapped_file
	            name = "netutils.dll"
	        filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll")

Region:
	              id = 5949
	        start_va = 0x7ff87bab0000
	          end_va = 0x7ff87bae0fff
	       monitored = 0
	     entry_point = 0x7ff87bab7d10
	     region_type = mapped_file
	            name = "ntmarta.dll"
	        filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll")

Region:
	              id = 5950
	        start_va = 0x7ff87bd20000
	          end_va = 0x7ff87bd3efff
	       monitored = 0
	     entry_point = 0x7ff87bd25d30
	     region_type = mapped_file
	            name = "userenv.dll"
	        filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll")

Region:
	              id = 5951
	        start_va = 0x7ff87be90000
	          end_va = 0x7ff87beebfff
	       monitored = 0
	     entry_point = 0x7ff87bea6f70
	     region_type = mapped_file
	            name = "mswsock.dll"
	        filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll")

Region:
	              id = 5952
	        start_va = 0x7ff87c060000
	          end_va = 0x7ff87c06afff
	       monitored = 0
	     entry_point = 0x7ff87c0619a0
	     region_type = mapped_file
	            name = "cryptbase.dll"
	        filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")

Region:
	              id = 5953
	        start_va = 0x7ff87c240000
	          end_va = 0x7ff87c26cfff
	       monitored = 0
	     entry_point = 0x7ff87c259d40
	     region_type = mapped_file
	            name = "sspicli.dll"
	        filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")

Region:
	              id = 5954
	        start_va = 0x7ff87c3d0000
	          end_va = 0x7ff87c425fff
	       monitored = 0
	     entry_point = 0x7ff87c3e0bf0
	     region_type = mapped_file
	            name = "winsta.dll"
	        filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll")

Region:
	              id = 5955
	        start_va = 0x7ff87c450000
	          end_va = 0x7ff87c478fff
	       monitored = 0
	     entry_point = 0x7ff87c464530
	     region_type = mapped_file
	            name = "bcrypt.dll"
	        filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")

Region:
	              id = 5956
	        start_va = 0x7ff87c5c0000
	          end_va = 0x7ff87c5cffff
	       monitored = 0
	     entry_point = 0x7ff87c5c56e0
	     region_type = mapped_file
	            name = "msasn1.dll"
	        filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")

Region:
	              id = 5957
	        start_va = 0x7ff87c5d0000
	          end_va = 0x7ff87c5e3fff
	       monitored = 0
	     entry_point = 0x7ff87c5d52e0
	     region_type = mapped_file
	            name = "profapi.dll"
	        filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")

Region:
	              id = 5958
	        start_va = 0x7ff87c5f0000
	          end_va = 0x7ff87c63afff
	       monitored = 0
	     entry_point = 0x7ff87c5f35f0
	     region_type = mapped_file
	            name = "powrprof.dll"
	        filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")

Region:
	              id = 5959
	        start_va = 0x7ff87c640000
	          end_va = 0x7ff87c64efff
	       monitored = 0
	     entry_point = 0x7ff87c643210
	     region_type = mapped_file
	            name = "kernel.appcore.dll"
	        filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")

Region:
	              id = 5960
	        start_va = 0x7ff87c710000
	          end_va = 0x7ff87c752fff
	       monitored = 0
	     entry_point = 0x7ff87c724b50
	     region_type = mapped_file
	            name = "cfgmgr32.dll"
	        filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")

Region:
	              id = 5961
	        start_va = 0x7ff87cdb0000
	          end_va = 0x7ff87ce35fff
	       monitored = 0
	     entry_point = 0x7ff87cdbd8f0
	     region_type = mapped_file
	            name = "firewallapi.dll"
	        filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll")

Region:
	              id = 5962
	        start_va = 0x7ff87ce40000
	          end_va = 0x7ff87d027fff
	       monitored = 0
	     entry_point = 0x7ff87ce6ba70
	     region_type = mapped_file
	            name = "kernelbase.dll"
	        filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")

Region:
	              id = 5963
	        start_va = 0x7ff87d030000
	          end_va = 0x7ff87d099fff
	       monitored = 0
	     entry_point = 0x7ff87d066d50
	     region_type = mapped_file
	            name = "bcryptprimitives.dll"
	        filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")

Region:
	              id = 5964
	        start_va = 0x7ff87d170000
	          end_va = 0x7ff87d336fff
	       monitored = 0
	     entry_point = 0x7ff87d1cdb80
	     region_type = mapped_file
	            name = "crypt32.dll"
	        filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")

Region:
	              id = 5965
	        start_va = 0x7ff87d3a0000
	          end_va = 0x7ff87d4e2fff
	       monitored = 0
	     entry_point = 0x7ff87d3c8210
	     region_type = mapped_file
	            name = "ole32.dll"
	        filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")

Region:
	              id = 5966
	        start_va = 0x7ff87ed60000
	          end_va = 0x7ff87eeb5fff
	       monitored = 0
	     entry_point = 0x7ff87ed6a8d0
	     region_type = mapped_file
	            name = "user32.dll"
	        filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")

Region:
	              id = 5967
	        start_va = 0x7ff87eed0000
	          end_va = 0x7ff87ef3afff
	       monitored = 0
	     entry_point = 0x7ff87eee90c0
	     region_type = mapped_file
	            name = "ws2_32.dll"
	        filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")

Region:
	              id = 5968
	        start_va = 0x7ff87efa0000
	          end_va = 0x7ff87efa7fff
	       monitored = 0
	     entry_point = 0x7ff87efa1ea0
	     region_type = mapped_file
	            name = "nsi.dll"
	        filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")

Region:
	              id = 5969
	        start_va = 0x7ff87f3e0000
	          end_va = 0x7ff87f565fff
	       monitored = 0
	     entry_point = 0x7ff87f42ffc0
	     region_type = mapped_file
	            name = "gdi32.dll"
	        filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")

Region:
	              id = 5970
	        start_va = 0x7ff87f640000
	          end_va = 0x7ff87f6ecfff
	       monitored = 0
	     entry_point = 0x7ff87f6581a0
	     region_type = mapped_file
	            name = "kernel32.dll"
	        filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")

Region:
	              id = 5971
	        start_va = 0x7ff87f6f0000
	          end_va = 0x7ff87f96cfff
	       monitored = 0
	     entry_point = 0x7ff87f7c4970
	     region_type = mapped_file
	            name = "combase.dll"
	        filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")

Region:
	              id = 5972
	        start_va = 0x7ff87f970000
	          end_va = 0x7ff87f9cafff
	       monitored = 0
	     entry_point = 0x7ff87f9838b0
	     region_type = mapped_file
	            name = "sechost.dll"
	        filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")

Region:
	              id = 5973
	        start_va = 0x7ff87f9d0000
	          end_va = 0x7ff87fa76fff
	       monitored = 0
	     entry_point = 0x7ff87f9db4d0
	     region_type = mapped_file
	            name = "clbcatq.dll"
	        filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")

Region:
	              id = 5974
	        start_va = 0x7ff87fa80000
	          end_va = 0x7ff87fb40fff
	       monitored = 0
	     entry_point = 0x7ff87faa0da0
	     region_type = mapped_file
	            name = "oleaut32.dll"
	        filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")

Region:
	              id = 5975
	        start_va = 0x7ff87fd30000
	          end_va = 0x7ff87fdd6fff
	       monitored = 0
	     entry_point = 0x7ff87fd458d0
	     region_type = mapped_file
	            name = "advapi32.dll"
	        filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")

Region:
	              id = 5976
	        start_va = 0x7ff87fde0000
	          end_va = 0x7ff87fe7cfff
	       monitored = 0
	     entry_point = 0x7ff87fde78a0
	     region_type = mapped_file
	            name = "msvcrt.dll"
	        filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")

Region:
	              id = 5977
	        start_va = 0x7ff87fe80000
	          end_va = 0x7ff87ff9bfff
	       monitored = 0
	     entry_point = 0x7ff87fec02b0
	     region_type = mapped_file
	            name = "rpcrt4.dll"
	        filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")

Region:
	              id = 5978
	        start_va = 0x7ff87ffa0000
	          end_va = 0x7ff880160fff
	       monitored = 0
	     entry_point = 0x0
	     region_type = mapped_file
	            name = "ntdll.dll"
	        filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")


Thread:
	id = 401
	os_tid = 0x9c0


Thread:
	id = 402
	os_tid = 0xce0


Thread:
	id = 403
	os_tid = 0x1228


Thread:
	id = 404
	os_tid = 0xb58


Thread:
	id = 405
	os_tid = 0x424


Thread:
	id = 406
	os_tid = 0xb84


Thread:
	id = 407
	os_tid = 0xb88


Thread:
	id = 408
	os_tid = 0xf88


Thread:
	id = 409
	os_tid = 0xda0


Thread:
	id = 410
	os_tid = 0x6d8


Thread:
	id = 411
	os_tid = 0x458


Thread:
	id = 412
	os_tid = 0x444


Thread:
	id = 413
	os_tid = 0x440


Thread:
	id = 414
	os_tid = 0x414


Thread:
	id = 415
	os_tid = 0x410


Thread:
	id = 416
	os_tid = 0x260


Thread:
	id = 417
	os_tid = 0x270


Thread:
	id = 418
	os_tid = 0x148


Thread:
	id = 419
	os_tid = 0x1b4


Thread:
	id = 420
	os_tid = 0x1b8


Thread:
	id = 421
	os_tid = 0x184


Thread:
	id = 422
	os_tid = 0x37c